Linux下如颁发证书：学习使用OpenSSL搭建一个CA.doc

下面是用OpenSSL这个强大的工具，在Linux下构建一个CA，来实现证书管理，我们用一个web服务器端作为需要证书的客户端 1.首先我们来给CA生成一个私钥 切换到/etc/pki/CA/目录，使用openssl命令给自己生成一个私钥 [root@?openssl]#?cd?/etc/pki/CA/?? [root@?CA]#?ls?? private?? [root@?CA]#?(umak?66;openssl?genrsa?2046??private/cakey.pem)?? -bash:?umak:?command?not?found?? Generating?RSA?private?key,?2046?bit?long?modulus?? .............................+++?? ..+++?? e?is?65537?(0x10001)?? 2. CA需要一个自签证书，所以我们给它使用openssl命令生成一个自签证书 [root@?CA]#?openssl?req?-new?-x509?-key?private/cakey.pem?-out?cacert.pem?? You?are?about?to?be?asked?to?enter?information?that?will?be?incorporated?? into?your?certificate?request.?? What?you?are?about?to?enter?is?what?is?called?a?Distinguished?Name?or?a?DN.?? There?are?quite?a?few?fields?but?you?can?leave?some?blank?? For?some?fields?there?will?be?a?default?value,?? If?you?enter?.,?the?field?will?be?left?blank.?? -----?? Country?Name?(2?letter?code)?[GB]:CN???????????????????????????????????????????????????????????#?输入你的各项信息，国家?，?省或州，地区，公司，单位，域名，邮箱地址?? State?or?Province?Name?(full?name)?[Berkshire]:Henan????? Locality?Name?(eg,?city)?[Newbury]:Zhengzhou?? Organization?Name?(eg,?company)?[My?Company?Ltd]:LINUX?? Organizational?Unit?Name?(eg,?section)?[]:Tech?? Common?Name?(eg,?your?name?or?your?servers?hostname)?[]:???#需要注意的是，这个域名是FQDN(完全限定域名)?? Email?Address?[]:ca@?? [root@?CA]#?ls?? cacert.pem??private?? 3.编辑CA配置文件，它位于etc/pki/tls/f，它的作用是指定你的CA所在目录，更改默认属性值 [root@?CA]#?vim?/etc/pki/tls/f?? [?CA_default?]?? ?? dir?????????????=?../../CA??????????????#?Where?everything?is?kept??????**************CA路径?，修改为绝对路径?? certs???????????=?$dir/certs????????????#?Where?the?issued?certs?are?kept??????????×××××××发给其他的人的证书??，该目录需要手动创建?? crl_dir?????????=?$dir/crl??????????????#?Where?the?issued?crl?are?kept???××××××证书吊销列表??不属于必须创建的目录?? database????????=?$dir/index.txt????????#?database?index?file.???????*****************存放生成证书文件索引??需要手动创建的文件?? #unique_subject?=?no????????????????????#?Set?to?no?to?allow?creation?of??????? ??????????????????????????????