To sign a certificate with a CA

This article original from Http://blog.csdn.net/voipmaker reprint annotated source.

This series is divided into three articles, mainly about building your own certificate issuance services, generating certificate requests, and signing and eventually applying the generated certificate request to the service through your own built ca.

This article is the last one, combined with the previous two articles, you can sign your own application with your own built-in CA.

This article assumes that you have referred to the signature two-article process,
CA Key in Directory/home/cg/myca/private/
CA Root Certificate in/home/cg/myca/certs/
CA configuration file in/home/cg/myca/conf/
Serial in/home/cg/myca/
Index.txt in/home/cg/myca/


Copy the CSR file Csr.server1.pem to the/home/cg/myca/csr/directory


To sign the CSR:


OpenSSL x509-days 3650-ca certs/crt.ca.cg.pem-cakey private/key.ca.cg.pem-req-in csr/csr.server1.pem-outform Pem-ou T certs/crt.server1.pem-caserial serial


Final file Certs/crt.server1.pem
That is, the generated signing certificate

To sign a certificate with a CA