java 创建根证书,如何创建自己的自签名根证书和要在Java密钥库中导入的中间CA？...

野性酷女 2022-10-04 12:51 134阅读 0赞

![Image 1][]

How to create self-signed root certificate and intermediate CA to be imported in Java keystore?

We will use this for SSL and TLS, and later for Client certificate based CLIENT-AUTH authentication.

Using OpenSSL and KeyTool.

解决方案

Just a side note for anyone wanting to generate a chain and a number of certificates. Refining @EpicPandaForce's own answer, here's a script that creates a root CA in root-ca/, an intermediate CA in intermediate/ and three certificates to out/, each signed with the intermediate CA.

\#!/bin/bash -x

set -e

for C in \`echo root-ca intermediate\`; do

mkdir $C

cd $C

mkdir certs crl newcerts private

cd ..

echo 1000 > $C/serial

touch $C/index.txt $C/index.txt.attr

echo '

\[ ca \]

default\_ca = CA\_default

\[ CA\_default \]

dir = '$C' \# Where everything is kept

certs = $dir/certs \# Where the issued certs are kept

crl\_dir = $dir/crl \# Where the issued crl are kept

database = $dir/index.txt \# database index file.

new\_certs\_dir = $dir/newcerts \# default place for new certs.

certificate = $dir/cacert.pem \# The CA certificate

serial = $dir/serial \# The current serial number

crl = $dir/crl.pem \# The current CRL

private\_key = $dir/private/ca.key.pem \# The private key

RANDFILE = $dir/.rnd \# private random number file

nameopt = default\_ca

certopt = default\_ca

policy = policy\_match

default\_days = 365

default\_md = sha256

\[ policy\_match \]

countryName = optional

stateOrProvinceName = optional

organizationName = optional

organizationalUnitName = optional

commonName = supplied

emailAddress = optional

\[req\]

req\_extensions = v3\_req

distinguished\_name = req\_distinguished\_name

\[req\_distinguished\_name\]

\[v3\_req\]

basicConstraints = CA:TRUE

' > $C/openssl.conf

done

openssl genrsa -out root-ca/private/ca.key 2048

openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3\_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'

openssl genrsa -out intermediate/private/intermediate.key 2048

openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=Interm.'

openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3\_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt

mkdir out

for I in \`seq 1 3\` ; do

openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048

openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request

done

[Image 1]: