SSL認證產生方法

一般情況下，如果能找到可用的認證，就可以直接使用，只不過會因認證的某些資訊不正確或與部署認證的主機不匹配而導致瀏覽器提示認證無效，但這並不影響使用。

需要手工產生認證的情況有： 找不到可用的認證 需要配置雙向SSL，但缺少用戶端認證 需要對認證作特別的定製

首先，無論是在Linux下還是在Windows下的Cygwin中，進行下面的操作前都須確認已安裝OpenSSL軟體包。

1. 建立根憑證密鑰檔案(自己做CA)root.key：

openssl genrsa -des3 -out root.key

輸出內容為：

[lenin@archer ~]$ openssl genrsa -des3 -out root.key
Generating RSA private key, 512 bit long modulus
……………..++++++++++++
..++++++++++++
e is 65537 (0×10001)
Enter pass phrase for root.key: ← 輸入一個新密碼
Verifying – Enter pass phrase for root.key: ← 重新輸入一遍密碼

2. 建立根憑證的申請檔案root.csr：

openssl req -new -key root.key -out root.csr

輸出內容為：

[lenin@archer ~]$ openssl req -new -key root.key -out root.csr
Enter pass phrase for root.key: ← 輸入前面建立的密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN ← 國家代號，中國輸入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音
Locality Name (eg, city) []:BeiJing ← 市的全名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不輸入
Common Name (eg, YOUR name) []: ← 此時不輸入
Email Address []:admin@mycompany.com ← 電子郵箱，可隨意填

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不輸入
An optional company name []: ← 可以不輸入

3. 建立一個自當前日期起為期十年的根憑證root.crt：

openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.req -out root.crt

輸出內容為：

[lenin@archer ~]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./emailAddress=admin@mycompany.com
Getting Private key
Enter pass phrase for root.key: ← 輸入前面建立的密碼

4. 建立伺服器憑證密鑰server.key：

openssl genrsa –des3 -out server.key 2048

輸出內容為：

[lenin@archer ~]$ openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
….+++
…………………………………………..+++
e is 65537 (0×10001)

運行時會提示輸入密碼,此密碼用於加密key檔案(參數des3便是指密碼編譯演算法,當然也可以選用其他你認為安全的演算法.),以後每當需讀取此檔案(通過openssl提供的命令或API)都需輸入口令.如果覺得不方便,也可以去除這個口令,但一定要採取其他的保護措施!
去除key檔案口令的命令:
openssl rsa -in server.key -out server.key

5.建立伺服器憑證的申請檔案server.csr：

openssl req -new -key server.key -out server.csr

輸出內容為：

[lenin@archer ~]$ openssl req -new -key server.key -out server.req
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN ← 國家名稱，中國輸入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省名，拼音
Locality Name (eg, city) []:BeiJing ← 市名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不輸入
Common Name (eg, YOUR name) []:www.mycompany.com ← 伺服器主機名稱，若填寫不正確，瀏覽器會報告認證無效，但並不影響使用
Email Address []:admin@mycompany.com ← 電子郵箱，可隨便填

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不輸入
An optional company name []: ← 可以不輸入

6. 建立自當前日期起有效期間為期兩年的伺服器憑證server.crt：

openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -out server.crt

輸出內容為：

[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in server.csr -out server.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=www.mycompany.com/emailAddress=admin@mycompany.com
Getting CA Private Key
Enter pass phrase for root.key: ← 輸入前面建立的密碼

7. 建立用戶端認證密鑰檔案client.key：

openssl genrsa -des3 -out client.key 2048

輸出內容為：

[lenin@archer ~]$ openssl genrsa -des3 -out client.key 2048
Generating RSA private key, 2048 bit long modulus
……………………………………………………………………………..+++
……………………………………………………………………………………………………….+++
e is 65537 (0×10001)
Enter pass phrase for client.key: ← 輸入一個新密碼
Verifying – Enter pass phrase for client.key: ← 重新輸入一遍密碼

8. 建立用戶端認證的申請檔案client.csr：

openssl req -new -key client.key -out client.csr

輸出內容為：

[lenin@archer ~]$ openssl req -new -key client.key -out client.csr
Enter pass phrase for client.key: ← 輸入上一步中建立的密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN ← 國家名稱，中國輸入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省名稱，拼音
Locality Name (eg, city) []:BeiJing ← 市名稱，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不填
Common Name (eg, YOUR name) []:Lenin ← 自己的英文名，可以隨便填
Email Address []:admin@mycompany.com ← 電子郵箱，可以隨便填

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不填
An optional company name []: ← 可以不填

9. 建立一個自當前日期起有效期間為兩年的用戶端認證client.crt：

openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -out client.crt

輸出內容為：

[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in client.csr -out client.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=www.mycompany.com/emailAddress=admin@mycompany.com
Getting CA Private Key
Enter pass phrase for root.key: ← 輸入上面建立的密碼

10. 將用戶端認證檔案client.crt和用戶端認證密鑰檔案client.key合并成用戶端認證安裝包client.pfx：

openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx

輸出內容為：

[lenin@archer ~]$ openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx
Enter pass phrase for client.key: ← 輸入上面建立的密碼
Enter Export Password: ← 輸入一個新的密碼，用作用戶端認證的保護密碼，在用戶端安裝認證時需要輸入此密碼
Verifying – Enter Export Password: ← 確認密碼

11. 儲存產生的檔案備用，其中server.crt和server.key是配置單向SSL時需要使用的認證檔案，client.crt是配置雙向SSL時需要使用的認證檔案，client.pfx是配置雙向SSL時需要用戶端安裝的認證檔案

     .crt檔案和.key可以合到一個檔案裡面，把2個檔案合成了一個.pem檔案（直接拷貝過去就行了）

參考：http://sinolog.it/?p=1460