logo
搜索
我的图书馆

发文章

发文工具

其他工具

留言交流
搜索
分享

建立你自己的 CA 服务：OpenSSL 命令行 CA 操作快速指南

 gljin_cn 2015-05-15

这些是关于使用 OpenSSL 生成证书授权（CA）、中间证书授权和末端证书的速记随笔，内容包括 OCSP、CRL 和 CA 颁发者信息，以及指定颁发和有效期限等。

我们将建立我们自己的根 CA，我们将使用根 CA 来生成一个中间 CA 的例子，我们将使用中间 CA 来签署末端用户证书。

根 CA

创建根 CA 授权目录并切换到该目录：

  1. mkdir ~/SSLCA/root/
  2. cd ~/SSLCA/root/

为我们的根 CA 生成一个8192位长的 SHA-256 RSA 密钥：

  1. openssl genrsa -aes256 -out rootca.key 8192

样例输出：

  1. Generating RSA private key, 8192 bit long modulus
  2. .........++
  3. ....................................................................................................................++
  4. e is 65537 (0x10001)

如果你想要用密码保护该密钥，请添加 -aes256 选项。

创建自签名根 CA 证书 ca.crt；你需要为你的根 CA 提供一个身份：

  1. openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt

样例输出：

  1. You are about to be asked to enter information that will be incorporated
  2. into your certificate request.
  3. What you are about to enter is what is called a Distinguished Name or a DN.
  4. There are quite a few fields but you can leave some blank
  5. For some fields there will be a default value,
  6. If you enter '.', the field will be left blank.
  7. -----
  8. Country Name (2 letter code) [AU]:NL
  9. State or Province Name (full name) [Some-State]:Zuid Holland
  10. Locality Name (eg, city) []:Rotterdam
  11. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Sparkling Network
  12. Organizational Unit Name (eg, section) []:Sparkling CA
  13. Common Name (e.g. server FQDN or YOUR name) []:Sparkling Root CA
  14. Email Address []:

创建一个存储 CA 序列的文件：

  1. touch certindex
  2. echo 1000 > certserial
  3. echo 1000 > crlnumber

放置 CA 配置文件，该文件持有 CRL 和 OCSP 末端的存根。

  1. # vim ca.conf
  2. [ ca ]
  3. default_ca = myca
  5. [ crl_ext ]
  6. issuerAltName=issuer:copy 
  7. authorityKeyIdentifier=keyid:always
  9.  [ myca ]
  10.  dir = ./
  11.  new_certs_dir = $dir
  12.  unique_subject = no
  13.  certificate = $dir/rootca.crt
  14.  database = $dir/certindex
  15.  private_key = $dir/rootca.key
  16.  serial = $dir/certserial
  17.  default_days = 730
  18.  default_md = sha1
  19.  policy = myca_policy
  20.  x509_extensions = myca_extensions
  21.  crlnumber = $dir/crlnumber
  22.  default_crl_days = 730
  24.  [ myca_policy ]
  25.  commonName = supplied
  26.  stateOrProvinceName = supplied
  27.  countryName = optional
  28.  emailAddress = optional
  29.  organizationName = supplied
  30.  organizationalUnitName = optional
  32.  [ myca_extensions ]
  33.  basicConstraints = critical,CA:TRUE
  34.  keyUsage = critical,any
  35.  subjectKeyIdentifier = hash
  36.  authorityKeyIdentifier = keyid:always,issuer
  37.  keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
  38.  extendedKeyUsage = serverAuth
  39.  crlDistributionPoints = @crl_section
  40.  subjectAltName  = @alt_names
  41.  authorityInfoAccess = @ocsp_section
  43.  [ v3_ca ]
  44.  basicConstraints = critical,CA:TRUE,pathlen:0
  45.  keyUsage = critical,any
  46.  subjectKeyIdentifier = hash
  47.  authorityKeyIdentifier = keyid:always,issuer
  48.  keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
  49.  extendedKeyUsage = serverAuth
  50.  crlDistributionPoints = @crl_section
  51.  subjectAltName  = @alt_names
  52.  authorityInfoAccess = @ocsp_section
  54.  [alt_names]
  55.  DNS.0 = Sparkling Intermidiate CA 1
  56.  DNS.1 = Sparkling CA Intermidiate 1
  58.  [crl_section]
  59.  URI.0 = http://pki.sparklingca.com/SparklingRoot.crl
  60.  URI.1 = http://pki.backup.com/SparklingRoot.crl
  62.  [ocsp_section]
  63.  caIssuers;URI.0 = http://pki.sparklingca.com/SparklingRoot.crt
  64.  caIssuers;URI.1 = http://pki.backup.com/SparklingRoot.crt
  65.  OCSP;URI.0 = http://pki.sparklingca.com/ocsp/
  66.  OCSP;URI.1 = http://pki.backup.com/ocsp/

如果你需要设置某个特定的证书生效/过期日期，请添加以下内容到[myca]：

  1. # format: YYYYMMDDHHMMSS
  2. default_enddate = 20191222035911
  3. default_startdate = 20181222035911

创建中间 CA

生成中间 CA （名为 intermediate1）的私钥：

  1. openssl genrsa -out intermediate1.key 4096

生成中间 CA 的 CSR：

  1. openssl req -new -sha256 -key intermediate1.key -out intermediate1.csr

样例输出：

  1. You are about to be asked to enter information that will be incorporated
  2. into your certificate request.
  3. What you are about to enter is what is called a Distinguished Name or a DN.
  4. There are quite a few fields but you can leave some blank
  5. For some fields there will be a default value,
  6. If you enter '.', the field will be left blank.
  7. -----
  8. Country Name (2 letter code) [AU]:NL
  9. State or Province Name (full name) [Some-State]:Zuid Holland
  10. Locality Name (eg, city) []:Rotterdam
  11. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Sparkling Network
  12. Organizational Unit Name (eg, section) []:Sparkling CA
  13. Common Name (e.g. server FQDN or YOUR name) []:Sparkling Intermediate CA
  14. Email Address []:
  16. Please enter the following 'extra' attributes
  17. to be sent with your certificate request
  18. A challenge password []:
  19. An optional company name []:

确保中间 CA 的主体（CN）和根 CA 不同。

用根 CA 签署中间 CA 的 CSR：

  1. openssl ca -batch -config ca.conf -notext -in intermediate1.csr -out intermediate1.crt

样例输出：

  1. Using configuration from ca.conf
  2. Check that the request matches the signature
  3. Signature ok
  4. The Subject's Distinguished Name is as follows
  5. countryName           :PRINTABLE:'NL'
  6. stateOrProvinceName   :ASN.1 12:'Zuid Holland'
  7. localityName          :ASN.1 12:'Rotterdam'
  8. organizationName      :ASN.1 12:'Sparkling Network'
  9. organizationalUnitName:ASN.1 12:'Sparkling CA'
  10. commonName            :ASN.1 12:'Sparkling Intermediate CA'
  11. Certificate is to be certified until Mar 30 15:07:43 2017 GMT (730 days)
  13. Write out database with 1 new entries
  14. Data Base Updated

生成 CRL（同时采用 PEM 和 DER 格式）：

  1. openssl ca -config ca.conf -gencrl -keyfile rootca.key -cert rootca.crt -out rootca.crl.pem
  3. openssl crl -inform PEM -in rootca.crl.pem -outform DER -out rootca.crl

每次使用该 CA 签署证书后，请生成 CRL。

如果你需要撤销该中间证书：

  1. openssl ca -config ca.conf -revoke intermediate1.crt -keyfile rootca.key -cert rootca.crt

配置中间 CA

为该中间 CA 创建一个新文件夹，然后进入该文件夹：

  1. mkdir ~/SSLCA/intermediate1/
  2. cd ~/SSLCA/intermediate1/

从根 CA 拷贝中间证书和密钥：

  1. cp ~/SSLCA/root/intermediate1.key ./
  2. cp ~/SSLCA/root/intermediate1.crt ./

创建索引文件：

  1. touch certindex
  2. echo 1000 > certserial
  3. echo 1000 > crlnumber

创建一个新的 ca.conf 文件：

  1. # vim ca.conf
  2. [ ca ]
  3. default_ca = myca
  5. [ crl_ext ]
  6. issuerAltName=issuer:copy 
  7. authorityKeyIdentifier=keyid:always
  9.  [ myca ]
  10.  dir = ./
  11.  new_certs_dir = $dir
  12.  unique_subject = no
  13.  certificate = $dir/intermediate1.crt
  14.  database = $dir/certindex
  15.  private_key = $dir/intermediate1.key
  16.  serial = $dir/certserial
  17.  default_days = 365
  18.  default_md = sha1
  19.  policy = myca_policy
  20.  x509_extensions = myca_extensions
  21.  crlnumber = $dir/crlnumber
  22.  default_crl_days = 365
  24.  [ myca_policy ]
  25.  commonName = supplied
  26.  stateOrProvinceName = supplied
  27.  countryName = optional
  28.  emailAddress = optional
  29.  organizationName = supplied
  30.  organizationalUnitName = optional
  32.  [ myca_extensions ]
  33.  basicConstraints = critical,CA:FALSE
  34.  keyUsage = critical,any
  35.  subjectKeyIdentifier = hash
  36.  authorityKeyIdentifier = keyid:always,issuer
  37.  keyUsage = digitalSignature,keyEncipherment
  38.  extendedKeyUsage = serverAuth
  39.  crlDistributionPoints = @crl_section
  40.  subjectAltName  = @alt_names
  41.  authorityInfoAccess = @ocsp_section
  43.  [alt_names]
  44.  DNS.0 = example.com
  45.  DNS.1 = example.org
  47.  [crl_section]
  48.  URI.0 = http://pki.sparklingca.com/SparklingIntermidiate1.crl
  49.  URI.1 = http://pki.backup.com/SparklingIntermidiate1.crl
  51.  [ocsp_section]
  52.  caIssuers;URI.0 = http://pki.sparklingca.com/SparklingIntermediate1.crt
  53.  caIssuers;URI.1 = http://pki.backup.com/SparklingIntermediate1.crt
  54.  OCSP;URI.0 = http://pki.sparklingca.com/ocsp/
  55.  OCSP;URI.1 = http://pki.backup.com/ocsp/

修改 [alt_names] 部分，添加你需要的主体备选名。如果你不需要主体备选名，请移除该部分包括subjectAltName = @alt_names的行。

如果你需要设置一个指定的生效/到期日期，请添加以下内容到 [myca]：

  1. # format: YYYYMMDDHHMMSS
  2. default_enddate = 20191222035911
  3. default_startdate = 20181222035911

生成一个空白 CRL（同时以 PEM 和 DER 格式）：

  1. openssl ca -config ca.conf -gencrl -keyfile rootca.key -cert rootca.crt -out rootca.crl.pem
  3. openssl crl -inform PEM -in rootca.crl.pem -outform DER -out rootca.crl

生成末端用户证书

我们使用这个新的中间 CA 来生成一个末端用户证书，请重复以下操作来使用该 CA 为每个用户签署。

  1. mkdir enduser-certs

生成末端用户的私钥：

  1. openssl genrsa -out enduser-certs/enduser-example.com.key 4096

生成末端用户的 CSR：

  1. openssl req -new -sha256 -key enduser-certs/enduser-example.com.key -out enduser-certs/enduser-example.com.csr

样例输出：

  1. You are about to be asked to enter information that will be incorporated
  2. into your certificate request.
  3. What you are about to enter is what is called a Distinguished Name or a DN.
  4. There are quite a few fields but you can leave some blank
  5. For some fields there will be a default value,
  6. If you enter '.', the field will be left blank.
  7. -----
  8. Country Name (2 letter code) [AU]:NL
  9. State or Province Name (full name) [Some-State]:Noord Holland
  10. Locality Name (eg, city) []:Amsterdam
  11. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Inc
  12. Organizational Unit Name (eg, section) []:IT Dept
  13. Common Name (e.g. server FQDN or YOUR name) []:example.com
  14. Email Address []:
  16. Please enter the following 'extra' attributes
  17. to be sent with your certificate request
  18. A challenge password []:
  19. An optional company name []:

使用中间 CA 签署末端用户的 CSR：

  1. openssl ca -batch -config ca.conf -notext -in enduser-certs/enduser-example.com.csr -out enduser-certs/enduser-example.com.crt

样例输出：

  1. Using configuration from ca.conf
  2. Check that the request matches the signature
  3. Signature ok
  4. The Subject's Distinguished Name is as follows
  5. countryName           :PRINTABLE:'NL'
  6. stateOrProvinceName   :ASN.1 12:'Noord Holland'
  7. localityName          :ASN.1 12:'Amsterdam'
  8. organizationName      :ASN.1 12:'Example Inc'
  9. organizationalUnitName:ASN.1 12:'IT Dept'
  10. commonName            :ASN.1 12:'example.com'
  11. Certificate is to be certified until Mar 30 15:18:26 2016 GMT (365 days)
  13. Write out database with 1 new entries
  14. Data Base Updated

生成 CRL（同时以 PEM 和 DER 格式）：

  1. openssl ca -config ca.conf -gencrl -keyfile intermediate1.key -cert intermediate1.crt -out intermediate1.crl.pem
  3. openssl crl -inform PEM -in intermediate1.crl.pem -outform DER -out intermediate1.crl

每次你使用该 CA 签署证书后，都需要生成 CRL。

如果你需要撤销该末端用户证书：

  1. openssl ca -config ca.conf -revoke enduser-certs/enduser-example.com.crt -keyfile intermediate1.key -cert intermediate1.crt

样例输出：

  1. Using configuration from ca.conf
  2. Revoking Certificate 1000.
  3. Data Base Updated

通过连接根证书和中间证书来创建证书链文件。

  1. cat ../root/rootca.crt intermediate1.crt > enduser-certs/enduser-example.com.chain

发送以下文件给末端用户：

  1. enduser-example.com.crt
  2. enduser-example.com.key
  3. enduser-example.com.chain

你也可以让末端用户提供他们自己的 CSR，而只发送给他们这个 .crt 文件。不要把它从服务器删除，否则你就不能撤销了。

校验证书

你可以对证书链使用以下命令来验证末端用户证书：

  1. openssl verify -CAfile enduser-certs/enduser-example.com.chain enduser-certs/enduser-example.com.crt 
  2. enduser-certs/enduser-example.com.crt: OK

你也可以针对 CRL 来验证。首先，将 PEM 格式的 CRL 和证书链相连接：

  1. cat ../root/rootca.crt intermediate1.crt intermediate1.crl.pem > enduser-certs/enduser-example.com.crl.chain

验证证书：

  1. openssl verify -crl_check -CAfile enduser-certs/enduser-example.com.crl.chain enduser-certs/enduser-example.com.crt

没有撤销时的输出：

  1. enduser-certs/enduser-example.com.crt: OK

撤销后的输出如下：

  1. enduser-certs/enduser-example.com.crt: CN = example.com, ST = Noord Holland, C = NL, O = Example Inc, OU = IT Dept
  2. error 23 at 0 depth lookup:certificate revoked

via: https:///s/tutorials/OpenSSL_command_line_Root_and_Intermediate_CA_including_OCSP_CRL%20and_revocation.html

作者：Remy van Elst 译者：GOLinux 校对：wxy

本文由 LCTT 原创翻译，Linux中国 荣誉推出

原文：https:///s/tutorials/OpenSSL_command_line_Root_and_Intermediate_CA_including_OCSP_CRL%20and_revocation.html 作者： Remy van Elst
译文：LCTT  https:///article-5443-1.html 译者： GOLinux

本文由 LCTT 原创翻译，Linux中国首发。也想加入译者行列，为开源做一些自己的贡献么？欢迎加入 LCTT！
翻译工作和译文发表仅用于学习和交流目的，翻译工作遵照CC 协议规定，如果我们的工作有侵犯到您的权益，请及时联系我们。
欢迎遵照CC 协议规定转载，敬请在正文中标注并保留原文/译文链接和作者/译者等信息。
文章仅代表作者的知识和看法，如有不同观点，请楼下排队吐槽 :D

    本站是提供个人知识管理的网络存储空间，所有内容均由用户发布，不代表本站观点。请注意甄别内容中的联系方式、诱导购买等信息，谨防诈骗。如发现有害或侵权内容，请点击一键举报。
    转藏 分享 献花（0）

    来自： gljin_cn > 《安全》

    举报/认领

    0条评论

    发表

    请遵守用户 评论公约

    类似文章 更多