http通過openssl轉https

標籤：cer   服務   new   ica   efault   htm   serial   val   ati   

1.建立CA伺服器

詳情可以參考我的另一篇文章 ： http://www.cnblogs.com/zhaojiedi1992/p/zhaojiedi_linux_011_ca.html

1.1 建立必要的目錄和檔案

[[email protected] CA]# mkdir csr crl newcerts[[email protected] CA]# touch index.txt serial[[email protected] CA]# echo 01>serial

1.2 修改預設配置

[[email protected] CA]# vim /etc/pki/tls/openssl.cnf #編輯以下行， 設定預設的國家，省，城市，組織名，部門名countryName_default             = CNstateOrProvinceName_default     = HeNanlocalityName_default    = ZhengZhouorganizationName_default        = ZKYTorganizationalUnitName_default  = Tech  

1.3產生自簽認證

[[email protected] CA]# (umask 077;openssl  genrsa -out private/cakey.pem 2048)Generating RSA private key, 2048 bit long modulus........................................................................................................................................+++...+++e is 65537 (0x10001)[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter ‘.‘, the field will be left blank.-----Country Name (2 letter code) [CN]:State or Province Name (full name) [HeNan]:Locality Name (eg, city) [ZhengZhou]:Organization Name (eg, company) [ZKYT]:Organizational Unit Name (eg, section) [Tech]:Common Name (eg, your name or your server‘s hostname) []:ca.linuxpanda.comEmail Address []:

 

http通過openssl轉https