OpenSSL证书以及二级CA

自建CA系统

创建~/TestCA文件夹，所有CA的操作都会在这个文件夹执行。

# mkdir ~/TestCA  
# cd ~/TestCA
# mkdir certs crl newcerts private
# chmod 700 private
# touch index.txt
# echo 1000 > serial
# touch openssl.cnf

说明

TestCA：CA文件夹

TestCA/certs：新签署证书和根证书存放的位置

TestCA/crl：证书请求文件存放位置

TestCA/newcerts：新签署证书存放的位置，是/root/ca/certs的备份

TestCA/private：ca.key.pem存放位置，千万别丢失

TestCA/index.txt：证书签名的纪录

TestCA/serial：下一次证书签名的序列号，保存到index.txt

配置文件

# OpenSSL root CA configuration file.
# Copy to `/root/ca/openssl.cnf`.

[ ca ]
# `man ca`
default_ca = CA_default

[ CA_default ]
# Directory and file locations.

dir = ./
certs = $dir/certs
crl_dir = $dir/crl
new_certs_dir = $dir/newcerts
database = $dir/index.txt
serial = $dir/serial
RANDFILE = $dir/private/.rand

# The root key and root certificate.
private_key = $dir/private/ca.key.pem
certificate = $dir/certs/ca.cert.pem

# For certificate revocation lists.
crlnumber = $dir/crlnumber
crl = $dir/crl/ca.crl.pem
crl_extensions = crl_ext
default_crl_days = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha256
name_opt = ca_default
cert_opt = ca_default
default_days = 3650
preserve = no
policy = policy_strict

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.

countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.

countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[ policy_test ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.

countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = optional
emailAddress = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits = 2048
distinguished_name = req_distinguished_name
string_mask = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha256

# Extension to add when the -x509 option is used.
x509_extensions = v3_ca

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName = Country Name (2 letter code)
stateOrProvinceName = State or Province Name
localityName = Locality Name
organizationName = Organization Name
organizationalUnitName = Organizational Unit Name
commonName = Common Name
emailAddress = Email Address

# Optionally, specify some defaults.
countryName_default = CN
stateOrProvinceName_default = SX
localityName_default = XA
organizationName_default = TestOrg
#organizationalUnitName = TestOrgUnit
#organizationalUnitName_default = TestOrgUnit
emailAddress_default = test@TestOrg.io

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @v3_ca_names

[ v3_ca_names ]
IP.1 = 127.0.0.1
DNS.1 = v3_ca_names.io

[ v3_ca2 ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @v3_ca2_names

[ v3_ca2_names ]
IP.1 = 127.0.0.2
DNS.1 = v3_ca2_names.io

[ user_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @server_names

[server_names]
IP.1 = 192.168.1.1
DNS.1 = test.io

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning

为了方便使用，我们执行如下命令

export OPENSSL_CONF=~/TestCA/openssl.conf

新建一个环境变量，后面使用openssl时就不用加-config参数了，方便使用

生成CA证书

openssl genrsa -aes256 -out private/ca.key or openssl genrsa -out private/ca.key
openssl req -key private/ca.key -new -x509 -extensions v3_ca -out certs/ca.cer
openssl x509 -in certs/ca.cer -text -noout

生成CA2证书

openssl genrsa -out private/ca2.key
openssl req -new -key private/ca2.key -out csr/ca2.csr
openssl x509 -req -CA certs/ca.cer -CAkey private/ca.key -CAcreateserial -in csr/ca2.csr -out certs/ca2.cer -extfile openssl.conf -extensions v3_ca2

也可以

openssl ca -extensions v3_ca2 -in csr/ca2.csr -out certs/ca2.ca.cer -policy policy_loose 进行签名

执行后ca2.ca.cer是可以被验证通过的

openssl x509 -in certs/ca2.cer -text -noout
openssl verify -CAfile certs/ca.cer certs/ca2.cer

生成服务器证书

openssl genrsa -out private/server.key
openssl req -new -key private/server.key -out csr/server.csr
openssl ca -extensions server_cert -in csr/server.csr -out certs/server.cer -policy policy_loose
openssl verify -CAfile certs/ca.cer certs/server.cer

可以在req的时候增加参数

openssl req -new -key private/server.key -out csr/server.csr -extfile openssl.conf -reqexts server_cert

这个在进行证书签名的使用可以不包含-extensions参数

使用二级证书签名服务器证书

openssl x509 -req -in csr/server.csr -CA certs/ca2.cer -CAkey private/ca2.key -CAcreateserial -out certs/server.ca2.cer -extfile openssl.conf -extensions server_cert

还可以使用

openssl ca -in csr/server.csr -cert certs/ca2.cer -keyfile private/ca2.key -out certs/server.ca2.cer -extfile openssl.conf -extensions server_cert -policy policy_loose

进行签名

cat certs/ca2.cer certs/ca.cer > certs/ca.chain.cer
openssl verify -CAfile certs/ca.chain.cer certs/server.ca2.cer 

自签名证书

openssl genrsa -out key.pem
openssl req -new -sha256 -key key.pem -out csr.csr
openssl req -x509 -sha256 -days 3650 -key key.pem -in csr.csr -out cert.pem -set_serial 0x10000000
openssl x509 -in cert.pem -text -noout

openssl ecparam -genkey -name prime256v1 -out key.pem
openssl req -new -sha256 -key key.pem -out csr.csr
openssl req -x509 -sha256 -days 3650 -key key.pem -in csr.csr -out cert.pem -set_serial 0x10000000

openssl ecparam -list_curves