Centos7_CA認證

說明：

CA主機  ：172.16.0.133

Client 主機  ： 172.16.0.132

/etc/pki/tls目錄下面文件含義：

          Cert.pem  軟連接到certs/ca-bundle.crt

          certs              該服務器證書存放目錄

          ca-bundle.crt    內置信任證書

          pricate          證書密鑰存放目錄

          openssl.cnf      openssl的CA主配置文件

不用自己做證書，然后頒發。直接頒發證書

可實現https訪問

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/httpd/ssl.key -out /etc/httpd/ssl.crt
cat /etc/httpd/ssl.crt  >> /etc/pki/tls/certs/ca-bundle.crt

1 為CA提供所需的目錄及文件

（1）所需目錄，如果無，則創建

/etc/pki/CA/certs/         存放Ca簽署（頒發）過的數字證書
/etc/pki/CA/crl/             吊銷的證書
/etc/pki/CA/newcerts/ （證書備份目錄）
/etc/pki /CA/ private/   用於存放ca私鑰

（2）所需文件

[root@centos7 ~]# touch  /etc/pki/CA/serial        #序列號文件
[root@centos7 ~]# touch  /etc/pki/CA/index.txt  #數據庫文件

（3）

[root@centos7 ~]# echo 01 > /etc/pki/CA/serial     #維護ca的序列號

 

2 生成私鑰

[root@centos7 ~]#(umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem  2048)

3·生成自簽證書

[root@centos7~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 365

4 在client上進行如下操作

（1）創建放置私鑰，證書的文件夾

[root@CentOS7 ~]# mkdir /etc/httpd/ssl

（2）生成自己的私鑰

[root@CentOS7~]#(umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)

（3）請CA為自己生成公鑰

[root@CentOS7 ~]#openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365

（4）把生成的公鑰發送給CA

[root@CentOS7~]#scp /etc/httpd/ssl/httpd.csr root@172.16.0.133:/tmp/

5 在CA主機上為client簽證

[root@centos7 ~]# openssl ca -in /tmp/httpd.csr  -out /etc/pki/CA/certs/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jun  3 02:54:23 2017 GMT
            Not After : Jun  3 02:54:23 2018 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = BeiJing
            organizationName          = Company
            organizationalUnitName    = OPS
            commonName                = www.test.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                5D:A9:5A:90:29:F3:3A:7F:76:BE:21:78:14:80:E5:FB:5E:03:D8:D9
            X509v3 Authority Key Identifier: 
                keyid:9E:1E:F3:84:4D:D0:79:E2:BD:DD:A8:50:29:6C:BA:0C:21:60:CA:96
Certificate is to be certified until Jun  3 02:54:23 2018 GMT (365 days)
Sign the certificate? [y/n]:y
 
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries(出現這段才是頒發證書成功)
Data Base Updated

6 把簽署的證書發給client

[root@centos7~]#scp /etc/pki/CA/certs/httpd.crt root@172.16.10.132:/etc/httpd/ssl/

7 把CA的證書發給client

[root@serverB ~]scp /etc/pki/CA/cacert.pem root@172.16.0.132:/etc/httpd/ssl/

8 在client上導入CA的證書（cacert.pem）

cat /etc/httpd/ssl/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt

為保險建議也把CA頒發的.crt證書也導入

HTTPS配置

9 修改配置文件/etc/httpd/conf.d/virthost.conf

 

模板可在/etc/httpd/conf.d/ssl.conf 里找粘貼修改路徑就好了