OpenSSL根证书和颁布者不一致(密钥)

末蓝、 2022-12-10 03:49 160阅读 0赞

需求：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70][]

加密钥：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1][]

根证书加密钥  
openssl genrsa -des3 -out CAroot.key 2048  
openssl req -new  -key CAroot.key -out  rootca.csr -config  /etc/ssl/openssl.cnf -keyform PEM  
openssl x509 -req   -extfile /etc/ssl/openssl.cnf  -extensions v3\_req  -in rootca.csr -out CARoot.crt  -signkey CAroot.key -CAcreateserial -days 3650

根证书下颁发给个人证书加密钥  
openssl genrsa -des3 -out myprivate.key 1024  
openssl  req -new -key  myprivate.key  -out MyCaReq.csr -config  /etc/ssl/openssl.cnf    -keyform PEM  
openssl x509 -req   -extfile /etc/ssl/openssl.cnf  -extensions v3\_req  -in MyCaReq.csr  -out MyCa.crt   -signkey myprivate.key  -CA CARoot.crt -CAkey CAroot.key   -CAcreateserial -days 3650

root@Fkali:~/openssl# mkdir new
    root@Fkali:~/openssl# cd new
    root@Fkali:~/openssl/new# openssl genrsa -des3 -out CAroot.key 2048
    Generating RSA private key, 2048 bit long modulus (2 primes)
    .+++++
    ................................................................................                                                                                                                              ....+++++
    e is 65537 (0x010001)
    Enter pass phrase for CAroot.key:
    Verifying - Enter pass phrase for CAroot.key:
    root@Fkali:~/openssl/new# openssl req -new  -key CAroot.key -out  rootca.csr -co                                                                                                                              nfig   -keyform PEM
    req: Use -help for summary.
    root@Fkali:~/openssl/new# ^C
    root@Fkali:~/openssl/new# openssl req -new  -key CAroot.key -out  rootca.csr -config  /etc/ssl/openssl.cnf -keyform PEM
    Enter pass phrase for CAroot.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:CN
    State or Province Name (full name) [Some-State]:test1
    Locality Name (eg, city) []:test2
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:test3
    Organizational Unit Name (eg, section) []:test4
    Common Name (e.g. server FQDN or YOUR name) []:test54
    Email Address []:test@dd.com
    
    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:
    root@Fkali:~/openssl/new# openssl req -x509   -extfile /etc/ssl/openssl.cnf  -extensions v3_req   -key rootca.key -in rootca.csr -out CARoot.crt -config /etc/ssl/openssl.cnf  -CAcreateserial -days 3650
    req: Unrecognized flag extfile
    req: Use -help for summary.
    root@Fkali:~/openssl/new# openssl req -x509   -extfile /etc/ssl/openssl.cnf  -extensions v3_req   -key rootca.key -in rootca^Csr -out CARoot.crt -config /etc/ssl/openssl.cnf  -CAcreateserial -days 3650
    root@Fkali:~/openssl/new# ls
    CAroot.key  rootca.csr
    root@Fkali:~/openssl/new# openssl x509 -req   -extfile /etc/ssl/openssl.cnf  -extensions v3_req  -in rootca.csr -out CARoot.crt  -signkey CAroot.key -CAcreateserial -days 3650
    Signature ok
    subject=C = CN, ST = test1, L = test2, O = test3, OU = test4, CN = test54, emailAddress = test@dd.com
    Getting Private key
    Enter pass phrase for CAroot.key:
    root@Fkali:~/openssl/new# openssl genrsa -des3 -out myprivate.key 1024
    Generating RSA private key, 1024 bit long modulus (2 primes)
    ................................+++++
    .........................+++++
    e is 65537 (0x010001)
    Enter pass phrase for myprivate.key:
    Verifying - Enter pass phrase for myprivate.key:
    root@Fkali:~/openssl/new# openssl  req -new -key  myprivate.key  -out MyCaReq.csr -config  -keyform PEM
    req: Use -help for summary.
    root@Fkali:~/openssl/new# openssl  req -new -key  myprivate.key  -out MyCaReq.csr -config  /etc/ssl/openssl.cnf    -keyform PEM
    Enter pass phrase for myprivate.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:CN
    State or Province Name (full name) [Some-State]:Mytest
    Locality Name (eg, city) []:mytest2
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:mytest3
    Organizational Unit Name (eg, section) []:mytest4
    Common Name (e.g. server FQDN or YOUR name) []:mytest5
    Email Address []:mytest@dd.com
    
    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:mytest
    root@Fkali:~/openssl/new# ls
    CARoot.crt  CAroot.key  MyCaReq.csr  myprivate.key  rootca.csr
    root@Fkali:~/openssl/new# openssl x509 -req   -extfile /etc/ssl/openssl.cnf  -extensions v3_req in MyCaReq.csr  -out MyCa.crt   -signkey myprivate.key  -CA CARoot.crt -CAkey CAroot.key   -CAcreateserial -days 3650
    x509: Unknown parameter in
    x509: Use -help for summary.
    root@Fkali:~/openssl/new# openssl x509 -req   -extfile /etc/ssl/openssl.cnf  -extensions v3_req  -in MyCaReq.csr  -out MyCa.crt   -signkey myprivate.key  -CA CARoot.crt -CAkey CAroot.key   -CAcreateserial -days 3650
    Signature ok
    subject=C = CN, ST = Mytest, L = mytest2, O = mytest3, OU = mytest4, CN = mytest5, emailAddress = mytest@dd.com
    Getting Private key
    Enter pass phrase for myprivate.key:
    Getting CA Private Key
    Enter pass phrase for CAroot.key:
    root@Fkali:~/openssl/new#

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70]: /images/20221123/95c7e75c025c49e7ad2e9f323db08188.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1]: /images/20221123/b091a9f47e9f4b2dae4528a47d8a0572.png