layout: post
title: 搭建私有CA
date: 2018-01-08
tags: [“Linux”,”信息和数据安全”]
一、实验目的
搭建私有CA并使其可以实现公司内部的的签名服务。
二、实验环境：
系统架构：Centos7（服务器）、Centos6（需要申请证书的服务器）
需要的软件包：openssl、openssl-libs、libssl
三、配置文件解析
搭建CA需要/etc/pki/tls/openssl.cnf文件，该配置文件 由openssl-libs生成
该配置文件中我们主要关注一下这些选项，我只列出了需要关注的，源配置文件不关注的不要修改
- [ ca ]
- default_ca = CA_default 这里代表默认的ca 策略
- [ CA_default ]
- dir = /etc/pki/CA 定义CA的目录
- certs = $dir/certs 定义证书的存放位置$dir表示上一个选项dir，之后的也是同样的意思
- crl_dir = $dir/crl 定义吊销证书的目录
- database = $dir/index.txt 证书数据库文件，注意：默认这个文件是不存在的需要手动创建，如果不创建，在签名证书时会报错
- new_certs_dir = $dir/newcerts 新证书的存放位置，每次签发证书之后都会在这个目录和$dir/certs目录生成同样的证书，但是这里是以编号命名的
- certificate = $dir/cacert.pem 自签或上级颁发的证书存放位置，注意：这里是自己的证书
- serial = $dir/serial 存放证书编号的位置，注意：默认这个文件不存在，需要手动创建，且需要初始化一个16进制的序号，我们一般都使用00作为初始化的默认值
- crlnumber = $dir/crlnumber 存放吊销证书编号的目录，注意是编号
- crl = $dir/crl.pem 吊销的证书
- private_key = $dir/private/cakey.pem自己的私有秘钥
- RANDFILE = $dir/private/.rand 自己的随机数文件，这个默认不需要改
- x509_extensions = usr_cert # The extentions to add to the cert
- default_days = 365 # 默认的证书有效期
- default_crl_days= 30 # 默认多少天发布一次crl（吊销）
- default_md = sha256 # 使用默认的单项加密算法
- policy = policy_match # 策略，这里是一个映射，映射的是"[ policy_match ]"
- [ policy_match ] #默认的申请ca的策略
- countryName = match #国家
- stateOrProvinceName = match #州或省
- organizationName = match #组织名称
- organizationalUnitName = optional #组织的名称
- commonName = supplied #域名
- emailAddress = optional #电子邮件
- [ policy_anything ] #默认的申请ca的策略
- countryName = optional
- stateOrProvinceName = optional
- localityName = optional
- organizationName = optional
- organizationalUnitName = optional
- commonName = supplied
- emailAddress = optional
- 如果要更换policy的策略，可以自己写，也可以借助默认的修改一下即可
四、修改openssl.cnf文件
一般私有CA都是用在公司内部的，作为自己公司的证书服务器，所以policy我们使用系统默认的策略”policy_match”，即countryName、stateOrProvinceName 、organizationName 都是完全匹配的，因为，我们不需要为其他公司授权，所以权限放小一点。
default_days 我们修改证书有效期为20年 ： default_days = 7300
五、配置私有CA
配置CA的步骤如下：
1、生成自己的私钥文件
2、生成自签名证书
1、搭建CA
- [root@newhostname tls]# (umask 066;openssl genrsa -out /etc/pki/CA/private/cakey.pem)
- Generating RSA private key, 2048 bit long modulus
- .................................................+++
- .........................................................+++
- e is 65537 (0x10001)
- 生成自己的私钥文件，注意：私钥文件必须保存在与配置文件标注的位置，且文件名必须相同
- [root@newhostname tls]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/certs/cacert.pem -days 7300
- You are about to be asked to enter information that will be incorporated
- into your certificate request.
- What you are about to enter is what is called a Distinguished Name or a DN.
- There are quite a few fields but you can leave some blank
- For some fields there will be a default value,
- If you enter '.', the field will be left blank.
- -----
- Country Name (2 letter code) [XX]:zh
- State or Province Name (full name) []:beijing
- Locality Name (eg, city) [Default City]:beijing
- Organization Name (eg, company) [Default Company Ltd]:xedj
- Organizational Unit Name (eg, section) []:xedj
- Common Name (eg, your name or your server's hostname) []:*.xedj.com
- Email Address []:
- req 表示请求，详细参数可以通过man req来查看；
- -new表示生成一个新的证书
- -key 指定加密要使用的私钥文件
- -x509表示自签名
- -days 表示证书的有效期，因为改过配置文件，所以不加这项默认也是20年
- 注意，输出位置必须是配置文件指定的位置指定的名字，否则后面会报错
2、现在我们查看一下我们生成的证书
- [root@newhostname certs]# cat /etc/pki/CA/certs/cacert.pem
- -----BEGIN CERTIFICATE-----
- MIIDmzCCAoOgAwIBAgIJAKz4AXj1nsaNMA0GCSqGSIb3DQEBCwUAMGQxCzAJBgNV
- BAYTAnpoMRAwDgYDVQQIDAdiZWlqaW5nMRAwDgYDVQQHDAdiZWlqaW5nMQ0wCwYD
- VQQKDAR4ZWRqMQ0wCwYDVQQLDAR4ZWRqMRMwEQYDVQQDDAoqLnhlZGouY29tMB4X
- DTE4MDEwODEyMzUxOVoXDTM4MDEwMzEyMzUxOVowZDELMAkGA1UEBhMCemgxEDAO
- BgNVBAgMB2JlaWppbmcxEDAOBgNVBAcMB2JlaWppbmcxDTALBgNVBAoMBHhlZGox
- DTALBgNVBAsMBHhlZGoxEzARBgNVBAMMCioueGVkai5jb20wggEiMA0GCSqGSIb3
- DQEBAQUAA4IBDwAwggEKAoIBAQC9UvPlmX1dWlzLlta/IusSt9cf6ZniEkEatews
- WksSbdp8cBYYdFz8xLcqEZrlMtr/WkTHRWQ6rc5/9MhH2TM23Ybq3QVdA3i2XOiT
- IDMjjpkfcnjHXgOpTXwfvWFaduMGvEByPK4Yy1jd+cW58YUxopmPh9EtPBjhzwpe
- fERJR0V2bjfHCsH6Zh76V8n1WwuqTuFNIqAHp8BFJ+5LLXWsJ6PUunOaZKSTGquj
- 3bMWUmawuYW9eoiUy3U7XMhCk2f9daE1gjsn0NitWpQ9BpyUn7Ak8RxBI77qP7uZ
- 3S2opGX8aui8XjkOJohX/3zU8PV01ZsigLC5Az7OG33je52PAgMBAAGjUDBOMB0G
- A1UdDgQWBBQxykBPVHt2bAHf8TnHisovok3AnTAfBgNVHSMEGDAWgBQxykBPVHt2
- bAHf8TnHisovok3AnTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCu
- rrCIVm2wJI3+shCC+V2Q3mVy0iGsi1gXPMsCK0ruAPM6Q0+QnkhB9Eh1ko57mJrA
- 68rR7RO6xtGfY69ItSHwmwsfSYOAMSZ1PLjJK5s0OVPRv+umZ0dXLhQIPCS2Rkow
- vb6D8xOQU6oe3/Z37AWMag/r4QNhmiZpYO/NrEjgFFTfyYyE0LeMHyVi57+M+bBa
- cmhHN/DiCVL4Whu9Q+FhE5Z37BCm7m8jez48ktiu8daP34MuDZ0SJHAPG/BtEBE/
- wZYyLcCzi2w1v7SIKYradZYNo/5v4LZ2GEi/Mqmqik9hpml4ShBf7d9VzeNylJHM
- /uqph3aD3egMJWuYGOsb
- -----END CERTIFICATE-----
- [root@newhostname certs]#
- 证书经过私钥加过密，什么都看不出来，必须通过一下方式来查看
- [root@newhostname certs]# openssl x509 -in /etc/pki/CA/certs/cacert.pem -noout -text
- Certificate:
- Data:
- Version: 3 (0x2)
- Serial Number:
- ac:f8:01:78:f5:9e:c6:8d
- Signature Algorithm: sha256WithRSAEncryption
- Issuer: C=zh, ST=beijing, L=beijing, O=xedj, OU=xedj, CN=*.xedj.com
- Validity
- Not Before: Jan 8 12:35:19 2018 GMT
- Not After : Jan 3 12:35:19 2038 GMT
- Subject: C=zh, ST=beijing, L=beijing, O=xedj, OU=xedj, CN=*.xedj.com
- Subject Public Key Info:
- Public Key Algorithm: rsaEncryption
- Public-Key: (2048 bit)
- Modulus:
- 00:bd:52:f3:e5:99:7d:5d:5a:5c:cb:96:d6:bf:22:
- eb:12:b7:d7:1f:e9:99:e2:12:41:1a:b5:ec:2c:5a:
- 4b:12:6d:da:7c:70:16:18:74:5c:fc:c4:b7:2a:11:
- 9a:e5:32:da:ff:5a:44:c7:45:64:3a:ad:ce:7f:f4:
- c8:47:d9:33:36:dd:86:ea:dd:05:5d:03:78:b6:5c:
- e8:93:20:33:23:8e:99:1f:72:78:c7:5e:03:a9:4d:
- 7c:1f:bd:61:5a:76:e3:06:bc:40:72:3c:ae:18:cb:
- 58:dd:f9:c5:b9:f1:85:31:a2:99:8f:87:d1:2d:3c:
- 18:e1:cf:0a:5e:7c:44:49:47:45:76:6e:37:c7:0a:
- c1:fa:66:1e:fa:57:c9:f5:5b:0b:aa:4e:e1:4d:22:
- a0:07:a7:c0:45:27:ee:4b:2d:75:ac:27:a3:d4:ba:
- 73:9a:64:a4:93:1a:ab:a3:dd:b3:16:52:66:b0:b9:
- 85:bd:7a:88:94:cb:75:3b:5c:c8:42:93:67:fd:75:
- a1:35:82:3b:27:d0:d8:ad:5a:94:3d:06:9c:94:9f:
- b0:24:f1:1c:41:23:be:ea:3f:bb:99:dd:2d:a8:a4:
- 65:fc:6a:e8:bc:5e:39:0e:26:88:57:ff:7c:d4:f0:
- f5:74:d5:9b:22:80:b0:b9:03:3e:ce:1b:7d:e3:7b:
- 9d:8f
- Exponent: 65537 (0x10001)
- X509v3 extensions:
- X509v3 Subject Key Identifier:
- 31:CA:40:4F:54:7B:76:6C:01:DF:F1:39:C7:8A:CA:2F:A2:4D:C0:9D
- X509v3 Authority Key Identifier:
- keyid:31:CA:40:4F:54:7B:76:6C:01:DF:F1:39:C7:8A:CA:2F:A2:4D:C0:9D
- X509v3 Basic Constraints:
- CA:TRUE
- Signature Algorithm: sha256WithRSAEncryption
- ae:ae:b0:88:56:6d:b0:24:8d:fe:b2:10:82:f9:5d:90:de:65:
- 72:d2:21:ac:8b:58:17:3c:cb:02:2b:4a:ee:00:f3:3a:43:4f:
- 90:9e:48:41:f4:48:75:92:8e:7b:98:9a:c0:eb:ca:d1:ed:13:
- ba:c6:d1:9f:63:af:48:b5:21:f0:9b:0b:1f:49:83:80:31:26:
- 75:3c:b8:c9:2b:9b:34:39:53:d1:bf:eb:a6:67:47:57:2e:14:
- 08:3c:24:b6:46:4a:30:bd:be:83:f3:13:90:53:aa:1e:df:f6:
- 77:ec:05:8c:6a:0f:eb:e1:03:61:9a:26:69:60:ef:cd:ac:48:
- e0:14:54:df:c9:8c:84:d0:b7:8c:1f:25:62:e7:bf:8c:f9:b0:
- 5a:72:68:47:37:f0:e2:09:52:f8:5a:1b:bd:43:e1:61:13:96:
- 77:ec:10:a6:ee:6f:23:7b:3e:3c:92:d8:ae:f1:d6:8f:df:83:
- 2e:0d:9d:12:24:70:0f:1b:f0:6d:10:11:3f:c1:96:32:2d:c0:
- b3:8b:6c:35:bf:b4:88:29:8a:da:75:96:0d:a3:fe:6f:e0:b6:
- 76:18:48:bf:32:a9:aa:8a:4f:61:a6:69:78:4a:10:5f:ed:df:
- 55:cd:e3:72:94:91:cc:fe:ea:a9:87:76:83:dd:e8:0c:25:6b:
- 98:18:eb:1b
- [root@newhostname certs]#
- x509是用来表示证书显示和签署实用程序
- -noout用来消除编码的版本
- -text使用它text的格式打印输出
- 通过上面的命令就可以查看我们刚才输入的证书的各种信息
### 六、其他人通过搭建的私有CA申请证书 执行步骤： 1、预申请服务器生成自己的私钥 2、生成证书请求文件 3、将请求文件发送给私有CA 4、CA签名并返还生成的证书给请求者
- [root@newhostname certs]# echo 01 >/etc/pki/CA/serial
- [root@newhostname certs]# touch /etc/pki/CA/index.txt
- 前面第三节有注释这这个文件是做什么的，这里不再赘述
- [root@joker-6-01 ~]# (umask 066;openssl genrsa -out /etc/pki/CA/private/zhang.pem 2048)
- -bash: umaks: command not found
- Generating RSA private key, 2048 bit long modulus
- ........................................................+++
- ......................+++
- e is 65537 (0x10001)
- 生成私钥文件
- [root@joker-6-01 ~]# openssl req -new -key /etc/pki/CA/private/zhang.pem -out /etc/pki/CA/certs/zhang.csr
- You are about to be asked to enter information that will be incorporated
- into your certificate request.
- What you are about to enter is what is called a Distinguished Name or a DN.
- There are quite a few fields but you can leave some blank
- For some fields there will be a default value,
- If you enter '.', the field will be left blank.
- -----
- Country Name (2 letter code) [XX]:zh
- State or Province Name (full name) []:beijing
- Locality Name (eg, city) [Default City]:beijing
- Organization Name (eg, company) [Default Company Ltd]:xedj
- Organizational Unit Name (eg, section) []:xedj
- Common Name (eg, your name or your server's hostname) []*.xedj.com ^ Email Address []:
- Please enter the following 'extra' attributes
- to be sent with your certificate request
- A challenge password []:
- An optional company name []:
- 生成证书请求文件
- 现在我们查看一下这个请求文件
- [root@joker-6-01 ~]# cat /etc/pki/CA/certs/zhang.csr
- -----BEGIN CERTIFICATE REQUEST-----
- MIICqTCCAZECAQAwZDELMAkGA1UEBhMCemgxEDAOBgNVBAgMB2JlaWppbmcxEDAO
- BgNVBAcMB2JlaWppbmcxDTALBgNVBAoMBHhlZGoxDTALBgNVBAsMBHhlZGoxEzAR
- BgNVBAMMCioueGVkai5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
- AQD4IWgr62LGdkRHcCaxlhKCWlRrOfWXkQPhd9VQCGHWNzU4xcTZNGWXtDqhUOFu
- E5rc1wteyoUbiDRU8aKgCCKS61ZBInCnwsF3y/YVLGsbaz9z9GqVW7EJoCkaPafu
- SUudy0OT6Vvq+rcXcUDIfdunsjO9+MqXvpetYpd09cXCsUvVhBn2LPPTj0T7+Nju
- BlgTYjkJzzPSUOoll1vupIuEAOREHkZG8lyPoYVKIzRB6g6HdM6xlNN9MkrxbMLo
- /FSJDh1DtyK8v6Z+hHJT7Da4AqQAloi1tYw713KGuVlnykMe7Kl3e28YmlExeeVX
- Ztw4DLLHMocsR40spWx2rWkfAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAQDi+
- GjO3dd+aLM6SqcPx5kSmGA3Ar7L1I2r6WC//+28PdirdBXA8iW+UwxmUHUc4T5Hh
- i2geQrn9PoHmesrmHS8eXseFnl6BzYLIpyD1wumkoiLZnMZycyPQ2MuFM0xyUGU6
- OOgvpYpj8PTRYn6kV4OS1Cq8qFQoi3lGHC7/ldLKVtRXAW72zsHC0DZjd+jFj0sD
- rJLHVYPQasn1P+3ePVvp1tGFSD89lEd5Lzv0p0OXsP50Ao2xzgbtSfuHVhmUxQXX
- 8aui7J/OZ4qawYqZXjaRX+xFlzogrpP69Wd+TtOpFk5X7i/goWmLv1bgWPIbMb+I
- OxDT165IbFdEe4layQ==
- -----END CERTIFICATE REQUEST-----
1总的来说生成证书请求文件与CA生成自签证书只差一个 -x509参数
下面将预申请服务器的请求文件发送到CA，用CA来签名
- [root@joker-6-01 security]# scp /etc/pki/CA/certs/zhang.csr 172.18.30.253:~
root@172.18.30.253’s password:
Permission denied, please try again.
root@172.18.30.253’s password:
zhang.csr 100% 1001 1.0KB/s 00:00我们这里只是做实验，就使用scp来传输文件了
在CA服务器上生成自签证书的时候，我把目录搞错了；自签证书必须和配置文件一致，放对位置，现在把证书移到正确位置
mv /etc/pki/CA/certs/cacert.pem /etc/pki/CA/下免在CA机器上做签名操作
[root@newhostname CA]# openssl ca -in ~/zhang.csr -out /etc/pki/CA/certs/zhang.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jan 8 15:48:14 2018 GMT
Not After : Jan 8 15:48:14 2019 GMT
Subject:
countryName = zh
stateOrProvinceName = beijing
organizationName = xedj
organizationalUnitName = xedj
commonName = *.xedj.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
FD:72:7A:F5:46:8C:69:C2:A2:74:3C:4C:0D:BF:6A:A1:84:70:C7:9F
X509v3 Authority Key Identifier:
keyid:31:CA:40:4F:54:7B:76:6C:01:DF:F1:39:C7:8A:CA:2F:A2:4D:C0:9DCertificate is to be certified until Jan 8 15:48:14 2019 GMT (365 days)
Sign the certificate? [y/n]:Y1 out of 1 certificate requests certified, commit? [y/n]Y
Write out database with 1 new entries
Data Base Updated签名成功，现在可以签过名的证书返回给原服务器
[root@newhostname certs]# scp /etc/pki/CA/certs/zhang.crt 172.18.30.254:/etc/pki/CA/certs/
root@172.18.30.254’s password:
zhang.crt 100% 4437 6.3MB/s 00:00
- 查看数据库和现在的编号
[root@newhostname CA]# cat serial
02
[root@newhostname CA]# cat index.txt
V 190108154814Z 01 unknown /C=zh/ST=beijing/O=xedj/OU=xedj/CN=*.xedj.com
[root@newhostname CA]# echo 01 > /etc/pki/CA/crlnumber 初始化吊销证书序号
七、吊销证书
步骤：
1、查看要吊销证书的编号，确保不会吊销错
2、进行吊销操作
- [root@newhostname CA]# cat index.txt
V 190108154814Z 01 unknown /C=zh/ST=beijing/O=xedj/OU=xedj/CN=*.xedj.com查看数据库文件
第三列是证书序号即生成时serial序号，第五列是证书的主题，吊销时要确保主题是我们钥吊销的证书主题[root@newhostname CA]# openssl ca -revoke /etc/pki/CA/newcerts/01.pem
Using configuration from /etc/pki/tls/openssl.cnf
Revoking Certificate 01.
Data Base Updated吊销完成
-revoke 后面为serial序号命名的pem文件（这个具体也是根据配置文件来做的）
- [root@newhostname CA]# openssl ca -gencrl -out /etc/pki/CA/crl.pem
Using configuration from /etc/pki/tls/openssl.cnf
、
更新证书吊销列表[root@newhostname CA]# openssl crl -in /etc/pki/CA/crl.pem -noout -text
查看以吊销的证书
八、操作总结
1、(umask 066;openssl genrsa -out /etc/pki/CA/private/cakey.pem) 创建ca私钥
2、openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/certs/cacert.pem -days 7300 生成CA的自签证书
3、openssl x509 -in /etc/pki/CA/certs/cacert.pem -noout -text 查看自签证书内容’
4、echo 01 >/etc/pki/CA/serial
touch /etc/pki/CA/index.txt 创建证书编号和数据库文件
5、(umaks 066;openssl genrsa -out /etc/pki/CA/private/zhang.pem 2048) 需要签名的服务器生成自己的私钥文件
6、openssl req -new -key /etc/pki/CA/private/zhang.pem -out /etc/pki/CA/certs/zhang.csr 通过私钥文件生成证书请求文件
7、openssl ca -in ~/zhang.csr -out /etc/pki/CA/certs/zhang.crt -days 365 将上一部生成的证书传送到CA服务器，并做签名操作
8、将做过签名证书返还给申请的服务器
9、cat index.txt 查看数据库文件
10、echo 01 > /etc/pki/CA/crlnumber 初始化吊销证书序号
11、openssl ca -revoke /etc/pki/CA/newcerts/01.pem 根据主题信息吊销需要吊销的证书’
12、openssl ca -gencrl -out /etc/pki/CA/crl.pem 更新吊销证书列表
13、openssl crl -in /etc/pki/CA/crl.pem -noout -text 查看吊销的证书
