Commands -often used OpenSSL

wenzk

Openssl的一些常用命令
Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev
Chapter 24. Software -Networking/Encryption
Next
24.6. Commands -often used
The commands listed below are some that we use often, but many more
exist. Check the man pages and documentation for more details and
information. As an example, we'll show you how to create certificates
for your Apache Web Server and/or your own CA Certifying Authority to sign your Certificate Signing Request yourself.


: All commands listed below are assumed to be made in the /etc/ssl/ directory.
Create a RSA private key protected with a passphrase for your Apache Server.
         [root@deep ]/ssl#openssl genrsa -des3 -out server.key 1024
         
         Generating RSA private key, 1024 bit long modulus
         ......................+++++
         .....+++++
         e is 65537 (0x10001)
         Enter PEM pass phrase:
         Verifying password - Enter PEM pass phrase:
         Please backup this server.key file and remember the pass-phrase you had to enter at a secure location.
         
Generate a Certificate Signing Request CSR with the server RSA private key.
         [root@deep ]/ssl# openssl req -new -key server.key -out server.csr
         
         Using configuration from /etc/ssl/openssl.cnf
         Enter PEM pass phrase:
         You are about to be asked to enter information that will be incorporated
         into your certificate request.
         What you are about to enter is what is called a Distinguished Name or a DN.
         There are quite a few fields but you can leave some blank
         For some fields there will be a default value,
         If you enter '.', the field will be left blank.
         -----
         Country Name (2 letter code) [CA]:
         State or Province Name (full name) [Quebec]:
         Locality Name (eg, city) [Montreal]:
         Organization Name (eg, company) [Open Network Architecture]:
         Organizational Unit Name (eg, section) [Internet Department]:
         Common Name (eg, YOUR name) [www.openna.com]:
         Email Address [admin@openna.com]:
         Please enter the following 'extra' attributes
         to be sent with your certificate request
         A challenge password []:.
         An optional company name []:.
         


: Make sure you enter the FQDN, Fully Qualified Domain Name of the server when OpenSSL prompts you for the CommonName, i.e. when you generate a CSR for a website which will be later accessed via https://www.mydomain.com/, enter www.mydomain.com here.
After generation of your Certificate Signing Request; CSR, you have two choices:

the first is to send this certificate to a commercial Certifying Authority (CA) like Verisign or Thawte for signing. You usually have to post the CSR into a web form, pay for the signing, await the signed Certificate and store it into a server.crt file. The result is then a real Certificate, which can be used for Apache.

Second, you can use your own CA and now have to sign the CSR yourself by this CA. This solution is economical, and allows an organization to host their own CA server and generate as many certificates as they need for internal use without paying any cent to a commercial CA. Unfortunately. using your own CA
to generate certificates cause problems in electronic commerce, because
customers need to have some trust in your organization by the use of
recognized commercial CA.
See below on how to sign a CSR with your CA yourself.
Create a RSA private key for your CA.
         [root@deep ]/ssl# openssl genrsa -des3 -out ca.key 1024
         
         Generating RSA private key, 1024 bit long modulus
         ...........................+++++
         ............................................+++++
         e is 65537 (0x10001)
         Enter PEM pass phrase:
         Verifying password - Enter PEM pass phrase:
         Please backup this ca.key file and remember the pass-phrase you had to enter at a secure location.
         
Create a self-signed CA certificate x509 structure with the RSA key of the CA.
         [root@deep ]/ssl# openssl req -new -x509 -days 365 -key ca.key -out ca.crt
         
         Using configuration from /etc/ssl/openssl.cnf
         Enter PEM pass phrase:
         You are about to be asked to enter information that will be incorporated
         into your certificate request.
         What you are about to enter is what is called a Distinguished Name or a DN.
         There are quite a few fields but you can leave some blank
         For some fields there will be a default value,
         If you enter '.', the field will be left blank.
         -----
         Country Name (2 letter code) [CA]:
         State or Province Name (full name) [Quebec]:
         Locality Name (eg, city) [Montreal]:
         Organization Name (eg, company) [Open Network Architecture]:
         Organizational Unit Name (eg, section) [Internet Department]:CA Marketing
         Common Name (eg, YOUR name) [www.openna.com]:
         Email Address [admin@openna.com]:
         
         [root@deep ]/ssl# mv server.key private/
         [root@deep ]/ssl# mv ca.key private/
         [root@deep ]/ssl# mv ca.crt certs/
         


: The req command creates a self-signed certificate when the -x509 switch is used.
Signing a certificate request. We create and use our own Certificate Authority -CA, Prepare the script for signing which is needed because the openssl ca command has some strange requirements, and the default OpenSSL config doesn't allow one easily to use openssl ca directly. The script named sign.sh is distributed with the floppy disk under the openssl directory. Use this script for signing. Now you can use this CA to sign server CSR's in order to create real SSL Certificates for use inside an Apache Webserver assuming you already have a server.csr at hand:
         [root@deep ]/ssl# /usr/bin/sign.sh server.csr
         
         CA signing: server.csr -> server.crt:
         Using configuration from ca.config
         Enter PEM pass phrase:
         Check that the request matches the signature
         Signature ok
         The Subjects Distinguished Name is as follows
         countryName                   :PRINTABLE:'CA'
         stateOrProvinceName           :PRINTABLE:'Quebec'
         localityName                  :PRINTABLE:'Montreal'
         organizationName              :PRINTABLE:'Open Network Architecture'
         organizationalUnitName        :PRINTABLE:'Internet Department'
         commonName                    :PRINTABLE:'www.openna.com'
         emailAddress                  :IA5STRING:'admin@openna.com'
         Certificate is to be certified until Dec  1 14:59:29 2000 GMT (365 days)
         Sign the certificate? [y/n]:y
         1 out of 1 certificate requests certified, commit? [y/n]y
         Write out database with 1 new entries
         Data Base Updated
         CA verifying: server.crt  CA cert
         server.crt: OK
         
This signs the CSR and results in a server.crt file.
         [root@deep ]/ssl# mv server.crt certs/
         Now you have two files: server.key and server.crt. These can now, for example, be used as follows, inside your Apache server's httpd.conf file:
         SSLCertificateFile    /etc/ssl/certs/server.crt         


         SSLCertificateKeyFile /etc/ssl/private/server.key         


         


Our web server public key


Our web server private key The server.csr file is no longer needed.
         [root@deep ]/ssl# rm -f server.csr
         


: If you receive error message during signature of the certificate, it's probably because you've entered the wrong FQDN, Fully Qualified Domain Name for the server when OpenSSL prompted you for the CommonName; the CommonName must be something like my.domain.com and not domain.com. Also, since you generate both the certificate and the CA
certificate, it's important that at least one piece of information
differs between both files, or you may encounter problems during the
signature of the certificate request.
Prev
Home
Next
Create the /usr/bin/sign.sh program file
Up
Securing OpenSSL

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/2389/showart_27381.html