https伺服器的配置（三）建立私人CA和認證

標籤：ca   認證   

首先在其他主機上建立一個私人的CA

假如我我現在就另外開一台虛擬機器

登入進去

一、生存一對密鑰（私密金鑰和公開金鑰，公開金鑰可以在私密金鑰中提取因此建立私密金鑰就可以了）

[[email protected] ~]#cd/etc/pki/CA

[[email protected] CA]#(umask 077; opensslgenrsa –out private/cakey.pem 2048)

 

二、產生CA的認證

[[email protected] CA]# openssl req -new -x509-key private/cakey.pem -out cacert.pem

 

You are about to be asked to enterinformation that will be incorporated

into your certificate request.

What you are about to enter is what iscalled a Distinguished Name or a DN.

There are quite a few fields but you canleave some blank

For some fields there will be a defaultvalue,

If you enter ‘.‘, the field will be leftblank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:Henan

Locality Name (eg, city) [DefaultCity]:Zhengzhou

Organization Name (eg, company) [DefaultCompany Ltd]:HuangBY

Organizational Unit Name (eg, section)[]:Tech

Common Name (eg, your name or your server‘shostname) []:www.huangbaoying.com

Email Address []:[email protected]

 

Please enter the following ‘extra‘attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[[email protected] CA]# mkdir certs newcerts crl

[[email protected] CA]# touch index.txt

[[email protected] CA]# touch serial

[[email protected] CA]# echo 01 > serial

OK準備給人家簽證吧

 

三、好了，現在在httpd伺服器的主機上

[[email protected] ~]# cd /etc/httpd/

[[email protected] httpd]# mkdir ssl

[[email protected] httpd]#cd ssl

建立私密金鑰

[[email protected] ssl]# (umask 077; opensslgenrsa –out httpd.key 1024)

建立認證

[[email protected] CA]# openssl req –new -key httpd.key-out httpd.csr

 

把認證發給CA

 

現在我們切換到CA如果你在同一台主機上就不再切換了

四、簽證

[[email protected] ~]#openssl ca –in httpd.csr –outhttpd.crt –days 3650

好了簽證完畢把httpd.crt發給httpd的伺服器主機

 

五、登入到httpd的伺服器主機

將收到的httpd.crt放到/etc/httpd/ssl/下面去備用

本文出自 “奔向互連網” 部落格，請務必保留此出處http://huangbaoying.blog.51cto.com/9267029/1604725

https伺服器的配置（三）建立私人CA和認證