创建简单的CA中心
转载自 向阳 http://www.hot-linux.com/
本文链接地址: http://www.hot-linux.com/centre-to-create-a-simple-ca/
1，安装openssl，
[root@station3 ~]# yum -y install openssl
2，编辑配置文件
[root@station3 ~]# vim /etc/pki/tls/openssl.cnf
3，如下：
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/my-ca.crt # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
crl = $dir/my-ca.crl # The current CRL
private_key = $dir/private/my-ca.key # The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
####################################################################
[ req ]
default_bits = 1024
default_md = sha1
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert
string_mask = MASK:0×2002
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = CN
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = hubei
localityName = Locality Name (eg, city)
localityName_default = wuhan
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Example, Inc.
3，因为配置文件中定义了其目录，所以：
[root@station3 ~]# cd /etc/pki/CA/
4，创建文件：
[root@station3 ~]# mkdir {certs,crl,newcerts}
[root@station3 CA]# echo 01 > serial
[root@station3 CA]# touch index.txt
5，生成私钥
[root@station3 CA]# (umask 077; opessl genrsa -out private/my-ca.key)
[root@station3 CA]# cd private/
[root@station3 private]# ll
total 8
-rw——- 1 root root 493 Mar 27 22:06 my-ca.key
这里可以看到这个私钥的权限，这里的私钥一定不能被别人拿去
6，根据上面的私钥，生成一把公钥
[root@station3 CA]# openssl req -new -x509 -key private/my-ca.key -days 365 > my-ca.crt
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
—–
Country Name (2 letter code) [CN]:
State or Province Name (full name) [hubei]:
Locality Name (eg, city) [wuhan]:
Organization Name (eg, company) [Example, Inc.]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
7，上面的公钥是要发给别人的，所以只要将上面的公钥给LDAP服务器就可以了
转载自 向阳 http://www.hot-linux.com/