1.查看软件包是否安装

[root@rrcy ~]# rpm -qa |grep ssl
nss_compat_ossl-0.9.6-1.el6.x86_64
openssl-1.0.1e-16.el6_5.7.x86_64
openssl-devel-1.0.1e-16.el6_5.7.x86_64
mod_ssl-2.2.15-30.el6.centos.x86_64

2.切换到CA目录
[root@rrcy ~]# cd /etc/pki/CA/
[root@rrcy CA]# ls
certs  crl  newcerts  private
[root@rrcy CA]# pwd
/etc/pki/CA

3.创建一个rsa 私钥 2048位
cakey.pem 

[root@rrcy CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
............................................................................................+++
..............................+++
e is 65537 (0x10001)

权限600
[root@rrcy CA]# ls -l private/cakey.pem
-rw------- 1 root root 1679 Jul 28 14:32 private/cakey.pem

4.生成自签证书

[root@rrcy CA]# vim ../tls/openssl.cnf

修改countryName_default             = XX 默认国家名字CN

修改stateOrProvinceName_default     = Fujian 默认省会名称

localityName_default    = Fuzhou 城市名称

0.organizationName_default      = MageEdu 组织名称

organizationalUnitName_default  = Tech 部门名称

[root@rrcy CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) [Fujian]:
Locality Name (eg, city) [Fuzhou]:
Organization Name (eg, company) [MageEdu]:
Organizational Unit Name (eg, section) [Tech]:
Common Name (eg, your name or your server‘s hostname) []:ca.magedu.com
Email Address []:admin@magedu.com

[ CA_default ]

dir             = /etc/pki/CA

5.创建证书

[root@rrcy CA]# cd /etc/httpd/
[root@rrcy httpd]# ls
conf  conf.d  logs  modules  run
[root@rrcy httpd]# mkdir ssl
[root@rrcy httpd]# ls
conf  conf.d  logs  modules  run  ssl
[root@rrcy httpd]# cd ssl/
[root@rrcy ssl]# (umask 077;openssl genrsa 1024 >httpd.key)
Generating RSA private key, 1024 bit long modulus
................++++++
..................++++++
e is 65537 (0x10001)
[root@rrcy ssl]# ll
total 4
-rw------- 1 root root 887 Jul 28 14:49 httpd.key
[root@rrcy ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [Fujian]:
Locality Name (eg, city) [Fuzhou]:
Organization Name (eg, company) [MageEdu]:
Organizational Unit Name (eg, section) [Tech]:
Common Name (eg, your name or your server‘s hostname) []:hello.magedu.com  
Email Address []:

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@rrcy ssl]# ls
httpd.csr  httpd.key

6.颁发证书

[root@rrcy ssl]# openssl ca -in httpd.csr -out httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 28 06:53:08 2014 GMT
            Not After : Jul 25 06:53:08 2024 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Fujian
            organizationName          = MageEdu
            organizationalUnitName    = Tech
            commonName                = hello.magedu.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                D4:5B:C9:45:2E:27:94:62:85:90:33:CB:38:ED:61:26:B1:B2:D8:CF
            X509v3 Authority Key Identifier:
                keyid:EA:DB:92:B3:D2:20:A3:9D:28:E8:73:6D:64:0D:EF:6D:5F:4A:D6:7B

Certificate is to be certified until Jul 25 06:53:08 2024 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@rrcy ssl]# cd /etc/pki/CA/
[root@rrcy CA]# ls
cacert.pem  crl        index.txt.attr  newcerts  serial
certs       index.txt  index.txt.old   private   serial.old
[root@rrcy CA]# cat index.txt
V 240725065308Z  01 unknown /C=CN/ST=Fujian/O=MageEdu/OU=Tech/CN=hello.magedu.com
[root@rrcy CA]# cat serial
02

本文出自 “steven 业精于勤荒于嬉..” 博客，请务必保留此出处http://steven2.blog.51cto.com/855881/1531485