证书的说明及使用
电子商务认证授权机构（CA, Certificate Authority），也称为电子商务认证中心，是负责发放和管理数字证书的权威机构，并作为电子商务交易中受信任的第三方，承担公钥体系中公钥的合法性检验的责任。
客户机需要申请CA认证时，首先要生成申请请求，把申请的请求发送到CA，CA进行审核，审核之后验证无误，CA可以进行签名，之后才能发放证书。得到证书之后就可以应用到程序里，程序的配置文件里包含证书的路径，既可以实现加密
搭建私有CA
1）查看CA的配置文件/etc/pki/tls/openssl.cnf
####################################################################
[ ca ]
default_ca = CA_default # 默认CA
####################################################################
[ CA_default ]
dir = /etc/pki/CA # CA的工作目录
certs = $dir/certs # 证书指定存放的文件夹
crl_dir = $dir/crl # 证书吊销列表文件夹
database = $dir/index.txt # 数据库文件夹，index.txt需手动创建空文件
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # 新证书存放列表
certificate = $dir/cacert.pem # CA自身的证书
serial = $dir/serial # 当前序列号，决定下一个证书的编号，需要手动创建文件，并设定编号
crlnumber = $dir/crlnumber # 下一个证书被吊销的编号
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# 证书CA的私钥
RANDFILE = $dir/private/.rand # private random number file
default_days = 365 # 证书的默认时间365天
default_crl_days= 30 # crl的有效时间
default_md = sha256 # 加密算法
[ policy_match ] # CA的策略
countryName = match # 国家
stateOrProvinceName = match # 城市
organizationName = match # 公司
organizationalUnitName = optional # 部门
commonName = supplied # 主机的通用名，泛域名
emailAddress = optional # 邮件地址
2）创建所需文件
在CA的文件目录下，index.txt和serial文件需要手工创建，index.txt是空文件，serial指定颁发证书的序列号，所有在创建文件时需写入一个能表达序号的数字。
[root@c7 ~]# touch /etc/pki/CA/index.txt # 创建index.txt
[root@c7 ~]# ls /etc/pki/CA/index.txt
/etc/pki/CA/index.txt
[root@c7 ~]# echo 01 > /etc/pki/CA/serial # 创建serial
[root@c7 ~]# ls /etc/pki/CA/serial
/etc/pki/CA/serial
3）生成私钥
首先生成私钥，生成的私钥存放在/etc/pki/CA/private/下，文件名为cakey.pem，权限为只读，并进行加密，因为umask仅对本文件生效，所以要加括号
[root@c7 CA]# (umask 066;openssl genrsa -out /etc/pki/CA/private/cakey.pem -des3 2048) # 生成私钥
Generating RSA private key, 2048 bit long modulus
.......+++
.........+++
e is 65537 (0x10001)
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Verifying - Enter pass phrase for /etc/pki/CA/private/cakey.pem:
[root@c7 CA]# cat private/cakey.pem # 查看私钥
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED # 已加密
DEK-Info: DES-EDE3-CBC,3F051902487C8CE7
cE6TNk0+ZGdh70JHwD9m6+KN/Y9Cx7K8Q1+xSsD2voAKTIIcxgS0ANWcIDnF1xLz
JS0aNeflStP2gOlb6cdXclkA1rVuLM8tuJ+bP2u2THOERA6HPpqyPZeAdb5AwBeO
hE3I+HSWzYu9VhfIfDILV9FC2rJJTyOoSyPJfPlCyzIzsgJs30pCfk+WSRgsISpM
...... # 文件过长
4）生成自签名证书
利用x509申请新的自签名证书，时间7300天，保存位置在/etc/pki/CA/，文件名cacert.pem
-new: 生成新证书签署请求
-x509: 专用于CA生成自签证书
-key: 生成请求时用到的私钥文件
-days n：证书的有效期限
-out /PATH/TO/SOMECERTFILE: 证书的保存路径
[root@c7 CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 7300 -out /etc/pki/CA/cacert.pem
Enter pass phrase for /etc/pki/CA/private/cakey.pem: # 输入私钥密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN # 填写国家简称（两位）
State or Province Name (full name) []:henan # 填写地区
Locality Name (eg, city) [Default City]:zhengzhou # 填写城市
Organization Name (eg, company) [Default Company Ltd]:magedu.com # 填写公司名称
Organizational Unit Name (eg, section) []:yunwei # 填写公司部门
Common Name (eg, your name or your server's hostname) []:ca.magedu.com # 填写证书颁发机构
Email Address []: # 填写公司邮箱，可以忽略
用sz命令到处cacert.pem文件到物理机，修改文件后缀为.cer，双击查看证书，自签名证书颁发者和颁发给是相同的，安装证书之后证书即可受信
客户端申请证书
1）首先生成私钥，私钥没有固定的文件路径，可以根据使用程序的路径随处存放。建议放在服务对应的文件夹里.
[root@c6 ~]# (umask 066; openssl genrsa -out /etc/pki/tls/private/test.key 2048)
Generating RSA private key, 2048 bit long modulus
..............+++
..................................................+++
e is 65537 (0x10001)
[root@c6 ~]# ls /etc/pki/tls/private/test.key
/etc/pki/tls/private/test.key
2）利用私钥生成证书申请文件，然后把申请文件发送到CA的办法机构，经过CA的确认后颁发CA授权证书。这一步与搭建私有CA的区别就是在命令中没有使用命令x509
[root@c6 ~]# openssl req -new -key /etc/pki/tls/private/test.key -out app.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN # 输入国家（必须和证书颁发机构一致）
State or Province Name (full name) []:henan # 输入地区（必须和证书颁发机构一致）
Locality Name (eg, city) [Default City]:zmd # 输入任意城市
Organization Name (eg, company) [Default Company Ltd]:magedu.com # 输入CA机构的名称（必须和证书颁发机构一致）
Organizational Unit Name (eg, section) []:bg # 输入任意部门
Common Name (eg, your name or your server's hostname) []:test.magedu.com # 输入使用证书的网址
Email Address []: # 输入邮箱（可忽略）
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: # 输入密码（可忽略）
An optional company name []: # 输入公司名称（可忽略）
[root@c6 ~]# ls # 查看生成的app.csr文件
anaconda-ks.cfg Desktop Downloads install.log.syslog Pictures Templates
app.csr Documents install.log Music Public Videos
3）发送证书申请文件app.csr到CA颁发机构
[root@c6 ~]# scp app.csr 192.168.10.134:/etc/pki/CA
root@192.168.10.134's password:
app.csr 100% 1005 1.0KB/s 00:00
4）由证书的颁发机构进行审核后颁发证书
[root@c7 CA]# openssl ca -in app.csr -out /etc/pki/CA/certs/app.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem: # 输入私钥密码
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Sep 10 09:32:45 2017 GMT
Not After : Sep 10 09:32:45 2018 GMT
Subject: # 审核申请信息
countryName = CN
stateOrProvinceName = henan
organizationName = magedu.com
organizationalUnitName = bg
commonName = test.magedu.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A0:CA:77:3A:E0:58:CA:B7:E9:85:31:93:02:9C:2B:C9:C5:EE:FF:7E
X509v3 Authority Key Identifier:
keyid:B2:7A:04:20:87:A8:3F:7A:DA:28:63:02:AC:D7:5B:AF:7E:9E:00:4A
Certificate is to be certified until Sep 10 09:32:45 2018 GMT (365 days)
Sign the certificate? [y/n]:y # 审核通过
1 out of 1 certificate requests certified, commit? [y/n]y # 确认颁发证书
Write out database with 1 new entries
Data Base Updated
[root@c7 CA]# ls certs/app.crt # 确认证书的生成
certs/app.crt
此时在index.txt文件中加入了一条新的记录，因为serial保存的是下一个证书的序列号，所以新的serial文件的内容在原有内容上加1，证书的序列号使用十六进制表示
[root@c7 CA]# cat index.txt
V 180910093245Z 01 unknown /C=CN/ST=henan/O=magedu.com/OU=bg/CN=test.magedu.com
[root@c7 CA]# cat serial
02
同时index.txt生成了备份文件index.txt.old，serial生成了备份文件serial.old
[root@c7 CA]# ls
app.csr certs index.txt index.txt.old private serial.old
cacert.pem crl index.txt.attr newcerts serial
在newcerts文件中生成以证书编号命名的内容相同的证书文件
[root@c7 CA]# ls newcerts/01.pem certs/app.crt
certs/app.crt newcerts/01.pem
[root@c7 CA]# diff newcerts/01.pem certs/app.crt
[root@c7 CA]#
5）复制证书到申请机构，就可以随意使用了
[root@c7 CA]# scp certs/app.crt 192.168.10.133:/etc/pki/tls/certs
The authenticity of host '192.168.10.133 (192.168.10.133)' can't be established.
RSA key fingerprint is 48:ad:3b:a3:d0:53:c6:ca:d0:48:da:5b:35:78:4e:72.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.133' (RSA) to the list of known hosts.
root@192.168.10.133's password:
app.crt 100% 4480 4.4KB/s 00:00
★ 同一个申请不能颁发两份证书
