openssl 生成自签CA和pkcs12证书

 

基础环境

mkdir Test
cd Test
mkdir -p ./CA/{private,newcerts} 
touch CA/index.txt 
touch CA/serial
touch CA/crlnumber
echo 01 > CA/serial
echo 01 > CA/crlnumber
cp /etc/pki/tls/openssl.cnf ./

# 修改dir为当前CA目录
vim openssl.cnf
　　[ CA_default ]
　　　　dir = ./CA
# 增强型密钥，客户端身份认证
　　[ v3_req ]
　　　　keyUsage = nonRepudiation,digitalSignature
　　　　extendedKeyUsage = clientAuth

 

生成CA证书

# 生成CA私钥
(umask 077;openssl genrsa -des3 -out ./CA/private/cakey.pem 2048)

# 生成ca证书
openssl req -new -x509 -days 365 -key ./CA/private/cakey.pem -out ./CA/cacert.pem -subj "/C=CN/ST=GD/L=SZ/O=organization/OU=dev/CN=organization.com/emailAddress=aa@organization.com"

 

生成用户证书

# user私钥
(umask 077;openssl genrsa -out userkey.pem 2048)

# 签署请求
openssl req -new -days 365 -key userkey.pem -out userreq.pem -subj "/C=CN/ST=GD/L=SZ/O=organization/OU=dev/CN=organization.com/emailAddress=aa@organization.com"

# 生成user证书
openssl ca -in userreq.pem -out usercert.pem -extensions v3_req -config openssl.cnf 

# 生成pkcs12证书 
openssl pkcs12 -export -inkey userkey.pem -in usercert.pem -out user.pfx

# rm ./CA/index.txt && touch ./CA/index.txt 重新生成user证书

 

吊销用户证书

# 吊销user证书
openssl ca -revoke usercert.pem -cert ./CA/cacert.pem -keyfile ./CA/private/cakey.pem

# 生成user证书吊销列表
openssl ca -gencrl -out rootca.crl -cert ./CA/cacert.pem -keyfile ./CA/private/cakey.pem -config openssl.cnf