刘佳的技术日志、博客

RHEL4的路径：
[root@minot conf]# pwd
/etc/httpd/conf
[root@minot conf]# tree ./
./
|-- Makefile -> ../../../usr/share/ssl/certs/Makefile
|-- httpd.conf
|-- magic
|-- ssl.crl
|   `-- Makefile.crl
|-- ssl.crt
|   |-- Makefile.crt
|   `-- server.crt
|-- ssl.csr
|-- ssl.key
|   `-- server.key
`-- ssl.prm

5 directories, 7 files
[root@minot conf]# make
This makefile allows you to create:
  o public/private key pairs
  o SSL certificate signing requests (CSRs)
  o self-signed SSL test certificates

To create a key pair, run "make SOMETHING.key".
To create a CSR, run "make SOMETHING.csr".
To create a test certificate, run "make SOMETHING.crt".
To create a key and a test certificate in one file, run "make SOMETHING.pem".

To create a key for use with Apache, run "make genkey".
To create a CSR for use with Apache, run "make certreq".
To create a test certificate for use with Apache, run "make testcert".

Examples:
  make server.key
  make server.csr
  make server.crt
  make stunnel.pem
  make genkey
  make certreq
  make testcert

RHEL5的路径：
[root@server certs]# pwd
/etc/pki/tls/certs
[root@server certs]# tree ./
./
|-- Makefile
|-- ca-bundle.crt
|-- localhost.crt
|-- make-dummy-cert
|-- server.crt
`-- server.csr

0 directories, 6 files
[root@server certs]# make
This makefile allows you to create:
  o public/private key pairs
  o SSL certificate signing requests (CSRs)
  o self-signed SSL test certificates

To create a key pair, run "make SOMETHING.key".
To create a CSR, run "make SOMETHING.csr".
To create a test certificate, run "make SOMETHING.crt".
To create a key and a test certificate in one file, run "make SOMETHING.pem".

To create a key for use with Apache, run "make genkey".
To create a CSR for use with Apache, run "make certreq".
To create a test certificate for use with Apache, run "make testcert".

To create a test certificate with serial number other than zero, add SERIAL=num

Examples:
  make server.key
  make server.csr
  make server.crt
  make stunnel.pem
  make genkey
  make certreq
  make testcert
  make server.crt SERIAL=1
  make stunnel.pem SERIAL=2
  make testcert SERIAL=3

[root@server conf.d]# httpd -S
VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
_default_:443          server.rhel5.com (/etc/httpd/conf.d/ssl.conf:81)
Syntax OK

[root@server conf.d]# cat ssl.conf
.............
SSLCertificateFile /etc/pki/tls/certs/locale.crt
SSLCertificateKeyFile /etc/pki/tls/private/locale.key
..................

1：保证自己进入下面的目录：
[root@server certs]# pwd
/etc/pki/tls/certs

2：创建私钥：
[root@server certs]# make server.key
umask 77 ; \
        /usr/bin/openssl genrsa -des3 1024 > server.key
Generating RSA private key, 1024 bit long modulus
.++++++
...++++++
e is 65537 (0x10001)
Enter pass phrase:  输入密码
Verifying - Enter pass phrase:  再次输入密码

3：重写私钥，清除密码，保证httpd启动时不必输入密码
[root@rhce conf]# openssl rsa -in server.key -out server.key
Enter pass phrase for server.key:
writing RSA key

4：证书签发请求(Certificate Signing Request) (CSR)
[root@server certs]# make server.csr
umask 77 ; \
        /usr/bin/openssl req -utf8 -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:ShangHai
Locality Name (eg, city) [Newbury]:ShangHai
Organization Name (eg, company) [My Company Ltd]:kook.com
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:server.rhel5.com
Email Address []:kook@kook.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:liujia
An optional company name []:kook

5：由于我们不能申请上级CA授权认证，自己给自己创建个CA吧。
[root@server certs]# openssl x509 -in server.csr -req -signkey server.key -days 365 -out server.crt
Signature ok
subject=/C=CN/ST=ShangHai/L=ShangHai/O=kook.com/CN=server.rhel5.com/emailAddress=kook@kook.com
Getting Private key

6：如上操作后，我们产生了3个文件。
[root@server certs]# ls server.*
server.crt  server.csr  server.key

[root@server conf.d]# cat ssl.conf
.............
SSLCertificateFile /etc/pki/tls/certs/server.crt
SSLCertificateKeyFile /etc/pki/tls/certs/server.key
..................