证书生成

    Linux环境安装了openssl组件。

    1. 搭建CA环境。

    2. 生成根私钥。

      2. openssl genrsa -aes256 -out demoCA/private/cakey.pem 2048
      3. Generating RSA private key, 2048 bit long modulus
      4. .................+++
      5. ..................+++
      6. e is 65537 (0x10001)
      7. --设置根私钥的保护密码，最少要求4个字符，假设为Test@123
      8. Enter pass phrase for demoCA/private/cakey.pem:
      9. --再次输入私钥密码 Test@123
      10. Verifying - Enter pass phrase for demoCA/private/cakey.pem:

    3. 生成根证书请求文件。

      1. --生成CA根证书申请文件server.req
      2. openssl req -config openssl.cnf -new -key demoCA/private/cakey.pem -out demoCA/careq.pem
      3. Enter pass phrase for demoCA/private/cakey.pem:
      4. --输入根私钥密码 Test@123
      5. You are about to be asked to enter information that will be incorporated
      6. into your certificate request.
      7. What you are about to enter is what is called a Distinguished Name or a DN.
      8. There are quite a few fields but you can leave some blank
      9. For some fields there will be a default value,
      10. If you enter '.', the field will be left blank.
      11. -----
      13. --以下名称请牢记，生成服务器证书和客户端证书时填写的信息需要与此处的一致
      14. Country Name (2 letter code) [AU]:CN
      15. State or Province Name (full name) [Some-State]:shanxi
      16. Locality Name (eg, city) []:xian
      17. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abc
      18. Organizational Unit Name (eg, section) []:hello
      19. --Common Name可以随意命名
      20. Common Name (eg, YOUR name) []:world
      21. --Email可以选择性填写
      22. Email Address []:
      24. Please enter the following 'extra' attributes
      25. to be sent with your certificate request
      26. A challenge password []:
      27. An optional company name []:

    4. 生成自签发根证书。

      1.     Serial Number: 1 (0x1)
      2.     Validity
      3.         Not Before: Feb 28 02:17:11 2017 GMT
      4.         Not After : Feb 28 02:17:11 2018 GMT
      5.     Subject:
      6.         countryName               = CN
      7.         stateOrProvinceName       = shanxi
      8.         organizationalUnitName    = hello
      9.         commonName                = world
      11.         X509v3 Basic Constraints: 
      12.             CA:FALSE
      13.         Netscape Comment: 
      14.             OpenSSL Generated Certificate
      15.         X509v3 Subject Key Identifier: 
      16.             F9:91:50:B2:42:8C:A8:D3:41:B0:E4:42:CB:C2:BE:8D:B7:8C:17:1F
      17.         X509v3 Authority Key Identifier: 
      18.             keyid:F9:91:50:B2:42:8C:A8:D3:41:B0:E4:42:CB:C2:BE:8D:B7:8C:17:1F

      Certificate is to be certified until Feb 28 02:17:11 2018 GMT (365 days) Sign the certificate? [y/n]:y

    1. 生成服务端证书私钥。

      1. --生成服务器私钥文件server.key
      2. openssl genrsa -aes256 -out server.key 2048
      3. Generating a 2048 bit RSA private key
      4. .......++++++
      5. ..++++++
      6. e is 65537 (0x10001)
      7. Enter pass phrase for server.key:
      8. --服务器私钥的保护密码，最少要求4个字符，假设为Test@123
      9. Verifying - Enter pass phrase for server.key:
      10. --再次确认服务器私钥的保护密码，即为Test@123

    2. 生成服务端证书请求文件。

      1. --生成服务器证书请求文件server.req
      2. openssl req -config openssl.cnf -new -key server.key -out server.req
      3. Enter pass phrase for server.key:
      4. You are about to be asked to enter information that will be incorporated
      5. into your certificate request.
      6. What you are about to enter is what is called a Distinguished Name or a DN.
      7. There are quite a few fields but you can leave some blank
      8. For some fields there will be a default value,
      9. If you enter '.', the field will be left blank.
      10. -----
      12. --以下填写的信息与创建CA时的信息一致
      13. Country Name (2 letter code) [AU]:CN
      14. State or Province Name (full name) [Some-State]:shanxi
      15. Locality Name (eg, city) []:xian
      16. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abc
      17. Organizational Unit Name (eg, section) []:hello
      18. --Common Name可以随意命名
      19. Common Name (eg, YOUR name) []:world
      20. Email Address []:
      21. --以下信息可以选择性填写
      22. Please enter the following 'extra' attributes
      23. to be sent with your certificate request
      24. A challenge password []:
      25. An optional company name []:

    3. 生成服务端证书。

      1. --生成服务端/客户端证书时，修改openssl.cnf文件，设置basicConstraints=CA:FALSE
      2. vi openssl.cnf
      5. --对生成的服务器证书请求文件进行签发，签发后将生成正式的服务器证书server.crt
      6. openssl ca  -config openssl.cnf -in server.req -out server.crt -days 3650 -md sha256
      7. Using configuration from /etc/ssl/openssl.cnf
      8. Enter pass phrase for ./demoCA/private/cakey.pem:
      9. Check that the request matches the signature
      10. Signature ok
      11. Certificate Details:
      12.         Serial Number: 2 (0x2)
      13.         Validity
      14.             Not Before: Feb 27 10:11:12 2017 GMT
      15.             Not After : Feb 25 10:11:12 2027 GMT
      16.         Subject:
      17.             countryName               = CN
      18.             stateOrProvinceName       = shanxi
      19.             organizationName          = Abc
      20.             organizationalUnitName    = hello
      21.             commonName                = world
      22.         X509v3 extensions:
      23.             X509v3 Basic Constraints: 
      24.                 CA:FALSE
      25.             Netscape Comment: 
      26.                 OpenSSL Generated Certificate
      27.             X509v3 Subject Key Identifier: 
      28.                 EB:D9:EE:C0:D2:14:48:AD:EB:BB:AD:B6:29:2C:6C:72:96:5C:38:35
      29.             X509v3 Authority Key Identifier: 
      30.                 keyid:84:F6:A1:65:16:1F:28:8A:B7:0D:CB:7E:19:76:2A:8B:F5:2B:5C:6A
      32. Certificate is to be certified until Feb 25 10:11:12 2027 GMT (3650 days)
      33. --选择y对证书进行签发
      34. Sign the certificate? [y/n]:y
      36. --选择y，证书签发结束
      37. 1 out of 1 certificate requests certified, commit? [y/n]y
      38. Write out database with 1 new entries
      39. Data Base Updated

      去掉私钥密码保护，方法如下：

    4. 生成客户端证书和客户端私钥的方法和要求与服务器相同。

      1. --生成客户端私钥
      2. openssl genrsa -aes256 -out client.key 2048
      3. --生成客户端证书请求文件
      4. openssl req -config openssl.cnf -new -key client.key -out client.req 
      5. --对生成的客户端证书请求文件进行签发，签发后将生成正式的客户端证书client.crt
      6. openssl ca -config openssl.cnf -in client.req -out client.crt -days 3650 -md sha256

      去掉私钥密码保护，方法如下：

      1. --去掉客户端私钥的密码
      2. openssl rsa -in client.key -out client.key
      3. --如果不去掉客户端私钥的密码保护需要使用gs_guc工具对存储密码进行加密保护
      4. gs_guc encrypt -M client -K Test@123 -D ./

      将客户端密钥转化为DER格式，方法如下：

      1. openssl pkcs8 -topk8 -outform DER -in client.key -out client.key.pk8 -nocrypt

    5. 吊销证书列表的生成。

      如果需要吊销列表，可按照如下方法生成：