创建CA和申请证书（一）
实验环境：
两台centos主机，一台充当CA，一台充当客户机。
在实现这个实验之前我们先来，看一下openssl的配置文件：/etc/pki/tls/openssl.cnf。在这个文件中定义了CA证书颁发的一些策略和文件命名和存放的规则。
[root@CA ~]# cat /etc/pki/tls/openssl.cnf
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha256 # use SHA-256 by default
preserve = no # keep passed DN ordering
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
/etc/pki/CA/的目录结构树
[root@CA CA]# tree
.
├── certs
├── crl
├── newcerts
└── private
接下来实现OpenSSL证书申请和颁发
在CA主机上
1、创建所需要的文件，这两个文件默认不存在，必须事先创建好，否则无法颁发证书。
[root@CA CA]# touch /etc/pki/CA/index.txt //生成证书索引数据库文件
[root@CA CA]# echo 01 > /etc/pki/CA/serial //指定第一个颁发证书的序列号
2、 CA自签证书
生成私钥
[root@CA ~]# cd /etc/pki/CA/
[root@CA CA]# (umask 066;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.........................................................................+++
......................................................+++
e is 65537 (0x10001)
3、生成自签名证书
[root@CA CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 7300 -out /etc/pki/CA/cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HN
Locality Name (eg, city) [Default City]:wenchang
Organization Name (eg, company) [Default Company Ltd]:hailian
Organizational Unit Name (eg, section) []:hailian-30
Common Name (eg, your name or your server's hostname) []:www.cwj.com
Email Address []:
-new: 生成新证书签署请求
-x509: 专用于CA生成自签证书
-key: 生成请求时用到的私钥文件
-days n：证书的有效期限
-out /PATH/TO/SOMECERTFILE: 证书的保存路径
在申请证书的主机上
4、 在需要使用证书的主机生成证书请求
[root@client pki]# (umask 066; openssl genrsa -out /etc/pki/tls/private/test.key 2048)
Generating RSA private key, 2048 bit long modulus
.....+++
..............................................................................+++
e is 65537 (0x10001)
5、生成证书申请文件
[root@client pki]# openssl req -new -key /etc/pki/tls/private/test.key -days 365 -out /etc/pki/tls/test.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HN
Locality Name (eg, city) [Default City]:hangzhou
Organization Name (eg, company) [Default Company Ltd]:hailian
Organizational Unit Name (eg, section) []:hailian-30
Common Name (eg, your name or your server's hostname) []:www.yd.cwj.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
6、 将证书请求文件传输给CA
[root@client pki]# scp /etc/pki/tls/test.csr 192.168.239.130:/data/
test.csr 100% 1013 32.2KB/s 00:00
在CA上
7、 CA签署证书，并将证书颁发给请求者
[root@CA CA]# openssl ca -in /data/test.csr -out /etc/pki/CA/certs/test.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Oct 17 14:04:52 2019 GMT
Not After : Oct 16 14:04:52 2020 GMT
Subject:
countryName = CN
stateOrProvinceName = HN
organizationName = hailian
organizationalUnitName = hailian-30
commonName = www.yd.cwj.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
76:F4:4D:C1:96:21:98:A3:D2:6A:70:AF:C8:9E:C1:C4:26:9D:06:7D
X509v3 Authority Key Identifier:
keyid:C7:93:0F:D2:1D:E4:FA:2E:11:52:48:5D:9E:9F:10:98:71:DE:BB:20
Certificate is to be certified until Oct 16 14:04:52 2020 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
8、把证书复制到申请的主机上即可。
[root@CA CA]# scp /etc/pki/CA/certs/test.crt 192.168.239.128:/data
test.crt 100% 4471 187.3KB/s 00:00
注意：默认国家，省，公司名称三项必须和CA一致
证书颁发完成后，可以查看证书中的信息：
[root@CA CA]# openssl x509 -in /etc/pki/CA/certs/test.crt -noout -issuer
issuer= /C=CN/ST=HN/L=wenchang/O=hailian/OU=hailian-30/CN=www.cwj.com
[root@CA CA]# openssl x509 -in /etc/pki/CA/certs/test.crt -noout -subject
subject= /C=CN/ST=HN/O=hailian/OU=hailian-30/CN=www.yd.cwj.com
[root@CA CA]# openssl x509 -in /etc/pki/CA/certs/test.crt -noout -serial -dates
serial=01
notBefore=Oct 17 14:04:52 2019 GMT
notAfter=Oct 16 14:04:52 2020 GMT
也可以查看指定编号的证书状态
[root@CA CA]# openssl ca -status 01 //查看指定编号的证书状态
Using configuration from /etc/pki/tls/openssl.cnf
01=Valid (V)
颁发完证书后CA的目录树结构
[root@CA CA]# tree
.
├── cacert.pem
├── certs
│ └── test.crt
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│ └── 01.pem
├── private
│ └── cakey.pem
├── serial
└── serial.old
我们也可以吊销证书，下面是吊销证书的步骤。
1、在客户端获取要吊销的证书的serial
[root@CA CA]# openssl x509 -in /etc/pki/CA/certs/test.crt -noout -serial -subject
serial=01
subject= /C=CN/ST=HN/O=hailian/OU=hailian-30/CN=www.yd.cwj.com
[root@CA CA]# cat index.txt
V 201016140452Z 01 unknown /C=CN/ST=HN/O=hailian/OU=hailian-30/CN=www.yd.cwj.com
2、在CA上，根据客户提交的serial与subject信息，对比检验是否与index.txt文件中的信息一致，然后选择要吊销的证书：
[root@CA CA]# openssl ca -revoke /etc/pki/CA/newcerts/01.pem
Using configuration from /etc/pki/tls/openssl.cnf
Revoking Certificate 01.
Data Base Updated
3、指定第一个吊销证书的编号
注意：第一次更新证书吊销列表前，才需要执行
[root@CA CA]# echo 01 > /etc/pki/CA/crlnumber
4、更新证书吊销列表
[root@CA CA]# openssl ca -gencrl -out /etc/pki/CA/crl.pem
Using configuration from /etc/pki/tls/openssl.cnf
完成后可以查看crl文件：
[root@CA CA]# openssl crl -in /etc/pki/CA/crl.pem -noout -text
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: /C=CN/ST=HN/L=wenchang/O=hailian/OU=hailian-30/CN=www.cwj.com
Last Update: Oct 17 14:22:47 2019 GMT
Next Update: Nov 16 14:22:47 2019 GMT
CRL extensions:
X509v3 CRL Number:
1
Revoked Certificates:
Serial Number: 01
Revocation Date: Oct 17 14:21:28 2019 GMT
Signature Algorithm: sha256WithRSAEncryption
80:89:a6:52:0a:09:94:cf:73:60:ee:cb:f9:d4:a3:76:48:26:
b2:b2:f0:5c:b4:45:af:35:12:f4:7e:06:e8:80:1a:1c:38:cd:
5b:37:2e:f4:e7:7a:48:f4:cb:a7:e9:9a:85:8a:44:18:08:61:
39:d3:61:c3:df:a2:f7:02:6f:df:53:6b:36:39:6a:0e:41:d8:
71:46:5b:52:fb:3d:96:9a:46:a4:f4:5e:84:41:31:56:ee:85:
e4:37:c7:64:d7:37:80:5c:11:b5:8e:b3:7f:db:4f:2b:98:a5:
b7:73:d1:90:26:ff:04:68:dd:65:5e:67:1c:98:67:4e:6c:9f:
d7:63:c8:b6:cf:17:aa:ee:d4:ca:ad:c1:9d:a8:57:38:14:e9:
16:52:68:ea:6c:48:f8:92:03:bd:b3:88:47:c5:4a:50:7c:df:
ee:b5:70:75:c7:d0:93:68:5e:6e:a4:45:54:5b:73:60:8e:a4:
da:ef:8f:0d:2a:5b:33:20:07:39:0d:c5:ee:ce:27:20:9c:fa:
12:4e:ea:62:95:16:ea:64:a1:0d:b0:cb:57:6c:a8:96:fa:a9:
fa:44:99:bb:c5:56:5a:3b:0d:dc:d2:42:c6:77:12:27:79:f7:
90:a6:e4:61:00:fb:64:a6:94:b9:aa:32:3c:07:c0:58:5d:4e:
91:f9:4a:1d
吊销证书后CA的目录结构
[root@CA CA]# ls
cacert.pem certs crl crlnumber crlnumber.old crl.pem index.txt index.txt.attr index.txt.attr.old index.txt.old newcerts private serial serial.old
[root@CA CA]# tree
.
├── cacert.pem
├── certs
│ └── test.crt
├── crl
├── crlnumber
├── crlnumber.old
├── crl.pem
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── newcerts
│ └── 01.pem
├── private
│ └── cakey.pem
├── serial
└── serial.old
4 directories, 13 files