文章目录
-
- 一、在 CentOS7 中使用 gpg 创建 RSA 非对称密钥对
- 二、将 CentOS7 导出的公钥，拷贝到 CentOS8 中，在 CentOS8 中使用 CentOS7 的公钥加密一个文件
- 三、回到 CentOS7 服务器，远程拷贝 file.txt.gpg 文件到本地，使用 CentOS7的私钥解密文件
- 四、在 CentOS7 中使用 openssl 软件创建 CA
- 五、 在 CentOS7 中使用 openssl 软件创建一个证书申请请求文件，并使用上面的跟证书对其进行签署
- 六、吊销已经签署成功的证书
一、在 CentOS7 中使用 gpg 创建 RSA 非对称密钥对
实验步骤大纲：
创建 RSA 非对称密钥对需要两步
1. 创建 RSA 非对称密钥对
2. 查看是否创建成功
`1. 创建 RSA 非对称密钥对`
[root@centos7 filecode]
gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1 <--------------
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) <--------------
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) <--------------
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: chenchen <--------------
Email address: <--------------
Comment: <--------------
You selected this USER-ID:
"chenchen"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key CE878036 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
pub 2048R/CE878036 2020-09-06
Key fingerprint = 2284 6905 355C 4FCD 1033 B0EA 404A D4B3 CE87 8036
uid chenchen
sub 2048R/C4A93B79 2020-09-06
`2. 查看是否创建成功`
[root@centos7 filecode]
/root/.gnupg/pubring.gpg <--------------
------------------------
pub 2048R/CE878036 2020-09-06 <--------------
uid chenchen <--------------
sub 2048R/C4A93B79 2020-09-06 <--------------
二、将 CentOS7 导出的公钥，拷贝到 CentOS8 中，在 CentOS8 中使用 CentOS7 的公钥加密一个文件
实验步骤大纲：
1. 将 Centos 7 的公钥导出
2. 拷贝到 Centos 8 中
3. 在 Centos 8 中使用 Centos 7 公钥加密文件
`1. 将 Centos 7 的公钥导出`
[root@centos7 filecode]
-a
--export
-o
`2. 拷贝到 Centos 8 中`
[root@centos7 filecode]
`3. 在 Centos 8 中使用 Centos 7 公钥加密文件`
[root@centos8 filecode]
[root@centos8 filecode]
hello,my name is centos8
[root@centos8 filecode]
[root@centos8 filecode]
[root@centos8 filecode]
-rw-r--r-- 1 root root 25 Sep 6 01:44 hello.txt
-rw-r--r-- 1 root root 363 Sep 6 01:46 hello.txt.gpg
三、回到 CentOS7 服务器，远程拷贝 file.txt.gpg 文件到本地，使用 CentOS7的私钥解密文件
实验步骤大纲：
1. 使用 scp 复制文件到本地
2. 使用私钥解密文件
`1. 使用 scp 复制文件到本地`
[root@centos8 filecode]
`2. 使用私钥解密文件`
[root@centos7 filecode]
You need a passphrase to unlock the secret key for
user: "chenchen"
2048-bit RSA key, ID 612635A8, created 2020-09-06 (main key ID 15FB8F96)
gpg: encrypted with 2048-bit RSA key, ID 612635A8, created 2020-09-06
"chenchen"
hello,my name is centos8
四、在 CentOS7 中使用 openssl 软件创建 CA
实验步骤大纲：
1. 创建 CA 私钥
2. 创建 CA 自签证书
因为 Centos 7 自带证书文件以及必须目录，所以就不需要创建了，如果是 Centos 8 是需要创建的
`1. 创建 CA 私钥`
[root@centos7 CA]
[root@centos7 CA]
`2. 创建 CA 自签证书`
[root@centos7 CA]
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shandong
Locality Name (eg, city) [Default City]:taian
Organization Name (eg, company) [Default Company Ltd]:ali
Organizational Unit Name (eg, section) []:devops
Common Name (eg, your name or your server's hostname) []:www.dingchen.club
Email Address []:[email protected]
五、 在 CentOS7 中使用 openssl 软件创建一个证书申请请求文件，并使用上面的跟证书对其进行签署
实验步骤大纲：
1. 生成证书请求
2. 颁发证书
`1. 生成证书请求`
[root@centos7 CA]
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shandong
Locality Name (eg, city) [Default City]:taian
Organization Name (eg, company) [Default Company Ltd]:ali
Organizational Unit Name (eg, section) []:devops
Common Name (eg, your name or your server's hostname) []:www.dingchen.club
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
`2. 颁发证书`
[root@centos7 CA]
六、吊销已经签署成功的证书
实验步骤大纲：
1. 查看证书编号
2. 吊销证书
`1. 查看证书编号`
[root@centos7 CA]
serial=04
subject= /C=CN/ST=shandong/O=ali/OU=devops/CN=www.dingchen.club/emailAddress=[email protected]
`2. 吊销证书`
[root@centos7 CA]
Using configuration from /etc/pki/tls/openssl.cnf
Revoking Certificate 04.
Data Base Updated
