OpenSSL 簽發憑證方式 [Jonathan's Wiki 筆記]

本頁是唯讀的，您可以看到原始碼，但不能更動它。您如果覺得它不應被鎖上，請詢問管理員。
====== OpenSSL 簽發憑證方式 ======
  * OpenSSL 版本 : openssl-0.9.8b-10.el5

===== - 根憑證 (Root CA) 作法：=====
==== - 建立根憑證 Private Key 檔 RootCA.key ====
<code sh>
openssl genrsa -des3 -out RootCA.key 2048
chmod og-rwx RootCA.key
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl genrsa -des3 -out RootCA.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................+++
.+++
e is 65537 (0x10001)
Enter pass phrase for RootCA.key:  <-- 設定 RootCA 密鑰的密碼
Verifying - Enter pass phrase for RootCA.key: <-- 再次輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ chmod og-rwx RootCA.key  <-- 讓 RootCA 只有自己可以讀寫
</cli>
++++

==== - 產生根憑證的申請檔 RootCA.req ====
<code sh>
openssl req -new -key RootCA.key -out RootCA.req
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl req -new -key RootCA.key -out RootCA.req
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []: <-- 可以不輸入
Common Name (eg, your name or your server's hostname) []:  <-- 不是當 Server 憑證不需要輸入
Email Address []:tryweb@ichiayi.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
[jonathan@pd920 ca]$
</cli>
++++
==== - 產生效期十年的根憑證檔 RootCA.crt ====
<code sh>
openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey RootCA.key -in RootCA.req -out RootCA.crt
rm -f RootCA.req
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey RootCA.key -in RootCA.req -out RootCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./emailAddress=tryweb@ichiayi.com
Getting Private key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f RootCA.req
</cli>
++++
|  {{:tech:rca_01.png?250&direct}}  |  {{:tech:rca_02.png?250&direct}}  |  {{:tech:rca_03.png?250&direct}}  |

===== - 伺服器憑證 (Server CA) 作法：=====
==== - 建立伺服器憑證 Private Key 檔 ServerCA.key ====
<code sh>
openssl genrsa -out ServerCA.key 2048
chmod og-rwx ServerCA.key
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl genrsa -out ServerCA.key 2048
Generating RSA private key, 2048 bit long modulus
.............................................+++
...........................................................................................................+++
e is 65537 (0x10001)
不會出現輸入密碼的訊息，因為 Server CA 不需要輸入密碼，否則啟動 Service 時會需要輸入密碼後，才可繼續執行服務
</cli>
++++

==== - 產生伺服器憑證的申請檔 ServerCA.req ====
<code sh>
openssl req -new -key ServerCA.key -out ServerCA.req
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl req -new -key ServerCA.key -out ServerCA.req
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []: <-- 可以不輸入
Common Name (eg, your name or your server's hostname) []:mail.ichiayi.com <-- 輸入 Server 的 Domain Name
Email Address []:tryweb@ichiayi.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
</cli>
++++

==== - 產生效期兩年的伺服器憑證檔 ServerCA.crt ====
<code sh>
openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key  -CAserial RootCA.srl -CAcreateserial -in ServerCA.req -out ServerCA.crt
rm -f ServerCA.req
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key  -CAserial RootCA.srl -CAcreateserial -in ServerCA.req -out ServerCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./CN=mail.ichiayi.com/emailAddress=tryweb@ichiayi.com
Getting CA Private Key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f ServerCA.req
</cli>
++++

|  {{:tech:ca_00.png?250}}  |  {{:tech:ca_02.png?250}}  |  {{:tech:ca_01.png?250}}  |

===== - 用戶憑證 (Client CA) 作法：=====
==== - 建立用戶憑證 Private Key 檔 ClientCA.key ====
<code sh>
openssl genrsa -des3 -out ClientCA.key 2048
chmod og-rwx ClientCA.key
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl genrsa -des3 -out ClientCA.key 2048
Generating RSA private key, 2048 bit long modulus
...........+++
................................................+++
e is 65537 (0x10001)
Enter pass phrase for ClientCA.key: <- 設定用戶憑證密碼
Verifying - Enter pass phrase for ClientCA.key: <- 再次輸入確認密碼
[jonathan@pd920 ca]$ chmod og-rwx ClientCA.key
</cli>
++++

==== - 產生用戶憑證的申請檔 ClientCA.req ====
<code sh>
openssl req -new -key ClientCA.key -out ClientCA.req
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl req -new -key ClientCA.key -out ClientCA.req
Enter pass phrase for ClientCA.key: <- 輸入用戶憑證密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []:Tech.
Common Name (eg, your name or your server's hostname) []:Jonathan Tsai
Email Address []:jonathan@ichiayi.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
</cli>
++++

==== - 產生效期兩年的用戶憑證檔 ClientCA.crt ====
<code sh>
openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key  -CAserial RootCA.srl -CAcreateserial -in ClientCA.req -out ClientCA.crt
rm -f ClientCA.req
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key  -CAserial RootCA.srl -CAcreateserial -in ClientCA.req -out ClientCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./OU=Tech./CN=Jonathan Tsai/emailAddress=jonathan@ichiayi.com
Getting CA Private Key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f ClientCA.req
</cli>
++++
==== - 將 ClientCA.crt 與 ClientCA.key 轉成 ClientCA.pfx ====
<code sh>
openssl pkcs12 -export -in ClientCA.crt -inkey ClientCA.key -out ClientCA.pfx
</code>
++++看產生結果|
<cli>
[jonathan@pd920 ca]$ openssl pkcs12 -export -in ClientCA.crt -inkey ClientCA.key -out ClientCA.pfx
Enter pass phrase for ClientCA.key: <-- 輸入用戶憑證密碼
Enter Export Password: <-- 設定匯出用戶憑證時的密碼, 可以和用戶憑證密碼相同
Verifying - Enter Export Password: <-- 輸入確認匯出用戶憑證時的密碼
</cli>
++++

{{gallery>tech:clientca?lightbox}}

  * 看到 apache 的 ssl_request_log 發現 IE7 使用 **TLSv1 RC4-MD5**, Firefox3 使用 **SSLv3 DHE-RSA-AES256-SHA**, cURL 7.15.5 使用 **TLSv1 DHE-RSA-AES256-SHA**
<cli>
[root@pd920 httpd]# cat ssl_request_log
[20/Aug/2008:16:28:12 +0800] 192.168.11.248 TLSv1 RC4-MD5 "GET /t.txt HTTP/1.1" 25   <-- IE7
[20/Aug/2008:16:46:14 +0800] 192.168.11.248 SSLv3 DHE-RSA-AES256-SHA "GET /t.txt HTTP/1.1" 25  <-- Firefox3
[21/Aug/2008:12:18:55 +0800] 127.0.0.1 TLSv1 DHE-RSA-AES256-SHA "GET /t.txt HTTP/1.1" 5 <-- cURL 7.15.5
[root@pd920 httpd]#
</cli>

===== 參考網址 =====
  * http://www.uniorg.net/redirect.php?fid=8&goto=nextoldset&tid=48
  * http://chinaunix.net/jh/13/523585.html

{{tag>openssl ca pki}}