1. Generate the private key server.key on the server side
[root@localhost opensscommand]# openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
..................++++++
..................++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
Second, generate server-side certificate request server.csr
[root@localhost opensscommand]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:sanxi
Locality Name (eg, city) [Default City]:xian
Organization Name (eg, company) [Default Company Ltd]:Family Network
Organizational Unit Name (eg, section) []:Home
Common Name (eg, your name or your server's hostname) []:cakin24
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:
The following information needs to be entered during the build process:
Country Name: cn two-letter country code
State or Province Name: sanxi province name
Locality Name: xian city name
Organization Name: Family Network Company Name
Organizational Unit Name: Home Department Name
Common Name: cakin24 your name
Email Address: [email protected] Email address
3. Generate the client's private key client.key
[root@localhost opensscommand]# openssl genrsa -des3 -out client.key 1024
Generating RSA private key, 1024 bit long modulus
..................................................................................................++++++
.................++++++
e is 65537 (0x10001)
Enter pass phrase for client.key:
Verifying - Enter pass phrase for client.key:
四 生成客户端证书请求client.csr
[root@localhost opensscommand]# openssl req -new -key client.key -out client.csr
Enter pass phrase for client.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:sanxi
Locality Name (eg, city) [Default City]:xian
Organization Name (eg, company) [Default Company Ltd]:Family Network
Organizational Unit Name (eg, section) []:Home
Common Name (eg, your name or your server's hostname) []:cakin24
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:
五 生成自签名根证书ca.crt
[root@localhost opensscommand]# openssl req -new -x509 -keyout ca.key -out ca.crt
Generating a 2048 bit RSA private key
.................................+++
............+++
writing new private key to 'ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:sanxi
Locality Name (eg, city) [Default City]:xian
Organization Name (eg, company) [Default Company Ltd]:Family Network
Organizational Unit Name (eg, section) []:Home
Common Name (eg, your name or your server's hostname) []:cakin24
Email Address []:[email protected]
六 用ca.crt给server.csr,client.csr文件签名
openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
七 证书使用方法
client使用的文件有：ca.crt,client.crt,client.key
server使用的文件有：ca.crt,server.crt,server.key