openSSL 使用 CA 签署 https_client 证书 [英] openSSL sign https_client certificate with CA

问题描述

我需要:

• 创建 CA 证书
• 创建一个 https_client 证书
• 由 CA 签署 https_client 证书

通过在 Linux 上使用命令行 - openSUSE.我创建了 CA 证书:

by using the command-line on Linux - openSUSE. I create the CA certificate:

 # openssl genrsa -out rootCA.key 2048
Generating RSA private key, 2048 bit long modulus
..........................................................+++
....................+++
e is 65537 (0x10001)
 # openssl req -x509 -new -nodes -key rootCA.key -days 3650 -out rootCA.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AA
State or Province Name (full name) [Some-State]:A
Locality Name (eg, city) []:A
Organization Name (eg, company) [Internet Widgits Pty Ltd]:A
Organizational Unit Name (eg, section) []:A
Common Name (e.g. server FQDN or YOUR name) []:A
Email Address []:A
 #

工作正常.然后我创建 https_client-certificate:

Works fine. Then I create the https_client-certificate:

 # openssl genrsa -out client1.key 2048
Generating RSA private key, 2048 bit long modulus
............................+++
.............................................+++
e is 65537 (0x10001)
 #
 # openssl req -x509 -new -nodes -key client1.key -days 3650 -out client1.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BB
State or Province Name (full name) [Some-State]:B
Locality Name (eg, city) []:B
Organization Name (eg, company) [Internet Widgits Pty Ltd]:B
Organizational Unit Name (eg, section) []:B
Common Name (e.g. server FQDN or YOUR name) []:B
Email Address []:B
 #

工作正常.现在，当我尝试使用 CA 签署 https_client-certificate 时，我在这里遇到了一些错误:

Works fine. Now when I try to sign the https_client-certificate with the CA I'm getting some error here:

 # openssl ca -in client1.pem -out client11.pem
Using configuration from /etc/ssl/openssl.cnf
Error opening CA private key ./demoCA/private/cakey.pem
139667082016400:error:02001002:system library:fopen:No such file or directory:bss_file.c:404:fopen('./demoCA/private/cakey.pem','re')
139667082016400:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:406:
unable to load CA private key
 #

我已经试过了:

• 使用绝对路径(在 Windows 上打开 CA 私钥时出错")

但对我来说没有成功.我在某处读到特定输入的属性需要与 CA 创建时输入的相同，但至少在使用 XCA-Tool 在 Windows 上创建证书时，这是不正确的.我可以输入完全不同的东西，只要我用 CA 签名就可以使用它.有人能帮我吗?

but no success for me. I read somewhere that specific entered attributes need to be the same entered on CA-creation, but at least when creating certificates on Windows using XCA-Tool this is not correct. I can enter completely different stuff as long as I sign it with CA I can use it. Can someone help me?

更新:我只使用 .key 和 .pem 因为这对我在 Windows 上使用 XCA-Tool 有效......我实际上正在阅读 openSSL Cookbook (https://www.feistyduck.com/library/openssl-cookbook/online/ch-openssl.html) 看看我有没有做过特别错.首先想到的是，我是否必须使用 .csr 来签署证书，或者我也可以使用任何其他格式来执行此操作?

Update: I only use .key and .pem because this works for me on Windows using XCA-Tool ... I'm actual reading the openSSL Cookbook (https://www.feistyduck.com/library/openssl-cookbook/online/ch-openssl.html) to see if I did any special wrong. First thought, do I have to use .csr to sign a certificate, or can I do this using any other format too?

推荐答案

您正在使用openssl ca"工具，该工具默认使用以下配置文件:/etc/ssl/openssl.cnf.换句话说，您没有尝试使用 CA 证书进行签名，而是使用该配置文件中的默认值.您还将 -x509 参数传递给导致无效 csr 的客户端证书签名请求.

You are using 'openssl ca' tool which uses the following configuration file by default: /etc/ssl/openssl.cnf. In other words you were not trying to sign with your CA certificate but using default values from that config file. You were also passing -x509 parameter to the client certificate signing request which lead to an invalid csr.

请在下面找到工作生成和签名命令.

Please, find below the working generation and signing commands.

生成 CA 密钥和证书:

Generate CA key and cert:

openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -key rootCA.key -days 3650 -out rootCA.pem 
-subj '/C=AA/ST=AA/L=AA/O=AA Ltd/OU=AA/CN=AA/emailAddress=[e-mail]'

生成客户端密钥和 csr:

Generate client key and csr:

openssl genrsa -out client1.key 2048
openssl req -new -key client1.key -out client1.csr 
-subj '/C=BB/ST=BB/L=BB/O=BB Ltd/OU=BB/CN=BB/emailAddress=[e-mail]'

生成使用 CA 证书签名的客户端证书:

Generate client cert signed with CA cert:

openssl x509 -req -days 365 -CA rootCA.pem -CAkey rootCA.key 
-CAcreateserial -CAserial serial -in client1.csr -out client1.pem

当然，您可以将配置文件设置为使用正确的 CA 文件，然后使用openssl ca"工具.

Of course you can set your config file to use right CA files and use the 'openssl ca' tool after that.

您可以像这样验证您的证书:

You can verify your certificate like this:

openssl verify -verbose -CAfile rootCA.pem client1.pem

这篇关于openSSL 使用 CA 签署 https_client 证书的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！