如何创建自己的自签名根证书和要在Java密钥库中导入的中间CA? [英] How to create own self-signed root certificate and intermediate CA to be imported in Java keystore?
问题描述
如何创建要在Java密钥库中导入的自签名根证书和中间CA?
How to create self-signed root certificate and intermediate CA to be imported in Java keystore?
我们将使用它进行SSL和TLS,稍后再使用基于客户端证书的CLIENT-AUTH身份验证.
We will use this for SSL and TLS, and later for Client certificate based CLIENT-AUTH authentication.
使用OpenSSL和KeyTool.
Using OpenSSL and KeyTool.
推荐答案
对于任何想要生成链和大量证书的人来说,它只是一个旁注.为了完善@EpicPandaForce的答案,以下是一个脚本,该脚本在root-ca/
中创建一个根CA,在intermediate/
中创建一个中间CA,并提供三个对out/
的证书,每个证书都使用中间CA签名.
Just a side note for anyone wanting to generate a chain and a number of certificates. Refining @EpicPandaForce's own answer, here's a script that creates a root CA in root-ca/
, an intermediate CA in intermediate/
and three certificates to out/
, each signed with the intermediate CA.
#!/bin/bash -x
set -e
for C in `echo root-ca intermediate`; do
mkdir $C
cd $C
mkdir certs crl newcerts private
cd ..
echo 1000 > $C/serial
touch $C/index.txt $C/index.txt.attr
echo '
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = '$C' # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/.rnd # private random number file
nameopt = default_ca
certopt = default_ca
policy = policy_match
default_days = 365
default_md = sha256
[ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req]
basicConstraints = CA:TRUE
' > $C/openssl.conf
done
openssl genrsa -out root-ca/private/ca.key 2048
openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'
openssl genrsa -out intermediate/private/intermediate.key 2048
openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=Interm.'
openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt
mkdir out
for I in `seq 1 3` ; do
openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048
openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request
done
这篇关于如何创建自己的自签名根证书和要在Java密钥库中导入的中间CA?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!