CA认证及搭建过程
作者:互联网
CA认证的介绍
翻译成: 认证中心,主要用途:实现为用户发放数字证书。
认证中心(CA)功能: 证书发放,证书更新,证书撤销和证书验证
总结签证过程:
- 生成请求文件
- CA确认申请者的身份的真实性
- CA使用根证书私钥加密请求文件-生成证书
- 把证书发给申请者
问题: CA证书是免费的吗?
个人版是免费的(阿里云申请)
收费的
搭建CA认证
1. 安装ca认证软件包中心
[root@xinsz08-64 桌面]# rpm -qf `which openssl`openssl-1.0.1e-57.el6.x86_64
2. 配置一个自己的CA认证中心,生成CA的根证书和私钥。根证书包括 : CA公钥
[root@xinsz08-64 桌面]# vim /etc/pki/tls/openssl.cnf basicConstraints=CA:TRUE
3. 生成CA的公钥和私钥
[root@xinsz08-64 桌面]# /etc/pki/tls/misc/CA -h
-newcert 新证书
-newreq 新请求
-newreq-nodes 新请求节点
-newca 新的CA证书
-sign 签证
-verify 验证
[root@xinsz08-64 桌面]# /etc/pki/tls/misc/CA -newcaCA certificate filename (or enter to create)Making CA certificate ... Generating a 2048 bit RSA private key.............+++............................+++ writing new private key to '/etc/pki/CA/private/./cakey.pem'Enter PEM pass phrase:123456 Verifying - Enter PEM pass phrase: 123456 ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:beijing Locality Name (eg, city) [Default City]:haidian Organization Name (eg, company) [Default Company Ltd]:zmedu Organizational Unit Name (eg, section) []:IT Common Name (eg, your name or your server's hostname) []:zmedu.cn Email Address []:xinsz08@yeah.net Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/private/./cakey.pem: 123456 Check that the request matches the signature Signature ok Certificate Details: Serial Number: 11528897308301078024 (0x9ffedf04e93e2e08) Validity Not Before: Mar 5 06:01:52 2020 GMT Not After : Mar 5 06:01:52 2023 GMT Subject: countryName = CN stateOrProvinceName = beijing organizationName = zmedu organizationalUnitName = IT commonName = zmedu.cn emailAddress = xinsz08@yeah.net X509v3 extensions: X509v3 Subject Key Identifier: E5:76:DA:19:34:76:F6:1D:26:66:57:97:C1:93:F5:BA:4E:B1:50:1A X509v3 Authority Key Identifier: keyid:E5:76:DA:19:34:76:F6:1D:26:66:57:97:C1:93:F5:BA:4E:B1:50:1A X509v3 Basic Constraints: CA:TRUE Certificate is to be certified until Mar 5 06:01:52 2023 GMT (1095 days)Write out database with 1 new entries Data Base Updated
4. 查看生成的CA根证书
[root@xinsz08-64 桌面]# vim /etc/pki/CA/cacert.pem 查看公钥
[root@xinsz08-64 桌面]# vim /etc/pki/CA/private/cakey.pem 查看私钥
标签:Name,证书,CA,认证,etc,xinsz08,pki,搭建 来源: https://blog.51cto.com/xinsz08/2799691