熟练掌握 openssl 证书命令说明

熟练掌握 openssl 证书命令说明
2、在我电脑建立好一个目录，并启动 terminal ，进入该目录
cd /Users/dhbm/Desktop/ssl/sign20180729
1
3、生成Self Signed证书
1）、生成一个key（我的私钥）
openssl genrsa -des3 -out selfsign.key 4096

结果 （过程中 密码： 123456）
Generating RSA private key, 4096 bit long modulus
...........++
...........................++
e is 65537 (0x10001)
Enter pass phrase for selfsign.key:
Verifying - Enter pass phrase for selfsign.key:

*** 这时应该生成了一个文件：selfsign.key
ls
selfsign.key

2）使用我的私钥（上面生成的key），生成一个自签名请求 certificate signing request (CSR)
openssl req -new -key selfsign.key -out selfsign.csr
结果
Enter pass phrase for selfsign.key:
unable to load Private Key
140735584793480:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:531:
140735584793480:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:488:

Enter pass phrase for selfsign.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BeiJing
Locality Name (eg, city) []:BeiJing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:dhbm.cn
Organizational Unit Name (eg, section) []:dhbm.cn
Common Name (e.g. server FQDN or YOUR name) []:wzh
Email Address []:13501062476@139.com

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:dhbm.cn
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
*** 这时应该又生成了一个文件 selfsign.csr
ls
selfsign.csr selfsign.key

3)、用以上证书请求文件（selfsign.csr），生成Self Signed证书
openssl x509 -req -days 365 -in selfsign.csr -signkey selfsign.key -out selfsign.crt
结果
Signature oksubject=/C=CN/ST=BeiJing/L=BeiJing/O=dhbm.cn/OU=dhbm.cn/CN=wzh/emailAddress=13501062476@139.com
br/>subject=/C=CN/ST=BeiJing/L=BeiJing/O=dhbm.cn/OU=dhbm.cn/CN=wzh/emailAddress=13501062476@139.com
Getting Private key
Enter pass phrase for selfsign.key:
*** 这时应该又生成了一个文件 selfsign.crt
ls
selfsign.crt selfsign.csr selfsign.key
1
2
3
4
5
6
7
8
9
10
4、生成自己的CA (Certificate Authority)
1）、生成CA的key，这一步和生成证书一样，也是一个私钥，文件名 叫 ca.key
openssl genrsa -des3 -out ca.key 4096

×××结果：
Generating RSA private key, 4096 bit long modulus
..................................................................................................++
.....................................++
e is 65537 (0x10001)
Enter pass phrase for ca.key:
Verifying - Enter pass phrase for ca.key:
*** 这时应该又生成了一个文件 ca.key
ls
ca.key selfsign.crt selfsign.csr selfsign.key

2）、生成CA的证书请求、证书 （两步合二为一了）
openssl req -new -x509 -days 365 -key ca.key -out ca.crt

结果
Enter pass phrase for ca.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BeiJing
Locality Name (eg, city) []:BeiJing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:dhbm.cn
Organizational Unit Name (eg, section) []:dhbm.cn
Common Name (e.g. server FQDN or YOUR name) []:wzh
Email Address []:13501062476@139.com
*** 这时应该又生成了 1 个文件 ca.crt （没有 ca.csr?）
ls
ca.crt ca.key selfsign.crt selfsign.csr selfsign.key
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
5、生成服务器证书，由以上自建的 CA 颁发
1）、前面 2 步 和以上一样，生成一个 私钥（key），生成一个证书请求（csr）

生成私钥

openssl genrsa -des3 -out myserver.key 4096
结果：
Generating RSA private key, 4096 bit long modulus
...................................................................++
...............................................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for myserver.key:
Verifying - Enter pass phrase for myserver.key:

生成证书请求

openssl req -new -key myserver.key -out myserver.csr
结果：
Enter pass phrase for myserver.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.

Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:BeiJing
Locality Name (eg, city) []:BeiJing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:dhbm.cn
Organizational Unit Name (eg, section) []:dhbm.cn
Common Name (e.g. server FQDN or YOUR name) []:wzh server
Email Address []:13501062476@139.com
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:dhbm.cn
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
这次和以上不一样，加上了一个中间人 CA ，表示这是由 CA 认可并办法的证书
openssl x509 -req -days 365 -in myserver.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out myserver.crt
结果：
Signature ok
subject=/C=cn/ST=BeiJing/L=BeiJing/O=dhbm.cn/OU=dhbm.cn/CN=wzh server/emailAddress=13501062476@139.com
Getting CA Private Key
Enter pass phrase for ca.key:
*** 到这里，又生成了 3 个文件 myserver.key，myserver.csr，myserver.crt
ls
ca.crt myserver.crt myserver.key selfsign.csr
ca.key myserver.csr selfsign.crt selfsign.key
1
2
3
4
5
6
7
8
9
10
6、查看我的证书情况 （myserver）
1）、查看维生素我的私钥
openssl rsa -noout -text -in myserver.key
结果
Enter pass phrase for myserver.key:
Private-Key: (4096 bit)
modulus:
00:b7:cb:ad:ad:37:bd:e9:3d:a2:36:10:1b:e6:8e:
0c:b7:83:09:3d:3e:09:94:a0:85:b2:2a:c6:68:29
...

2)、查看我的证书请求
openssl req -noout -text -in myserver.csr
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=cn, ST=BeiJing, L=BeiJing, O=dhbm.cn, OU=dhbm.cn, CN=wzh server/emailAddress=13501062476@139.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
00:b7:cb:ad:ad:37:bd:e9:3d:a2:36:10:1b:e6:8e:
0c:b7:83:09:3d:3e:09:94:a0:85:b2:2a:c6:68:29:
...
Attributes:
challengePassword :123456
unstructuredName :dhbm.cn
Signature Algorithm: sha256WithRSAEncryption
00:6f:04:6c:30:93:88:34:ee:43:f2:ce:2b:d0:3e:11:20:46:
...
3)、查看我的证书
openssl x509 -noout -text -in myserver.crt
Data:
Version: 1 (0x0)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=CN, ST=BeiJing, L=BeiJing, O=dhbm.cn, OU=dhbm.cn, CN=wzh/emailAddress=13501062476@139.com
Validity
Not Before: Jul 29 09:02:55 2018 GMT
Not After : Jul 29 09:02:55 2019 GMT
Subject: C=cn, ST=BeiJing, L=BeiJing, O=dhbm.cn, OU=dhbm.cn, CN=wzh server/emailAddress=13501062476@139.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
00:b7:cb:ad:ad:37:bd:e9:3d:a2:36:10:1b:e6:8e:
0c:b7:83:09:3d:3e:09:94:a0:85:b2:2a:c6:68:29:
...

4）、验证我的证书
openssl verify -CAfile ca.crt myserver.crt
myserver.crt: OK
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
7、到这里完成了 3 步 ，自建名证书、CA证书、CA颁发 myserver 证书
疑问：什么是服务端用的？什么是客户端用的？

原文地址：https://blog.51cto.com/14224054/2357999

时间： 2024-11-29 03:02:42

熟练掌握 openssl 证书命令说明的相关文章

OpenSSL之命令总结

OpenSSL从基础到应用系列: 1) OpenSSL之安全通讯基础 2) OpenSSL之PKI 3) OpenSSL之SSL协议的Web安全实现 4) OpenSSL之编译安装 透过上面几个方面的学习,我们应该对OpenSSL有了一个基本的了解.OpenSSL功能之强大,命令组合用法之多,往往让我们的学习不知所措.在此,我们来对openssl命令的使用做一个总结. 语法格式:  openssl command [ command_opts ] [ command_args ] 常用comma

iOS push全方位解析（二）【译文】"——生成OpenSSL证书,Provisioning Profile

这是一篇来自raywenderlich的教程,内容翔实!结构简单透彻.讲解循序渐进.文章质量上乘!是一篇难的的博文!使用半瓶的英语水平翻译了一下: 1.[iOS push全方位解析](一) push的概述 2.[iOS push全方位解析](二) 生成push证书,生成Provisioning Profile(本篇) 3.[iOS push全方位解析](三) 一个极简的demo,并测试一下push 这里查看原文 ------------------------------------------

Linux下生成openssl证书

SSL 安全证书可以自己生成,也可以通过第三方的 CA ( Certification Authority )认证中心付费申请颁发. SSL 安全证书包括: 1.CA 证书,也叫根证书或中间级证书.单向认证的 https , CA 证书是可选的.主要目的是使证书构成一个证书链,以达到浏览器信任证书的目的.如果使用了 CA 证书,服务器证书和客户证书都使用 CA 证书来签名.如果不安装 CA 证书,浏览器默认认为是不安全的. 2.服务器证书.必选.通过服务器私钥,生成证书请求文件 CSR ,再通过

"iOS push全方位解析（二）【译文】"——生成OpenSSL证书,Provisioning Profile

这是一篇来自raywenderlich的教程,内容翔实!结构简单透彻.讲解循序渐进.文章质量上乘!是一篇难的的博文!使用半瓶的英语水平翻译了一下:1.[iOS push全方位解析](一) push的概述2.[iOS push全方位解析](二) 生成push证书,生成Provisioning Profile(本篇)3.[iOS push全方位解析](三) 一个极简的demo,并测试一下push 这里查看原文 ---------------------------------------------

创建服务器证书命令

获取数字证书有三种方法,一是从CA机构申请,二是自己搭建服务器发布证书,三是使用makecert.exe来生成一个证书文件.这里我们使用makecert.exe来生成一个证书文件,用来测试.启动VS2010的命令行,然后输入如下命令将会生成一个能供xxxx.example.com所有二级域名使用的证书. Makecert -r -pe -n CN="*.example.com" -b 05/10/2010 -e 12/22/2011 -eku 1.3.6.1.5.5.7.3.1 -ss

10.openssl证书和CA功能概述

10.1 证书和CA功能概述 10.1.1 证书存在价值 数字证书正是为了建立实体跟密钥对之间的联系而存在,证书验证中心CA充当了确认特定实体跟密钥对之间关系的确认人,并且通过用自己的私钥对这些确认信息和公钥一起签名来保证其可信性和不可改变性. 10.1.2 证书生命周期 a.证书申请:所谓证书生命周期是指从证书申请到证书被吊销的整个过程,这中间涉及证书申请.颁发.使用管理方面的问题. b.证书颁发 c.证书验证 d.证书吊销:一是从CA的证书数据库中删除被吊销的证书:而是对外公布被撤销的证书信

openssl基于椭圆曲线密码体制生成证书命令

# openssl ecparam -out EccCA.key -name secp256k1 -genkey //生成CA私钥# openssl req -key EccCA.key -new -out EccCA.req //生成CA证书请求# openssl x509 -req -in EccCA.req -signkey EccCA.key -out EccCA.pem //自签名得到CA根证书# openssl ecparam -out EccSite.key -name secp2

Openssl ca命令

一.简介 ca命令能够签发证书请求文件以及生成CRL列表 二.语法 openssl ca [-verbose] [-config filename] [-name section] [-gencrl] [-revoke file][-crl_reason reason] [-crl_hold instruction] [-crl_compromise time] [-crl_CA_compromise time ] [ -subj subj] [-crldays days] [-crlhours

Openssl crl2pkcs7命令

一.简介 crl2pkcs7命令根据CRL或证书来生成pkcs#7消息 二.语法 openssl crl2pkcs7 [-inform PEM|DER ] [-outform PEM|DER ] [-in filename ] [-out filename ] [-certfile filename ] [-nocrl ] 选项 -inform arg input format - DER or PEM -outform arg output format - DER or PEM -in ar