OpenSSL自建CA和颁发SSL证书

浅浅的花香味﹌ 2022-03-31 02:14 296阅读 0赞

系统环境：

Ubuntu 18.10

OpenSSL 1.1.1  11 Sep 2018

一：自建CA

1：依次创建如下目录

mkdir -p /opt/ca/root

mkdir /opt/ca/root/key

2：vim /opt/ca/root/openssl.cnf

[ ca ]
    default_ca	= CA_default
    
    [ CA_default ]
    dir		    = /opt/ca/root
    certs		= $dir/certs
    crl_dir		= $dir/crl
    database	= $dir/index.txt
    new_certs_dir	= $dir/newcerts
    certificate	= $dir/key/cacert.crt
    serial		= $dir/serial
    crlnumber	= $dir/crlnumber
    crl		    = $dir/crl.pem
    private_key	= $dir/key/cakey.pem
    RANDFILE	= $dir/key/.rand
    unique_subject	= no
    
    x509_extensions	= usr_cert
    copy_extensions = copy
    
    name_opt 	= ca_default
    cert_opt 	= ca_default
    
    default_days	= 365
    default_crl_days= 30
    default_md	= sha256
    preserve	= no
    policy		= policy_ca
    
    [ policy_ca ]
    countryName		= supplied
    stateOrProvinceName	= supplied
    organizationName	= supplied
    organizationalUnitName	= supplied
    commonName		= supplied
    emailAddress		= optional
    
    [ req ]
    default_bits		= 2048
    default_keyfile 	= privkey.pem
    distinguished_name	= req_distinguished_name
    attributes		= req_attributes
    x509_extensions	= v3_ca
    string_mask = utf8only
    utf8 = yes
    prompt                  = no
    
    [ req_distinguished_name ]
    countryName			= CN
    stateOrProvinceName		= beijing
    localityName			= beijing
    organizationName        = Global Google CA Inc
    organizationalUnitName	= Root CA
    commonName			= Global Google Root CA
    
    [ usr_cert ]
    basicConstraints = CA:TRUE
    
    [ v3_ca ]
    basicConstraints        = CA:TRUE
    
    [ req_attributes ]

3：创建如下目录及文件

mkdir /opt/ca/root/newcerts

touch /opt/ca/root/index.txt

touch /opt/ca/root/index.txt.attr

echo 01 > /opt/ca/root/serial

4：创建CA私钥

openssl genrsa -out /opt/ca/root/key/cakey.pem 2048

5：生成CA证书请求文件

openssl req -new -key /opt/ca/root/key/cakey.pem -out /opt/ca/root/key/ca.csr -config /opt/ca/root/openssl.cnf

6：自签名

openssl ca -selfsign -in /opt/ca/root/key/ca.csr -out /opt/ca/root/key/cacert.crt -config /opt/ca/root/openssl.cnf

7：修改/opt/ca/root/openssl.cnf配置，把

\[ usr\_cert \]  
basicConstraints = CA:TRUE

修改为

\[ usr\_cert \]  
basicConstraints = CA:FALSE

CA:TRUE代表的是签发的是CA机构（自己是CA机构），CA:FALSE代表的是签发的是证书（改成false就不能去签发其他CA）

经过以上7个步骤，就成功创建了CA私钥及CA证书。有了这些就可以去签发其他的证书请求了

二：使用自建CA签名证书

1：mkdir /opt/ca/taobao

2：vim /opt/ca/taobao/openssl.cnf

[ req ]
    prompt             = no
    distinguished_name = server_distinguished_name
    req_extensions     = req_ext
    x509_extensions	= v3_req
    attributes		= req_attributes
    string_mask = utf8only
    utf8 = yes
    
    [ server_distinguished_name ]
    commonName              = taobao2018.cn
    stateOrProvinceName     = guangzhou
    countryName             = CN
    organizationName        = 广州我要淘科技有限公司
    organizationalUnitName  = IT
    
    [ v3_req ]
    basicConstraints        = CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    
    [ req_attributes ]
    
    [ req_ext ]
    subjectAltName      = @alternate_names
    
    [ alternate_names ]
    DNS.1        = taobao2018.cn
    DNS.2        = bbs.taobao2018.cn
    DNS.3        = taobao2019.cn

3：生成网站私钥

openssl genrsa -out /opt/ca/taobao/privkey.pem 2048

4：生成证书请求文件（csr文件）

openssl req -new -key /opt/ca/taobao/privkey.pem -out /opt/ca/taobao/taobao.csr -config /opt/ca/taobao/openssl.cnf

5：使用自建CA进行签发证书

openssl ca -in /opt/ca/taobao/taobao.csr -out /opt/ca/taobao/taobao.crt -config /opt/ca/root/openssl.cnf

6：查看证书信息（可选）

openssl x509 -text -in /opt/ca/taobao/taobao.crt

经过以上几个步骤，就生成了由自建CA签发的证书了

三：配置nginx的ssl

server {
    	listen       443 ssl;
    	server_name  taobao2018.cn bbs.taobao2018.cn taobao2019.cn;
    
    	ssl_certificate      /opt/ca/taobao/taobao.crt;
    	ssl_certificate_key  /opt/ca/taobao/privkey.pem;
    
    	ssl_session_cache    shared:SSL:1m;
    	ssl_session_timeout  5m;
    
    	ssl_ciphers  HIGH:!aNULL:!MD5;
    	ssl_prefer_server_ciphers  on;
    
    	location / {
    		root   html;
    		index  index.html index.htm;
    	}
    }

保存配置文件之后，启动nginx

四：导入自建CA的证书（根证书）

这里以Firefox为例，打开：选项 -> 隐私与安全 -> 查看证书，在证书颁发机构里面选择导入，

选择文件 /opt/ca/root/key/cacert.crt 导入并勾选2个信任的复选框

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21uOTYwbW4_size_16_color_FFFFFF_t_70][]

五：配置hosts

192.168.133.134 taobao2018.cn
    192.168.133.134 bbs.taobao2018.cn
    192.168.133.134 taobao2019.cn

最后，使用https方式访问上面的三个url中的任意一个均可

访问之后，也可以在Firefox上查看证书

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21uOTYwbW4_size_16_color_FFFFFF_t_70 1][]

注意：

1：证书的x509信息如：stateOrProvinceName、organizationalUnitName已经在openssl.cnf配置文件中指定了，所以在生成证书请求文件的时候，不需要再输入了

2：证书请求文件里面的commonName，只需要填写主要的域名就可以了，其他的域名（包括主域名）必须要在openssl.cnf配置文件的subjectAltName属性中指定，否则浏览器会报不安全警告。本例子中展示了证书支持3个域名，所以这3个域名都要配置在subjectAltName属性中

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21uOTYwbW4_size_16_color_FFFFFF_t_70]: /images/20220331/c043a87cced548088c706ef99ecdf35f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21uOTYwbW4_size_16_color_FFFFFF_t_70 1]: /images/20220331/f1a745b2f4aa4fb0ad2b4cae59dacc58.png