首页 > 代码库 > 搭建私有CA服务器

搭建私有CA服务器

2024-09-10 12:36:14   215人阅读

 

1.CA是什么

CA（Certificate Authority）证书颁发机构主要负责证书的颁发、管理以及归档和吊销。证书内包含了拥有证书者的姓名、地址、电子邮件帐号、公钥、证书有效期、发放证书的CA、CA的数字签名等信息。证书主要有三大功能：加密、签名、身份验证。

2.搭建CA服务器

2.1 生成秘钥

[root@localhost CA]# cd /etc/pki/CA/               #切换到CA目录[root@localhost CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048)  #调用openssl子命令genrsa生成私钥Generating RSA private key, 2048 bit long modulus..+++...................................................................................................................................................................................................................+++e is 65537 (0x10001)

注：上述命令使用（）扩着，表示在当前shell的子shell执行,()内的设定只在子shell内生效，每个命令使用“；”分割 ， umask指定掩码， -out选项指定了生成的私钥存放位置，不指定是输出到终端的。2048 指定秘钥的长度，默认是1024。

2.2自签证书

[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter ‘.‘, the field will be left blank.-----Country Name (2 letter code) [GB]:CNState or Province Name (full name) [Berkshire]:ZHENGZHOULocality Name (eg, city) [Newbury]:[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter ‘.‘, the field will be left blank.-----Country Name (2 letter code) [GB]:CNState or Province Name (full name) [Berkshire]:HENANLocality Name (eg, city) [Newbury]:ZHENGZHOUOrganization Name (eg, company) [My Company Ltd]:ZKYTOrganizational Unit Name (eg, section) []:TECHCommon Name (eg, your name or your server‘s hostname) []:ca.linuxpanda.comEmail Address []:caadmin@linuxpanda.com
  • req：生成证书签署请求
  • -x509：生成自签署证书
  • -days n：证书的有效天数
  • -new：新请求
  • -key /path/to/keyfile：指定私钥文件
  • -out /path/to/somefile：输出证书文件位置

3.初始化工作环境

[root@localhost CA]# touch index.txt serial   #创建index.txt,serial文件[root@localhost CA]# echo 01 >serial          #写入初始值

[root@localhost CA]# mkdir csr          #创建csr目录
  • index.txt：索引文件，用于匹配证书编号
  • serial：证书序列号文件，只在首次生成证书时赋值

3.节点申请证书

3.1生成密钥对

[root@localhost CA]# cd /etc/httpd/ssl                       #进入httpd的配置子目录ssl-bash: cd: /etc/httpd/ssl: No such file or directory[root@localhost CA]# lscacert.pem  index.txt  private  serial[root@localhost CA]# cd /etc/httpd/　　　　　　　　　　　　　　　#查看目录情况[root@localhost httpd]# lsconf  conf.d  logs  modules  run　　[root@localhost httpd]# mkdir ssl　　　　　　　　　　　　　　    #创建ssl目录，用于存放秘钥[root@localhost httpd]# (umask 077; openssl genrsa -out ssl/httpd.key 2048) #生成私钥Generating RSA private key, 2048 bit long modulus.+++............................+++e is 65537 (0x10001)

3.2生成证书请求

[root@localhost httpd]# openssl req -new -key ssl/httpd.key  -out ssl/httpd.csrYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter ‘.‘, the field will be left blank.-----Country Name (2 letter code) [GB]:CNState or Province Name (full name) [Berkshire]:HENAN Locality Name (eg, city) [Newbury]:ZHENGZHOU Organization Name (eg, company) [My Company Ltd]:ZKYTOrganizational Unit Name (eg, section) []:TECHCommon Name (eg, your name or your server‘s hostname) []:tech1.linuxpanda.comEmail Address []:Please enter the following ‘extra‘ attributesto be sent with your certificate requestA challenge password []:An optional company name []:

3.3证书请求文件发送到服务器

 

搭建私有CA服务器


联系
我们