使用 makecert 向自签名证书添加或创建“主题备用名称"字段 [英] add or create 'Subject Alternative Name' field to self-signed certificate using makecert
问题描述
如何使用带有主题备用名称"字段的 makecert 创建证书?
How can I create a certificate using makecert with a 'Subject Alternative Name' field ?
您可以添加 一些 字段，例如使用 -eku 选项的增强型密钥使用"，我尝试了 -san 选项，但 makecert 不喜欢它.
You can add some fields eg, 'Enhanced Key Usage' with the -eku option and I've tried the -san option but makecert doesn't like it.
这是一个自签名证书，因此任何使用 IIS 创建内容以发送给 CA 的方法都不合适.
This is a self-signed certificate so any method that uses IIS to create something to send off to a CA won't be appropriate.
推荐答案
Makecert 似乎不支持 SAN，所以我创建了一个带有 SAN 的证书，用于使用 OpenSSL 的 IIS.查看我的博客文章:
Makecert doesn't appear to support SANs so I created a certificate with SANs for use with IIS using OpenSSL. Check out my blog post about it:
IIS 7 提供了一些易于使用的向导来创建 SSL 证书，但是不是很强大.我需要做的是创建 SSL包含 x.509 V3 扩展的证书，即主题替代名称，a.k.a SAN.SAN 所做的是允许网站用于验证来自多个 URL 域的传入请求的证书名称.当 web 服务器运行 web 时，这非常重要服务(例如 WCF 服务)以及其他 Web 服务何时连接到它们通过 SSL 连接与面向服务的体系结构一样.除非向 Web 服务添加特殊代码来覆盖默认 SSL 验证处理程序例程，通用名称 (CN)证书必须与传入的请求 URL 域匹配.所以如果请求是使用 FQDN 发出的，证书的 FQDN 必须为CN 或 SAN、IP 地址或仅主机名将导致 SSL验证错误，连接将失败.
IIS 7 provides some easy to use wizards to create SSL certificates, however not very powerful ones. What I needed to do was to create SSL certificates that included a x.509 V3 extension, namely subject alternative names, a.k.a SANs. What SANs do is allow the website certificate to validate incoming requests by more than one URL domain name. This is really important when the web server is running web services such as WCF services and when other web services connect to them over SSL connections as with service oriented architectures. Unless special code is added to the web services to override the default SSL validation handler routines, the common name (CN) of the certificate MUST match the incoming request URL domain. So if the request was made using an FQDN, the certificate must have the FQDN as a CN or a SAN, a IP address or just a hostname will cause an SSL validation error and the connection will fail.
SAN 来拯救... SAN 支持 DNS 名称和 IP 等地址.因此，通过使用服务器 FQDN 的 SAN 创建证书和 IP 地址，它增加了其他 Web 服务可以使用的方式连接.
SANs to the rescue… SANs support, among other things, DNS names and IP addresses. So by creating the certificate with SANs of the server FQDN and IP address, it increases the ways that other web services can connect.
有许多工具可以生成证书:makecert.exe、keytool.exe (java)、selfssl.exe 和 openssl.exe.在此外，从 Windows Vista 和 Server 2008 开始，Microsoft 添加了CertEnroll API，它也可以以编程方式创建证书通过 COM 接口.
There are a number of tools that can generate certificates: makecert.exe, keytool.exe (java), selfssl.exe and openssl.exe. In addition, starting with Windows Vista and Server 2008 Microsoft added the CertEnroll API which can also create certificates programmatically either through COM interfaces.
OpenSSL 最终完成了我需要它做的事情.这个过程是相当直截了当.
OpenSSL ended up doing exactly what I needed it to do. The process was fairly straight forward.
- 构造一个 OpenSSL 配置文件.
[req] distinct_name = req_distinguished_name x509_extensions =v3_req prompt = no [req_distinguished_name] C = US ST = VA L =某处 O = MyOrg OU = MyOU CN = MyServerName [v3_req] keyUsage =keyEncipherment, dataEncipherment extendedKeyUsage = serverAuthsubjectAltName = @alt_names [alt_names] DNS.1 = MyServerName DNS.2 =10.0.1.34 IP.1 = 10.0.1.34 IP.2 = 192.167.20.1
[req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = VA L = Somewhere O = MyOrg OU = MyOU CN = MyServerName [v3_req] keyUsage = keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = MyServerName DNS.2 = 10.0.1.34 IP.1 = 10.0.1.34 IP.2 = 192.167.20.1
- 使用 OpenSSL 创建 x509 请求
openssl.exe req -x509 -nodes -days 730 -newkey rsa:2048 -keyoutC:cert.pem -out C:cert.pem -config C:PathToConfigFileAbove.txt
openssl.exe req -x509 -nodes -days 730 -newkey rsa:2048 -keyout C:cert.pem -out C:cert.pem -config C:PathToConfigFileAbove.txt
- 创建一个包含密钥对的 PFX
openssl.exe pkcs12 -export -out C:cert.pfx -in C:cert.pem -name "My证书"-passout pass:mypassword
openssl.exe pkcs12 -export -out C:cert.pfx -in C:cert.pem -name "My Cert" -passout pass:mypassword
使用服务器中的导入链接将 PFX 导入 IIS证书区.
Import the PFX into IIS using the import link in the server certificates area.
将证书绑定到 IIS 网站.
Bind the certificate to the IIS websites.
还有 viola，我们知道有一个带有 SAN 的 IIS 的 SSL 证书，所以我们可以使用多个域名连接而无需证书验证错误.
And viola, we know have a SSL certificate for IIS with SANs so we can connect using multiple domain names without certificate validation errors.
来源:使用 SAN 创建证书使用 OpenSSL，作者 Andy Arismeti，2011 年 9 月 1 日，星期四
Source: Creating certificates with SANs using OpenSSL by Andy Arismeti, Thursday, September 1, 2011
这篇关于使用 makecert 向自签名证书添加或创建“主题备用名称"字段的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
