OpenSSL 簽發憑證方式

[jonathan@pd920 ca]$ openssl genrsa -des3 -out RootCA.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................+++
.+++
e is 65537 (0x10001)
Enter pass phrase for RootCA.key:  <-- 設定 RootCA 密鑰的密碼
Verifying - Enter pass phrase for RootCA.key: <-- 再次輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ chmod og-rwx RootCA.key  <-- 讓 RootCA 只有自己可以讀寫

[jonathan@pd920 ca]$ openssl req -new -key RootCA.key -out RootCA.req
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []: <-- 可以不輸入
Common Name (eg, your name or your server's hostname) []:  <-- 不是當 Server 憑證不需要輸入
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
[jonathan@pd920 ca]$

[jonathan@pd920 ca]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey RootCA.key -in RootCA.req -out RootCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./[email protected]
Getting Private key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f RootCA.req

[jonathan@pd920 ca]$ openssl genrsa -out ServerCA.key 2048
Generating RSA private key, 2048 bit long modulus
.............................................+++
...........................................................................................................+++
e is 65537 (0x10001)
不會出現輸入密碼的訊息，因為 Server CA 不需要輸入密碼，否則啟動 Service 時會需要輸入密碼後，才可繼續執行服務

[jonathan@pd920 ca]$ openssl req -new -key ServerCA.key -out ServerCA.req
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []: <-- 可以不輸入
Common Name (eg, your name or your server's hostname) []:mail.ichiayi.com <-- 輸入 Server 的 Domain Name
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入

[jonathan@pd920 ca]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key  -CAserial RootCA.srl -CAcreateserial -in ServerCA.req -out ServerCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./CN=mail.ichiayi.com/[email protected]
Getting CA Private Key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f ServerCA.req

[jonathan@pd920 ca]$ openssl genrsa -des3 -out ClientCA.key 2048
Generating RSA private key, 2048 bit long modulus
...........+++
................................................+++
e is 65537 (0x10001)
Enter pass phrase for ClientCA.key: <- 設定用戶憑證密碼
Verifying - Enter pass phrase for ClientCA.key: <- 再次輸入確認密碼
[jonathan@pd920 ca]$ chmod og-rwx ClientCA.key

[jonathan@pd920 ca]$ openssl req -new -key ClientCA.key -out ClientCA.req
Enter pass phrase for ClientCA.key: <- 輸入用戶憑證密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []:Tech.
Common Name (eg, your name or your server's hostname) []:Jonathan Tsai
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入

[jonathan@pd920 ca]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key  -CAserial RootCA.srl -CAcreateserial -in ClientCA.req -out ClientCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./OU=Tech./CN=Jonathan Tsai/[email protected]
Getting CA Private Key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f ClientCA.req

[jonathan@pd920 ca]$ openssl pkcs12 -export -in ClientCA.crt -inkey ClientCA.key -out ClientCA.pfx
Enter pass phrase for ClientCA.key: <-- 輸入用戶憑證密碼
Enter Export Password: <-- 設定匯出用戶憑證時的密碼, 可以和用戶憑證密碼相同
Verifying - Enter Export Password: <-- 輸入確認匯出用戶憑證時的密碼