OpenSSL为网络通信提供安全及数据完整性的一种安全协议,囊括了主要的密码算法、常用的密钥和证书封装管理功能以及SSL协议,并提供了丰富的应用程序供测试或其它目的使用。

OpenSSL包含一个命令行工具用来完成OpenSSL库中的所有功能,更好的是,它可能已经安装到你的系统中了。

OpenSSL是一个强大的安全套接字层密码库,Apache使用它加密HTTPS,OpenSSH使用它加密SSH,但是,你不应该只将其作为一个库来使用,它还是一个多用途的、跨平台的密码工具。
接下来,我们将要实现给予openssl的CA建立及证书签发。
进入/etc/pki/目录,
[root@localhost ~]# cd /etc/pki/
[root@localhost pki]#
编辑配置文件:
[root@localhost pki]# vim tls/openssl.cnf

 

 

需要注意的是,配置文件中的certs,crl,newcerts目录以及index.txt,serial文件都需要我们自己创建。
[root@localhost pki]# cd CA/
[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# touch index.txt serial
[root@localhost CA]#
给我们的serial文件一个初始序列号:
[root@localhost CA]# echo "01" >serial
[root@localhost CA]#
接下来,产生我们的私钥文件:
[root@localhost CA]# cd ..
[root@localhost pki]# openssl genrsa 1024 >CA/private/cakey.pem
Generating RSA private key, 1024 bit long modulus
.................................................++++++
...................................++++++
e is 65537 (0x10001)
[root@localhost pki]#
私钥文件要注意保密,我们可以通过设置权限来解决:

 

 

然后需要我们产生证书文件:
[root@localhost private]# cd ..
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:BEIJING
Locality Name (eg, city) [Newbury]:BEIJING
Organization Name (eg, company) [My Company Ltd]:seccenter
Organizational Unit Name (eg, section) []:tec
Common Name (eg, your name or your server's hostname) []:ca.net.net
Email Address []:
[root@localhost CA]#
如下图,已经产生我们证书文件了。

 

 

接下来去查看我们的证书文件:
[root@localhost CA]# openssl x509 -in cacert.pem -noout –text

 

 

 

完成了CA部分的实现,接下来需要为我们的 请求阶段做准备,
Apache服务已经安装:

 

 

打开一个关于CA的文件,修改部分默认配置:

进入/etc/pki/tls目录下,编辑openssl.cnf文件:

 

 

(修改了第136,141,144行)
产生私钥:
[root@localhost CA]# mkdir -pv /etc/httpd/certs
mkdir: 已创建目录 “/etc/httpd/certs”
[root@localhost CA]# cd /etc/httpd/certs/
[root@localhost certs]# openssl genrsa 1024 >httpd.key
Generating RSA private key, 1024 bit long modulus
.....++++++
..........................................................................................................++++++
e is 65537 (0x10001)
[root@localhost certs]#
[root@localhost certs]# chmod 600 httpd.key             //修改权限
[root@localhost certs]#
 
私钥搞定以后,需要一个请求:
[root@localhost certs]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BEIJING]:
Locality Name (eg, city) [BEIJING]:
Organization Name (eg, company) [My Company Ltd]:abc
Organizational Unit Name (eg, section) []:tec
Common Name (eg, your name or your server's hostname) []:www.abc.com
Email Address []:
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost certs]#
至此,请求部分完成。
把请求递交给CA。在线递交方式。
然后完成签署:
[root@localhost certs]#openssl ca –in httpd.csr –out httpd.cert
输入‘y’,完成签署。