数字证书的安装配置

    openssl的安装和配置文件其实都很简单，唯一有困难的是openssl复杂的命令，大家可以参考一下我上传到文件


1，软件安装

[root@test4 ~]# yum install openssl -y


2,配置文件


[root@test4 ~]#vim/etc/pki/tls/openssl.cnf

dir= /etc/pki/CA CA家目录

certs= $dir/certs证书

crl_dir= $dir/crl证书吊销列表

database= $dir/index.txt证书的信息

#unique_subject = no# Set to 'no' to allowcreationof

#several ctificates with same subject.

new_certs_dir= $dir/newcerts存放证书的副本

certificate= $dir/cacert.pem   CA的公钥

serial= $dir/serial   记录序列号，每签一次证书都会+1

crlnumber= $dir/crlnumber   吊销的证书的数量

# mustbe commented out to leavea V1 CRL

crl= $dir/crl.pem    吊销证书的客户端黑名单

private_key=$dir/private/cakey.pem # CAThe private key

RANDFILE= $dir/private/.rand  # private randomnumber file


default_days= 365证书的有效期

default_crl_days= 30每30天去更新一次黑名单

default_md= sha1# which md to use.

preserve= no


optional 表示可选match 表示要匹配supplied 表示的是必须不一样

countryName=match国家代码

stateOrProvinceName=match省份名字

organizationName= match

organizationalUnitName= optional

commonName= supplied

emailAddress= optional


[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = CN
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = hubei
#stateOrProvinceName_default    = Default Province

localityName                    = Locality Name (eg, city)
localityName_default    = Default City

0.organizationName              = wuhan
0.organizationName_default      = Default Company Ltd

3，实例配置

     ca中心是test4          服务器是mail

(1)通过CA中心的私钥自请求生成CA中心的公钥

[root@test4 ~]# (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem  -des3 2048 )
Generating RSA private key, 2048 bit long modulus
......................................................+++
............................................................................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for /etc/pki/CA/private/cakey.pem:1050311018

Verifying - Enter pass phrase for /etc/pki/CA/private/cakey.pem:1050311018

[root@test4 ~]# openssl req -new -key  /etc/pki/CA/private/cakey.pem  -out   /etc/pki/CA/cacert.pem  -x509 -days 365 
Enter pass phrase for /etc/pki/CA/private/cakey.pem:1050311018
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:


（2）mail主机请求验证自己的私钥生成证书请求文件

[root@mail ~]# openssl genrsa 1024 > mail.key
Generating RSA private key, 1024 bit long modulus
.....++++++
............++++++
e is 65537 (0x10001)
[root@mail ~]# openssl req -new -key  mail.key -out  mail.csr 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:hubei
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:wuhan
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:t^H^H
[root@mail ~]# 
[root@mail ~]# openssl req -new -key  mail.key -out  mail.csr 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:hubei
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:wuhan
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:mail.example.org
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:



将自己通过证书请求文件发送到服务器端进行签字

[root@mail ~]# scp mail.csr root@192.168.87.129:/root
The authenticity of host '192.168.87.129 (192.168.87.129)' can't be established.
RSA key fingerprint is 7c:76:9e:08:fc:5e:60:a6:d0:13:71:21:7e:2f:90:47.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.87.129' (RSA) to the list of known hosts.
root@192.168.87.129's password: 
mail.csr                                      100%  651     0.6KB/s   00:00


(3)ca签字

[root@test4 ~]# openssl ca -in mail.csr  -out  mail.crt
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
       Serial Number: 0 (0x0)
       Validity
           Not Before: Jun  1 14:39:01 2013 GMT
           Not After : Jun  1 14:39:01 2014 GMT
       Subject:
           countryName               = CN
           stateOrProvinceName       = hubei
           organizationName          = wuhan
           commonName                = mail.example.org
       X509v3 extensions:
           X509v3 Basic Constraints: 
               CA:FALSE
           Netscape Comment: 
               OpenSSL Generated Certificate
           X509v3 Subject Key Identifier: 
               70:0D:4C:A6:C2:94:1A:0F:F1:1A:7A:B2:DD:5A:81:55:60:EF:7F:D6
           X509v3 Authority Key Identifier: 
               keyid:88:23:82:0E:D4:B8:04:54:3B:9E:2F:32:2E:F4:E9:5C:A2:EF:E4:51

Certificate is to be certified until Jun  1 14:39:01 2014 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated


(4)邮件服务器上的应用

这里是用的dovecot，在其配置文件中加入就可以进行openssl了

ssl_cert_file = /etc/pki/dovecot/certs/mail.crt
ssl_key_file = /etc/pki/dovecot/private/mail.key