OpenSSL 实践
- 1. 简介
- 2. 实践指南
- 3. 环境
- 4. 修改用于创建根证书的配置文件
- 5. 修改用于创建中间人证书的配置文件
- 6. 为 root 和中间人创建密钥和证书
- 7. 创建服务器证书
- 8. 使用 CRL 吊销证书
- 9. 参考
1. 简介
数字证书（digital certificate）是公钥基础设施（public key infrastructure, PKI）的一个重要组成部分。证书包括公用钥匙和标的物识别名称（distinguished name, DN）以及其他内容。DN 是证书所携带的公用钥匙的实体的标识符。这个实体可以是任何需要加密服务的实体，如个人、组织或计算机程序。证书签发者（certificate issuer）使用其私人密钥签署证书。证书拥有者将他的证书提供给他人，以便他人可以安全地与他/她通信。证书中没有任何秘密，因此可以使用任何传递方式。但是，证书接受者在使用所附的公钥之前，必须验证证书的真实性。要做到这一点，就要获得证书颁发者的公钥，并用它来验证证书的签名。发证者的公钥也是通过证书获得的。该证书必须由链中更高一级的另一个发证者验证，或者出于特定的原因信任其真实性。
认证机构（certification authority, CA）是一个人，或者更可能是一个组织，它得到许多用户的信任。由于商业或实用性的原因，CA 可以按等级组织起来。最底层的是最终用户，他们要求中间 CA（如区域 CA）签署他们的证书。中间 CA 的证书由更高一级的 CA（如国家 CA）签署。最终，达到最高级别的 CA。这个 CA 被称为根 CA，其证书称为根证书。根证书是由根 CA 自签的，因为没有更高一级的 CA 可以证明根 CA 的身份。完整的证书验证意味着从根证书以下的级别到终端用户级别的所有证书都得到验证。不这样做是一个严重的安全风险。根证书不能以同样的方式进行验证。相反，它们是通过声誉来信任的，并且通常包含在运给用户的产品中（例如，在 Web 浏览器或嵌入式设备中）。
CA 有两类：public 和 private 。
公共 CA（如 Verisign）在公众中建立了信任，因为它们在为个人和组织提供认证服务方面有经济利益。如果公众知道签发的证书是假的（无论是故意还是错误），就会对 CA 所享有的信任产生灾难性影响，从而对 CA 从认证服务中获得的利润产生灾难性影响。
私人 CA 负责在一个组织内签发证书，比如在企业内部。在这种情况下，信任来源于雇主和雇员的关系。一个理性的雇主非常希望维护数字资源的安全访问。因此，实施适当的安全程序，例如为员工管理数字证书，是符合他们的最佳利益的。来自私人 CA 的证书可以保护内网网站的安全，或允许客户端对服务器进行认证。由于私人 CA 在其组织之外不受信任，因此除了组织成员外，其他人不能安全地使用其证书。
数字证书的事实上的标准格式是 X.509。这一标准的最初版本由国际电联于 1988 年发布。1995 年，IETF 成立了 Public-Key Infrastructure x.509 Working Group（PKIX-WG），以规范互联网上的 PKI 使用，其中包括如何使用 X.509 的指南（记录在 RFC 42101 中）。X.509 的初始版本有许多缺陷，并导致了后续版本的发布，X.509v3 是最新版本。
X.509v3 最显著的变化是对扩展的支持，它们允许证书包含 X.509v1 中定义以外的附加字段。一些扩展在 X.509v3 中因其有用性而被标准化，但非标准的扩展也是可能的。
扩展名由一个名称（字段名称）、一个分配给字段的值和一个表示该扩展名是否关键的布尔标志组成。如果任何关键扩展不被识别，那么处理具有关键扩展的证书的应用程序必须拒绝证书的有效性。不被应用程序识别的非关键扩展可以被忽略。
2. 实践指南
OpenSSL 是一个免费的开源加密库，它提供了处理数字证书的命令行工具。其中一些工具可以用来充当证书颁发机构。
最佳做法是创建一个根 CA 和一个或多个中间 CA。根 CA 的私钥由组织中一位值得信赖的（通常是既得利益者）成员离线保存。该成员可以将签发证书的责任委托给组织中的其他成员，这些成员将充当中间 CA。受信任的员工除了是根 CA 之外，还可以扮演中间 CA 的角色。为每个中间 CA 创建密钥对和证书。中间 CA 的证书用根 CA 的私钥签署。
如果怀疑中间 CA 的私钥被泄露，那么根 CA 可以撤销中间 CA 的证书。这就有效地破坏了证书链，并间接地使所有由泄露的CA签署的证书无效。当代理中间 CA 的个人离开组织时，可以采用同样的撤销程序。这将确保此人无法再代表组织签署任何证书。
3. 环境
系统：Ubuntu 18.04
创建主目录用于存放根证书：
1$ mkdir root_ca
2$ cd root_ca/
3$ mkdir certs crl newcerts private
4$ chmod 700 private/
5$ touch index.txt
6$ echo 1000 > serial
7$ pwd
8/home/root_ca
我们创建了四个子目录。当一个证书由根 CA 签发时，它会自动作为一个文件放在 newcerts 目录下。文件名是所发证书的序列号。这并不总是那么实用 —— 例如，有时你想通过所有者的名字来查找证书。因此，我们在 certs 目录下存储了每个由根 CA 发行的证书的副本。crl 目录下将包含有废止证书的列表。最后，私钥存储在私有目录下。私钥在任何时候都必须是保密的。这就是为什么我们设置了目录的权限位，只允许目录的所有者访问它的内容。
OpenSSL 将使用 index.txt 文件来跟踪所有签发的证书。每个证书必须有一个唯一的值，这个值是从序列文件中获得的。OpenSSL 为每一个创建的证书递增这个文件中的值。在第 6 行，我们提供了初始值。OpenSSL 将该文件的内容解释为十六进制值，所以 1000 实际上是 0x1000，也就是十进制的 4096 。
接着复制默认的配置文件到目录下：
1cp /etc/ssl/openssl.cnf /home/root_ca/
4. 修改用于创建根证书的配置文件
这里需要修改拷贝过来的配置文件 openssl.cnf 。
-
编辑
[ CA_default ]，修改几个变量：修改路径
1dir = /home/root_ca
修改保存的名称，`<name><type><format>`
1certificate = $dir/certs/root.cert.pem
2crl = $dir/crl/root.crl.pem
3private_key = $dir/private/root.key.pem
找到 `default_md` 并确保设置成 `sha256` ，默认的 `sha1` 已经被放弃使用。
1default_md = sha256
找到并注释 `x509_extensions` 变量。因为用于特定目的的扩展都集中在一个共同的部分中。我们将在命令行中选择所需的扩展部分。
-
编辑
[ req ]部分，主要在创建证书或证书签署请求时使用。添加变量
1default_md = sha256
- 编辑
[ req_distinguished_name ]部分，本节定义了建立区分名称（distinguished name, DN）所需的元素，区分名称是唯一识别证书所有者的方法。
1countryName_default = CN
2stateOrProvince_default = Beijing
3localityName_default = Chaoyang
40.organizationName_default = the masses
-
编辑
[ v3_ca ]部分，本节主要在创建根证书时使用。取消注释
keyUsage变量，并增加值
1keyUsage = critical, digitalSignature, cRLSign, keyCertSign
- 新增
[ v3_intermediate_ca ]部分
1[ v3_intermediate_ca ]
2subjectKeyIdentifier = hash
3authorityKeyIdentifier = keyid:always,issuer
4basicConstraints = critical, CA:true, pathlen:0
5keyUsage = critical, digitalSignature, cRLSign, keyCertSign
`pathlen:0` 确保中间 CA 下面不能再有其他证书机构。
-
编辑
[ usr_cert ]部分，该部分被用来签发客户证书。取消注释并修改两个变量
1keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
2extendedKeyUsage = clientAuth, emailProtection
- 新增
[ server_cert ]部分，主要用于签发服务器证书。
1[ server_cert ]
2basicConstraints = CA:FALSE
3subjectKeyIdentifier = hash
4authorityKeyIdentifier = keyid,issuer:always
5keyUsage = critical, digitalSignature, keyEncipherment
6extendedKeyUsage = serverAuth
5. 修改用于创建中间人证书的配置文件
为方便起见，在根证书目录下创建中间人证书目录：
1mkdir inter_ca
2cd inter_ca/
3mkdir certs crl newcerts private csr
4chmod 700 private/
5touch index.txt
6echo 2000 > serial
7echo 2000 > crlnumber
8cp ../openssl.cnf .
我们创建一个 csr 目录来存储所有传入的证书签名请求（certificate signature requests, CSR）。创建文件 crlnumber 用于跟踪 CRLs 。
如同上文一样，我们需要修改 openssl.cnf 中的路径，文件名等。
启用 x509_extensions 并设置成 usr_cert ，同时设置 policy 的值为 policy_anything 。
6. 为 root 和中间人创建密钥和证书
使 PKI 正常运行的下一步是分别为 root 和中间人生成密钥对和相应的证书。
6.1. 为 root 创建密钥
1$ cd root_ca/
2$ openssl genrsa -aes256 -out private/root.key.pem 4096
3Generating RSA private key, 4096 bit long modulus
4.......................................................................................................................................................................++
5............................................................................................++
6e is 65537 (0x010001)
7Enter pass phrase for private/root.key.pem: root # 仅作为示例使用，请勿模仿！
8Verifying - Enter pass phrase for private/root.key.pem: root
9$ chmod 400 private/root.key.pem
如果想要获得公钥，可以使用如下命令：
1openssl rsa -in private/root.key.pem -pubout -out root.pub.pem
这里我们不这么直接使用，因为公钥将在被嵌入证书后间接使用。
6.2. 为 root 生成自签名证书
1$ openssl req -config openssl.cnf -key private/root.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out certs/root.cert.pem
2Enter pass phrase for private/root.key.pem:
3You are about to be asked to enter information that will be incorporated
4into your certificate request.
5What you are about to enter is what is called a Distinguished Name or a DN.
6There are quite a few fields but you can leave some blank
7For some fields there will be a default value,
8If you enter '.', the field will be left blank.
9-----
10Country Name (2 letter code) [CN]:
11State or Province Name (full name) [Beijing]:
12Locality Name (eg, city) [Chaoyang]:
13Organization Name (eg, company) [the masses]:
14Organizational Unit Name (eg, section) []:
15Common Name (e.g. server FQDN or YOUR name) []: cyqz_Root
16Email Address []:
17$ chmod 444 certs/root.cert.pem
6.3. 验证根证书
1$ openssl x509 -noout -text -in certs/root.cert.pem
2Certificate:
3 Data:
4 Version: 3 (0x2)
5 Serial Number:
6 8f:4f:94:a4:7d:21:49:d0
7 Signature Algorithm: sha256WithRSAEncryption
8 Issuer: C = CN, ST = Beijing, L = Chaoyang, O = the masses, CN = " cyqz_Root"
9 Validity
10 Not Before: Dec 22 08:48:28 2020 GMT
11 Not After : Dec 17 08:48:28 2040 GMT
12 Subject: C = CN, ST = Beijing, L = Chaoyang, O = the masses, CN = " cyqz_Root"
13 Subject Public Key Info:
14 Public Key Algorithm: rsaEncryption
15 Public-Key: (4096 bit)
16 Modulus:
17 00:c9:37:6b:a7:b0:b4:a5:2f:83:5e:65:ec:47:aa:
18 92:9d:a5:20:f3:3a:c1:22:08:b9:a8:1e:eb:2b:49:
19 2c:89:b5:a0:00:ae:f0:1b:48:2c:b0:24:83:10:fb:
20 72:82:3b:af:38:c8:7d:46:48:90:17:76:64:ff:ca:
21 ...
22 5d:fb:6f:4c:fb:65:b8:af:72:98:e8:84:e6:f0:fb:
23 4b:c7:5e:13:23:7c:5d:10:ff:fb:92:19:d8:09:19:
24 94:15:da:cb:b7:82:f1:0f:16:f8:45:2a:8b:43:b0:
25 65:7e:53
26 Exponent: 65537 (0x10001)
27 X509v3 extensions:
28 X509v3 Subject Key Identifier:
29 CE:45:6D:DA:CB:11:46:F4:79:0A:D9:70:22:0A:95:92:49:FB:D1:37
30 X509v3 Authority Key Identifier:
31 keyid:CE:45:6D:DA:CB:11:46:F4:79:0A:D9:70:22:0A:95:92:49:FB:D1:37
32
33 X509v3 Basic Constraints: critical
34 CA:TRUE
35 X509v3 Key Usage: critical
36 Digital Signature, Certificate Sign, CRL Sign
37 Signature Algorithm: sha256WithRSAEncryption
38 77:5f:fe:43:c8:e3:37:51:68:1a:f8:e7:bd:43:bc:db:97:41:
39 a3:14:6e:92:7f:e6:90:a1:42:aa:f0:d4:e0:a2:d4:ab:ea:83:
40 94:5d:00:3b:d9:aa:9b:1d:f7:3b:7a:ae:30:08:1d:12:c0:ec:
41 d0:3b:af:1d:0d:47:45:d5:58:ed:b5:68:02:7d:db:2b:84:49:
42 ...
43 16:67:9d:53:d5:88:23:7b:4e:d0:34:b2:38:2e:9a:2f:20:ed:
44 64:97:ab:79:98:4f:fb:f4:a5:ef:e4:fb:98:66:26:9c:8f:ab:
45 74:f6:4d:eb:21:e5:6c:89
6.4. 为中间人创建密钥
1$ openssl genrsa -aes256 -out inter_ca/private/inter.key.pem 4096
2Generating RSA private key, 4096 bit long modulus
3...............................................................................++
4.......................................................................................................................................................................................................................................................................................................................................................++
5e is 65537 (0x010001)
6Enter pass phrase for inter_ca/private/inter.key.pem: inter # 仅作为示例使用，请勿模仿！
7Verifying - Enter pass phrase for inter_ca/private/inter.key.pem: inter
8$ chmod 400 inter_ca/private/inter.key.pem
6.5. 创建 CSR
1$ openssl req -config inter_ca/openssl.cnf -new -sha256 -key inter_ca/private/inter.key.pem -out inter_ca/csr/inter.csr.pem
2Enter pass phrase for inter_ca/private/inter.key.pem:
3You are about to be asked to enter information that will be incorporated
4into your certificate request.
5What you are about to enter is what is called a Distinguished Name or a DN.
6There are quite a few fields but you can leave some blank
7For some fields there will be a default value,
8If you enter '.', the field will be left blank.
9-----
10Country Name (2 letter code) [CN]:
11State or Province Name (full name) [Beijing]:
12Locality Name (eg, city) [Chaoyang]:
13Organization Name (eg, company) [the masses]:
14Organizational Unit Name (eg, section) []:
15Common Name (e.g. server FQDN or YOUR name) []:cyqz_Inter
16Email Address []:
17
18Please enter the following 'extra' attributes
19to be sent with your certificate request
20A challenge password []:
21An optional company name []:
6.6. 验证 CSR
1$ openssl req -text -noout -verify -in inter_ca/csr/inter.csr.pem
2verify OK
3Certificate Request:
4 Data:
5 Version: 1 (0x0)
6 Subject: C = CN, ST = Beijing, L = Chaoyang, O = the masses, CN = cyqz_Inter
7 Subject Public Key Info:
8 Public Key Algorithm: rsaEncryption
9 Public-Key: (4096 bit)
10 Modulus:
11 00:b2:80:b6:b8:c5:d6:6a:37:56:da:40:c1:86:80:
12 6d:cb:b4:01:a3:8d:9d:3e:1d:81:59:74:4c:e4:dd:
13 39:10:94:f6:e9:f8:8e:fc:96:2b:18:fd:6a:54:23:
14 70:80:8f:20:f3:f7:ce:c5:a1:58:43:de:af:80:36:
15 ...
16 a1:fa:e2:fb:cf:30:04:69:88:a5:3a:63:5d:65:bd:
17 03:ba:c8:54:8b:12:f6:3e:6f:36:fe:e8:e7:e3:6a:
18 a8:8d:b6:74:ea:2c:47:9f:5b:2e:19:8a:1b:7f:22:
19 83:c5:3d
20 Exponent: 65537 (0x10001)
21 Attributes:
22 a0:00
23 Signature Algorithm: sha256WithRSAEncryption
24 23:31:74:a6:3e:a4:87:82:c3:4e:7f:2d:50:bd:44:e3:1f:b7:
25 ae:2c:02:58:c8:b5:73:e3:0c:6e:c1:06:89:90:c2:42:42:2a:
26 f5:61:9c:7f:bf:6e:58:1b:4b:02:37:2c:ce:ac:e1:36:a4:09:
27 c8:47:43:ed:1f:81:04:e5:63:da:64:35:2a:20:0d:24:fa:48:
28 ...
29 83:b5:53:93:0f:97:27:bf:69:e8:9a:2d:92:6e:9e:d5:5b:99:
30 ab:d7:d9:e6:57:77:9b:ba:3f:ae:c0:df:02:11:b2:00:50:1d:
31 8e:49:9f:5b:c6:b4:83:f4:84:b8:9b:c8:64:18:8f:02:06:84:
32 98:4c:8d:c9:4b:d1:0a:61
6.7. 创建中间人证书
1$ openssl ca -config openssl.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in inter_ca/csr/inter.csr.pem -out inter_ca/certs/inter.cert.pem
2Using configuration from openssl.cnf
3Enter pass phrase for /root_ca/private/root.key.pem:
4Check that the request matches the signature
5Signature ok
6Certificate Details:
7 Serial Number: 4096 (0x1000)
8 Validity
9 Not Before: Dec 22 11:49:10 2020 GMT
10 Not After : Dec 20 11:49:10 2030 GMT
11 Subject:
12 countryName = CN
13 stateOrProvinceName = Beijing
14 organizationName = the masses
15 commonName = cyqz_Inter
16 X509v3 extensions:
17 X509v3 Subject Key Identifier:
18 4E:ED:71:D7:0E:F5:67:42:78:57:6B:77:DB:D1:0F:69:65:81:E2:40
19 X509v3 Authority Key Identifier:
20 keyid:CE:45:6D:DA:CB:11:46:F4:79:0A:D9:70:22:0A:95:92:49:FB:D1:37
21
22 X509v3 Basic Constraints: critical
23 CA:TRUE, pathlen:0
24 X509v3 Key Usage: critical
25 Digital Signature, Certificate Sign, CRL Sign
26Certificate is to be certified until Dec 20 11:49:10 2030 GMT (3650 days)
27Sign the certificate? [y/n]:y
28
29
301 out of 1 certificate requests certified, commit? [y/n]y
31Write out database with 1 new entries
32Data Base Updated
33$ chmod 444 inter_ca/certs/inter.cert.pem
6.8. 验证中间人证书
验证证书细节。
1$ openssl x509 -noout -text -in inter_ca/certs/inter.cert.pem
2Certificate:
3 Data:
4 Version: 3 (0x2)
5 Serial Number: 4096 (0x1000)
6 Signature Algorithm: sha256WithRSAEncryption
7 Issuer: C = CN, ST = Beijing, L = Chaoyang, O = the masses, CN = " cyqz_Root"
8 Validity
9 Not Before: Dec 22 11:49:10 2020 GMT
10 Not After : Dec 20 11:49:10 2030 GMT
11 Subject: C = CN, ST = Beijing, O = the masses, CN = cyqz_Inter
12 Subject Public Key Info:
13 Public Key Algorithm: rsaEncryption
14 Public-Key: (4096 bit)
15 Modulus:
16 00:b2:80:b6:b8:c5:d6:6a:37:56:da:40:c1:86:80:
17 6d:cb:b4:01:a3:8d:9d:3e:1d:81:59:74:4c:e4:dd:
18 39:10:94:f6:e9:f8:8e:fc:96:2b:18:fd:6a:54:23:
19 70:80:8f:20:f3:f7:ce:c5:a1:58:43:de:af:80:36:
20 ...
21 11:b4:43:5d:da:30:b0:b9:47:2f:8d:cf:d3:7e:f6:
22 a1:fa:e2:fb:cf:30:04:69:88:a5:3a:63:5d:65:bd:
23 03:ba:c8:54:8b:12:f6:3e:6f:36:fe:e8:e7:e3:6a:
24 a8:8d:b6:74:ea:2c:47:9f:5b:2e:19:8a:1b:7f:22:
25 83:c5:3d
26 Exponent: 65537 (0x10001)
27 X509v3 extensions:
28 X509v3 Subject Key Identifier:
29 4E:ED:71:D7:0E:F5:67:42:78:57:6B:77:DB:D1:0F:69:65:81:E2:40
30 X509v3 Authority Key Identifier:
31 keyid:CE:45:6D:DA:CB:11:46:F4:79:0A:D9:70:22:0A:95:92:49:FB:D1:37
32
33 X509v3 Basic Constraints: critical
34 CA:TRUE, pathlen:0
35 X509v3 Key Usage: critical
36 Digital Signature, Certificate Sign, CRL Sign
37 Signature Algorithm: sha256WithRSAEncryption
38 9d:6d:32:00:ab:1f:cd:b0:df:5d:fd:43:80:b4:0c:83:91:66:
39 7b:b7:f2:af:da:9a:b5:f7:3a:40:f0:ea:1c:b6:f1:05:a0:c9:
40 fa:29:57:75:d0:cb:fe:c3:e3:00:30:e5:bd:3c:da:c6:e0:09:
41 03:90:ed:d3:79:ee:86:bd:7c:7e:c0:b5:98:13:40:2e:d9:92:
42 ...
43 f6:fd:a1:e5:da:11:53:e0:e5:14:ba:95:15:a8:3a:e1:6d:ec:
44 37:1c:94:ae:7d:97:e4:52:56:40:23:cf:cb:36:89:24:56:29:
45 f3:2e:be:5a:0d:6b:64:ea:64:f0:3a:de:3e:cb:f4:96:fd:ce:
46 a8:ce:02:24:b6:b3:64:90:e3:57:5a:47:a2:59:3b:da:59:31:
47 a4:1e:be:26:d4:c7:c6:f5
将中间证书与根证书进行核对。
1$ openssl verify -CAfile certs/root.cert.pem inter_ca/certs/inter.cert.pem
2inter_ca/certs/inter.cert.pem: OK
6.9. 创建证书链
当应用程序（例如 Web 浏览器）尝试验证由中间 CA 签名的证书时，它还必须对照根证书验证中间证书。 要完成信任链，请创建一个 CA 证书链以呈现给应用程序。
1cat inter_ca/certs/inter.cert.pem certs/root.cert.pem > inter_ca/certs/ca-chain.cert.pem
2chmod 444 inter_ca/certs/ca-chain.cert.pem
7. 创建服务器证书
使用中间 CA 来为服务器签署证书。
7.1. 创建私钥
如果你正在创建一个用于 Web 服务器的加密对（例如，Apache），你需要在每次重新启动 Web 服务器时输入这个密码。你可能想省略 -aes256 选项来创建一个没有密码的密钥，虽然这样会导致安全性降低。
1$ openssl genrsa -out inter_ca/private/server.key.pem 2048
2Generating RSA private key, 2048 bit long modulus
3.......................................................................................+++
4....................................................................+++
5e is 65537 (0x010001)
7.2. 创建 CSR
1$ openssl req -config inter_ca/openssl.cnf -key inter_ca/private/server.key.pem -new -sha256 -out inter_ca/csr/server.csr.pem
2You are about to be asked to enter information that will be incorporated
3into your certificate request.
4What you are about to enter is what is called a Distinguished Name or a DN.
5There are quite a few fields but you can leave some blank
6For some fields there will be a default value,
7If you enter '.', the field will be left blank.
8-----
9Country Name (2 letter code) [CN]:
10State or Province Name (full name) [Beijing]:
11Locality Name (eg, city) [Chaoyang]:
12Organization Name (eg, company) [the masses]:
13Organizational Unit Name (eg, section) []:
14Common Name (e.g. server FQDN or YOUR name) []:localhost
15Email Address []:
16
17Please enter the following 'extra' attributes
18to be sent with your certificate request
19A challenge password []:
20An optional company name []:
7.3. 验证 CSR
1$ openssl req -text -noout -verify -in inter_ca/csr/server.csr.pem
2verify OK
3Certificate Request:
4 Data:
5 Version: 1 (0x0)
6 Subject: C = CN, ST = Beijing, L = Chaoyang, O = the masses, CN = localhost
7 Subject Public Key Info:
8 Public Key Algorithm: rsaEncryption
9 Public-Key: (2048 bit)
10 Modulus:
11 00:bc:da:6d:7b:73:e1:bf:1a:8e:b2:32:d2:39:7f:
12 e4:67:9e:a3:3c:f8:38:d9:45:13:75:26:22:c5:54:
13 ae:9e:76:7a:f7:1a:91:c3:01:49:bc:8a:b3:8a:d6:
14 6f:9c:f4:b7:0a:65:ac:cf:fa:f9:8d:07:2b:18:e4:
15 ...
16 a0:cd:70:48:3e:11:e9:26:14:11:91:4c:36:5a:c6:
17 ed:e4:19:14:77:32:e5:1b:64:a7:dc:8b:3f:3b:94:
18 5f:ed:db:50:32:c8:2d:25:6b:bc:67:af:37:2e:80:
19 80:77:df:04:66:e1:f6:8a:19:a1:94:37:ab:73:a1:
20 57:73
21 Exponent: 65537 (0x10001)
22 Attributes:
23 a0:00
24 Signature Algorithm: sha256WithRSAEncryption
25 b9:12:34:af:a6:46:38:e7:2b:3f:01:79:d6:8c:20:3b:77:b8:
26 76:d2:1f:d3:5c:6b:b6:c0:15:f0:2d:90:30:80:46:a6:ae:69:
27 f8:21:f1:20:a8:c7:b7:52:73:22:0e:b3:cf:52:ba:2e:a5:02:
28 f6:72:e0:58:cc:28:36:ff:cf:9b:7e:49:6c:8d:06:da:90:05:
29 ...
30 a6:d4:4c:74:2b:8a:67:19:f0:8e:bc:b8:3d:3a:4b:75:00:36:
31 48:cd:9e:c1:a6:70:1e:b1:ec:b7:d1:bf:79:8a:88:fa:79:a3:
32 58:cd:9e:91
7.4. 创建证书
1$ openssl ca -config inter_ca/openssl.cnf -extensions server_cert -days 375 -notext -md sha256 -in inter_ca/csr/server.csr.pem -out inter_ca/certs/server.cert.pem
2Using configuration from inter_ca/openssl.cnf
3Enter pass phrase for /home/root_ca/inter_ca/private/inter.key.pem:
4Check that the request matches the signature
5Signature ok
6Certificate Details:
7 Serial Number: 8192 (0x2000)
8 Validity
9 Not Before: Dec 22 12:17:44 2020 GMT
10 Not After : Jan 1 12:17:44 2022 GMT
11 Subject:
12 countryName = CN
13 stateOrProvinceName = Beijing
14 localityName = Chaoyang
15 organizationName = the masses
16 commonName = localhost
17 X509v3 extensions:
18 X509v3 Basic Constraints:
19 CA:FALSE
20 X509v3 Subject Key Identifier:
21 6B:F6:40:0A:6D:93:7C:A2:23:19:E3:6A:7B:DF:DF:6D:5F:63:49:EF
22 X509v3 Authority Key Identifier:
23 keyid:4E:ED:71:D7:0E:F5:67:42:78:57:6B:77:DB:D1:0F:69:65:81:E2:40
24 DirName:/C=CN/ST=Beijing/L=Chaoyang/O=the masses/CN= cyqz_Root
25 serial:10:00
26
27 X509v3 Key Usage: critical
28 Digital Signature, Key Encipherment
29 X509v3 Extended Key Usage:
30 TLS Web Server Authentication
31Certificate is to be certified until Jan 1 12:17:44 2022 GMT (375 days)
32Sign the certificate? [y/n]:y
33
34
351 out of 1 certificate requests certified, commit? [y/n]y
36Write out database with 1 new entries
37Data Base Updated
7.5. 验证证书
1$ openssl x509 -noout -text -in inter_ca/certs/server.cert.pem
2Certificate:
3 Data:
4 Version: 3 (0x2)
5 Serial Number: 8192 (0x2000)
6 Signature Algorithm: sha256WithRSAEncryption
7 Issuer: C = CN, ST = Beijing, O = the masses, CN = cyqz_Inter
8 Validity
9 Not Before: Dec 22 12:17:44 2020 GMT
10 Not After : Jan 1 12:17:44 2022 GMT
11 Subject: C = CN, ST = Beijing, L = Chaoyang, O = the masses, CN = localhost
12 Subject Public Key Info:
13 Public Key Algorithm: rsaEncryption
14 Public-Key: (2048 bit)
15 Modulus:
16 00:bc:da:6d:7b:73:e1:bf:1a:8e:b2:32:d2:39:7f:
17 e4:67:9e:a3:3c:f8:38:d9:45:13:75:26:22:c5:54:
18 ae:9e:76:7a:f7:1a:91:c3:01:49:bc:8a:b3:8a:d6:
19 6f:9c:f4:b7:0a:65:ac:cf:fa:f9:8d:07:2b:18:e4:
20 ...
21 ed:e4:19:14:77:32:e5:1b:64:a7:dc:8b:3f:3b:94:
22 5f:ed:db:50:32:c8:2d:25:6b:bc:67:af:37:2e:80:
23 80:77:df:04:66:e1:f6:8a:19:a1:94:37:ab:73:a1:
24 57:73
25 Exponent: 65537 (0x10001)
26 X509v3 extensions:
27 X509v3 Basic Constraints:
28 CA:FALSE
29 X509v3 Subject Key Identifier:
30 6B:F6:40:0A:6D:93:7C:A2:23:19:E3:6A:7B:DF:DF:6D:5F:63:49:EF
31 X509v3 Authority Key Identifier:
32 keyid:4E:ED:71:D7:0E:F5:67:42:78:57:6B:77:DB:D1:0F:69:65:81:E2:40
33 DirName:/C=CN/ST=Beijing/L=Chaoyang/O=the masses/CN= cyqz_Root
34 serial:10:00
35
36 X509v3 Key Usage: critical
37 Digital Signature, Key Encipherment
38 X509v3 Extended Key Usage:
39 TLS Web Server Authentication
40 Signature Algorithm: sha256WithRSAEncryption
41 1c:4b:7b:16:c5:32:79:8c:f1:c4:1c:68:8d:17:02:7d:b6:f9:
42 ba:22:ca:f9:17:40:2d:3a:82:c7:ae:74:96:12:5b:9c:f8:0d:
43 03:c5:e7:fc:55:46:6c:92:f4:3f:91:24:66:ad:be:fb:73:d7:
44 d4:dc:fa:35:c5:d3:4d:97:7c:bb:45:94:24:d5:62:de:46:c4:
45 29:dd:9d:7b:90:ac:5b:29:ef:00:b8:58:e2:2e:fa:e8:27:d8:
46 ...
47 70:56:96:fe:b3:6d:4b:2d:d6:6c:23:76:b4:fa:1b:7d:aa:e3:
48 41:15:91:cc:0c:f1:d0:05:39:11:ee:c7:f3:70:fc:91:35:1f:
49 97:bb:2d:59:2a:68:45:13:12:9a:a3:ce:01:f1:66:dc:f3:f6:
50 c2:2d:2b:cc:fd:5c:88:04:f1:ac:f3:07:52:09:55:d6:ac:f3:
51 e2:d1:33:d0:26:3f:40:7d
1$ openssl verify -CAfile inter_ca/certs/ca-chain.cert.pem inter_ca/certs/server.cert.pem
2inter_ca/certs/server.cert.pem: OK
8. 使用 CRL 吊销证书
编辑 /root_ca/inter_ca/openssl.cnf ，并在 server_cert 部分添加：
1crlDistributionPoints = URI:https://localhost/inter.crl.pem
8.1. 创建 CRL
1$ openssl ca -config inter_ca/openssl.cnf -gencrl -out inter_ca/crl/inter.crl.pem
2Using configuration from inter_ca/openssl.cnf
3Enter pass phrase for /home/root_ca/inter_ca/private/inter.key.pem:
检查内容：
1$ openssl crl -in inter_ca/crl/inter.crl.pem -noout -text
2Certificate Revocation List (CRL):
3 Version 2 (0x1)
4 Signature Algorithm: sha256WithRSAEncryption
5 Issuer: /C=CN/ST=Beijing/O=the masses/CN=cyqz_Inter
6 Last Update: Dec 22 12:37:35 2020 GMT
7 Next Update: Jan 21 12:37:35 2021 GMT
8 CRL extensions:
9 X509v3 CRL Number:
10 8192
11No Revoked Certificates.
12 Signature Algorithm: sha256WithRSAEncryption
13 55:78:44:16:c4:a6:15:f4:71:ad:e9:0b:9f:9f:72:a0:2a:8f:
14 96:67:8a:c2:7e:f4:49:ab:9f:34:73:b7:13:04:e0:b4:b0:60:
15 50:07:16:e3:d5:d9:61:cc:70:2f:6f:3d:91:fa:52:9b:96:96:
16 2d:93:7b:85:f4:4c:a0:b1:16:e1:a9:02:67:1d:0c:de:eb:44:
17 ...
18 35:4a:3b:a7:2a:59:c6:78:99:5e:f3:54:9f:8a:af:2b:da:38:
19 a1:5a:3f:2c:65:86:56:02:3c:5e:f9:c1:f8:12:8d:41:d0:d8:
20 a3:2b:52:af:00:f2:52:93
此时还没有证书被吊销，接下来就创建一个证书并吊销它。
8.2. 吊销证书
8.2.1. 创建私钥
1$ openssl genrsa -out private/jack@jack.com.key.pem 2048
2Generating RSA private key, 2048 bit long modulus
3........................................................+++
4.....................................+++
5e is 65537 (0x010001)
8.2.2. 创建 CSR
1$ mkdir csr
2$ openssl req -config inter_ca/openssl.cnf -key private/jack@jack.com.key.pem -new -sha256 -out csr/jack@jack.com.csr.pem
3You are about to be asked to enter information that will be incorporated
4into your certificate request.
5What you are about to enter is what is called a Distinguished Name or a DN.
6There are quite a few fields but you can leave some blank
7For some fields there will be a default value,
8If you enter '.', the field will be left blank.
9-----
10Country Name (2 letter code) [CN]:
11State or Province Name (full name) [Beijing]:
12Locality Name (eg, city) [Chaoyang]:
13Organization Name (eg, company) [the masses]:
14Organizational Unit Name (eg, section) []:
15Common Name (e.g. server FQDN or YOUR name) []:jack@jack.com
16Email Address []:
17
18Please enter the following 'extra' attributes
19to be sent with your certificate request
20A challenge password []:
21An optional company name []:
8.2.3. 创建证书
1$ openssl ca -config inter_ca/openssl.cnf -extensions usr_cert -days 375 -notext -md sha256 -in csr/jack@jack.com.csr.pem -out certs/jack@jack.com.cert.pem
2Using configuration from inter_ca/openssl.cnf
3Enter pass phrase for /home/root_ca/inter_ca/private/inter.key.pem:
4Check that the request matches the signature
5Signature ok
6Certificate Details:
7 Serial Number: 8193 (0x2001)
8 Validity
9 Not Before: Dec 22 12:49:47 2020 GMT
10 Not After : Jan 1 12:49:47 2022 GMT
11 Subject:
12 countryName = CN
13 stateOrProvinceName = Beijing
14 localityName = Chaoyang
15 organizationName = the masses
16 commonName = jack@jack.com
17 X509v3 extensions:
18 X509v3 Basic Constraints:
19 CA:FALSE
20 X509v3 Key Usage: critical
21 Digital Signature, Non Repudiation, Key Encipherment
22 Netscape Comment:
23 OpenSSL Generated Certificate
24 X509v3 Subject Key Identifier:
25 F9:43:1B:77:29:B4:5D:E3:69:C8:7F:09:71:94:CE:C8:91:24:6F:F9
26 X509v3 Authority Key Identifier:
27 keyid:4E:ED:71:D7:0E:F5:67:42:78:57:6B:77:DB:D1:0F:69:65:81:E2:40
28
29 X509v3 Extended Key Usage:
30 TLS Web Client Authentication, E-mail Protection
31Certificate is to be certified until Jan 1 12:49:47 2022 GMT (375 days)
32Sign the certificate? [y/n]:y
33
34
351 out of 1 certificate requests certified, commit? [y/n]y
36Write out database with 1 new entries
37Data Base Updated
8.2.4. 验证证书
1$ openssl verify -CAfile inter_ca/certs/ca-chain.cert.pem certs/jack@jack.com.cert.pem
2certs/jack@jack.com.cert.pem: OK
8.2.5. 查看 index.txt
1$ cat inter_ca/index.txt
2V 220101121744Z 2000 unknown /C=CN/ST=Beijing/L=Chaoyang/O=the masses/CN=localhost
3V 220101124947Z 2001 unknown /C=CN/ST=Beijing/L=Chaoyang/O=the masses/CN=jack@jack.com
8.2.6. 吊销证书
1$ openssl ca -config inter_ca/openssl.cnf -revoke certs/jack@jack.com.cert.pem
2Using configuration from inter_ca/openssl.cnf
3Enter pass phrase for /home/root_ca/inter_ca/private/inter.key.pem:
4Revoking Certificate 2001.
5Data Base Updated
8.2.7. 再次查看 index.txt
1$ openssl ca -config inter_ca/openssl.cnf -revoke certs/jack@jack.com.cert.pem
2Using configuration from inter_ca/openssl.cnf
3Enter pass phrase for /home/root_ca/inter_ca/private/inter.key.pem:
4Revoking Certificate 2001.
5Data Base Updated
此时证书已经被吊销
8.3. 重新创建 CRL
1$ openssl ca -config inter_ca/openssl.cnf -gencrl -out inter_ca/crl/inter.crl.pem
2Using configuration from inter_ca/openssl.cnf
3Enter pass phrase for /home/root_ca/inter_ca/private/inter.key.pem:
查看内容：
1$ cat inter_ca/index.txt
2V 220101121744Z 2000 unknown /C=CN/ST=Beijing/L=Chaoyang/O=the masses/CN=localhost
3R 220101124947Z 201222125325Z 2001 unknown /C=CN/ST=Beijing/L=Chaoyang/O=the masses/CN=jack@jack.com
吊销的证书会出现说明。