@mrz1 2018-01-07T09:08:23.000000Z 字数 14314 阅读 4489

利用openssl命令搭建私有CA管理证书

工具

1、创建所需要的文件

touch /etc/pki/CA/index.txt 生成证书索引数据库文件
echo 01 > /etc/pki/CA/serial 指定第一个颁发证书的序列号

2、CA自签证书

[root@centos7 ~]#cd /etc/pki/CA/

[root@centos7 CA]#(umask066; openssl genrsa -out /etc/pki/CA/private/cakey.pem -des3 2048) //生成私钥
bash: umask066: command not found...
Generating RSA private key, 2048 bit long modulus
..................+++
..+++
e is 65537 (0x10001)
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Verifying - Enter pass phrase for /etc/pki/CA/private/cakey.pem:

[root@centos7 CA]#tree
.
├── certs
├── crl
├── newcerts
└── private
    └── cakey.pem
4 directories, 1 file

[root@centos7 CA]#openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days  7300 -out cacert.pem //生成自签名证书
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:magedu
Organizational Unit Name (eg, section) []:opt
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:1353250703@qq.com

-new: 生成新证书签署请求
-x509: 专用于CA生成自签证书
-key: 生成请求时用到的私钥文件
-days n：证书的有效期限
-out /PATH/TO/SOMECERTFILE: 证书的保存路径

[root@centos7 CA]#cat cacert.pem //查看文件
-----BEGIN CERTIFICATE-----
MIID6TCCAtGgAwIBAgIJAIltKDHnCEbmMA0GCSqGSIb3DQEBCwUAMIGKMQswCQYD
VQQGEwJDTjEQMA4GA1UECAwHQmVpamluZzEQMA4GA1UEBwwHQmVpamluZzEPMA0G
A1UECgwGbWFnZWR1MQwwCgYDVQQLDANvcHQxFjAUBgNVBAMMDWNhLm1hZ2VkdS5j
b20xIDAeBgkqhkiG9w0BCQEWETEzNTMyNTA3MDNAcXEuY29tMB4XDTE4MDEwNzA3
NDUwOFoXDTM4MDEwMjA3NDUwOFowgYoxCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdC
ZWlqaW5nMRAwDgYDVQQHDAdCZWlqaW5nMQ8wDQYDVQQKDAZtYWdlZHUxDDAKBgNV
BAsMA29wdDEWMBQGA1UEAwwNY2EubWFnZWR1LmNvbTEgMB4GCSqGSIb3DQEJARYR
MTM1MzI1MDcwM0BxcS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCyR4IORcFzC3eHsKHXIo7FlywAPTZY80BWVwSM7jdTpSlNCvDGb6wjjKS0YY4w
dyAxflfdtGopfxJyvjqjB1auVSgBe24raUjhgZL/bBMkQ255CPv/e9isKVn8FD+v
mGYVf3e1wlxSKoqKwqsO/7JvZk8Wt2cG12Rvh3AisD0AKPc9TOMbsn5yEcriekh3
W7aO5PtkZVe+V3YSjUix+FWzYiDJ2RRmY+w51PSt1cb6Vk7891VJ2NMch4q/sNy0
TUCd0t4xE/E0JXx8rpZoffEsDYK0QHb9o5GoNUMSYHfGR271krtf01l6+4Gj0QDZ
rjA8MBbkDwgkXMS2uvKxnO9HAgMBAAGjUDBOMB0GA1UdDgQWBBT9ZGVRTE5llYJD
PB3+CMHAw3J+qzAfBgNVHSMEGDAWgBT9ZGVRTE5llYJDPB3+CMHAw3J+qzAMBgNV
HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQADUogD0Em7e9OtcZEKl3N5N7bL
JPzqT6RRpN0ToCTPunD7vCPaVpI0b8KOhvMTNLoM432r+kPzf9l+GAln7DPeZprP
k1kCW7tQQMCTSEf6SVnQ5r5BhSmB+nwEjQ4hiBrAzOH+3+uwYHiY0jI6EajgC03J
g+Kd6rYHIC3uDNNh8lI2SoQUh244CdS/aRfWDIjDoEMpzjO94YU1EOWadmKUWvY3
bh0zpwO076cvnZ43XKXpscNpktmLKxgQDrodn8MxHBMyOxX2Qx/SoCrLzfJPWtrn
/BmcRkX5GlUR0LV1vUcOKgczr3ka/sY6OizGxOGJy4NmW3T/kJPsHbU9o7pP
-----END CERTIFICATE-----

[root@centos7 CA]#openssl x509 -in cacert.pem -noout -text //文本查看证书
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            89:6d:28:31:e7:08:46:e6
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Beijing, L=Beijing, O=magedu, OU=opt, CN=ca.magedu.com/emailAddress=1353250703@qq.com
        Validity
            Not Before: Jan  7 07:45:08 2018 GMT
            Not After : Jan  2 07:45:08 2038 GMT
        Subject: C=CN, ST=Beijing, L=Beijing, O=magedu, OU=opt, CN=ca.magedu.com/emailAddress=1353250703@qq.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b2:47:82:0e:45:c1:73:0b:77:87:b0:a1:d7:22:
                    8e:c5:97:2c:00:3d:36:58:f3:40:56:57:04:8c:ee:
                    37:53:a5:29:4d:0a:f0:c6:6f:ac:23:8c:a4:b4:61:
                    8e:30:77:20:31:7e:57:dd:b4:6a:29:7f:12:72:be:
                    3a:a3:07:56:ae:55:28:01:7b:6e:2b:69:48:e1:81:
                    92:ff:6c:13:24:43:6e:79:08:fb:ff:7b:d8:ac:29:
                    59:fc:14:3f:af:98:66:15:7f:77:b5:c2:5c:52:2a:
                    8a:8a:c2:ab:0e:ff:b2:6f:66:4f:16:b7:67:06:d7:
                    64:6f:87:70:22:b0:3d:00:28:f7:3d:4c:e3:1b:b2:
                    7e:72:11:ca:e2:7a:48:77:5b:b6:8e:e4:fb:64:65:
                    57:be:57:76:12:8d:48:b1:f8:55:b3:62:20:c9:d9:
                    14:66:63:ec:39:d4:f4:ad:d5:c6:fa:56:4e:fc:f7:
                    55:49:d8:d3:1c:87:8a:bf:b0:dc:b4:4d:40:9d:d2:
                    de:31:13:f1:34:25:7c:7c:ae:96:68:7d:f1:2c:0d:
                    82:b4:40:76:fd:a3:91:a8:35:43:12:60:77:c6:47:
                    6e:f5:92:bb:5f:d3:59:7a:fb:81:a3:d1:00:d9:ae:
                    30:3c:30:16:e4:0f:08:24:5c:c4:b6:ba:f2:b1:9c:
                    ef:47
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                FD:64:65:51:4C:4E:65:95:82:43:3C:1D:FE:08:C1:C0:C3:72:7E:AB
            X509v3 Authority Key Identifier: 
                keyid:FD:64:65:51:4C:4E:65:95:82:43:3C:1D:FE:08:C1:C0:C3:72:7E:AB
            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         03:52:88:03:d0:49:bb:7b:d3:ad:71:91:0a:97:73:79:37:b6:
         cb:24:fc:ea:4f:a4:51:a4:dd:13:a0:24:cf:ba:70:fb:bc:23:
         da:56:92:34:6f:c2:8e:86:f3:13:34:ba:0c:e3:7d:ab:fa:43:
         f3:7f:d9:7e:18:09:67:ec:33:de:66:9a:cf:93:59:02:5b:bb:
         50:40:c0:93:48:47:fa:49:59:d0:e6:be:41:85:29:81:fa:7c:
         04:8d:0e:21:88:1a:c0:cc:e1:fe:df:eb:b0:60:78:98:d2:32:
         3a:11:a8:e0:0b:4d:c9:83:e2:9d:ea:b6:07:20:2d:ee:0c:d3:
         61:f2:52:36:4a:84:14:87:6e:38:09:d4:bf:69:17:d6:0c:88:
         c3:a0:43:29:ce:33:bd:e1:85:35:10:e5:9a:76:62:94:5a:f6:
         37:6e:1d:33:a7:03:b4:ef:a7:2f:9d:9e:37:5c:a5:e9:b1:c3:
         69:92:d9:8b:2b:18:10:0e:ba:1d:9f:c3:31:1c:13:32:3b:15:
         f6:43:1f:d2:a0:2a:cb:cd:f2:4f:5a:da:e7:fc:19:9c:46:45:
         f9:1a:55:11:d0:b5:75:bd:47:0e:2a:07:33:af:79:1a:fe:c6:
         3a:3a:2c:c6:c4:e1:89:cb:83:66:5b:74:ff:90:93:ec:1d:b5:
         3d:a3:ba:4f

[root@centos7 CA]#openssl x509 -in cacert.pem -noout -subject
subject= /C=CN/ST=Beijing/L=Beijing/O=magedu/OU=opt/CN=ca.magedu.com/emailAddress=1353250703@qq.com
[root@centos7 CA]#openssl x509 -in cacert.pem -noout -dates //文本查看时间
notBefore=Jan  7 07:45:08 2018 GMT
notAfter=Jan  2 07:45:08 2038 GMT

3、颁发证书

在需要使用证书的主机生成证书请求并生成私钥

[root@centos6 app]#(umask 066;openssl genrsa -out app.key 1024)
Generating RSA private key, 1024 bit long modulus
..++++++
.......................++++++
e is 65537 (0x10001)
You have new mail in /var/spool/mail/root

生成证书申请文件

[root@centos6 app]#openssl req -new -key app.key -days 365 -out app.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:magedu
Organizational Unit Name (eg, section) []:web
Common Name (eg, your name or your server's hostname) []:*.ifeier.tech
Email Address []:1353250703@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

将证书请求文件传输给CA
CA签署证书，并将证书颁发给请求者

注意：默认国家，省，公司名称三项必须和CA一致

[root@centos7 CA]#openssl ca -in app.csr -out certs/app.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jan  7 08:19:28 2018 GMT
            Not After : Jan  7 08:19:28 2019 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Beijing
            organizationName          = magedu
            organizationalUnitName    = web
            commonName                = *.ifeier.tech
            emailAddress              = 1353250703@qq.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                AE:97:38:A0:F1:8A:B1:47:F6:18:21:2C:5A:B7:D9:72:8A:EA:CC:22
            X509v3 Authority Key Identifier: 
                keyid:FD:64:65:51:4C:4E:65:95:82:43:3C:1D:FE:08:C1:C0:C3:72:7E:AB
Certificate is to be certified until Jan  7 08:19:28 2019 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@centos7 CA]#cat index.txt //记录在案
V       190107081928Z           01      unknown /C=CN/ST=Beijing/O=magedu/OU=web/CN=*.ifeier.tech/emailAddress=1353250703@qq.com
[root@centos7 CA]#cat serial //证书编号
02
[root@centos7 CA]#tree
.
├── app.csr
├── cacert.pem
├── certs
│   └── app.crt
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│   └── 01.pem
├── private
│   └── cakey.pem
├── serial
└── serial.old
4 directories, 10 files
[root@centos7 CA]#diff newcerts/01.pem certs/app.crt -s //比较这两个文件
Files newcerts/01.pem and certs/app.crt are identical
[root@centos7 CA]#ll newcerts/01.pem certs/app.crt -s   //比较这两个文件
4 -rw-r--r-- 1 root root 3861 Jan  7 16:19 certs/app.crt
4 -rw-r--r-- 1 root root 3861 Jan  7 16:19 newcerts/01.pem

之后把申请之后的文件发给申请的人

[root@centos7 CA]#scp certs/app.crt 172.18.101.93:/app
The authenticity of host '172.18.101.93 (172.18.101.93)' can't be established.
RSA key fingerprint is SHA256:2cqUUYDNyWgJnskm7U33xF66s7E0wxByhOkt7OYiOiA.
RSA key fingerprint is MD5:75:54:cf:f5:09:41:35:17:c2:00:a1:84:c3:48:10:8e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.18.101.93' (RSA) to the list of known hosts.
root@172.18.101.93's password: 
app.crt                                                     100% 3861     1.9MB/s   00:00

4、吊销证书

[root@centos7 CA]#cat index.txt.old  //找到对应的编号
V       190107081928Z           01      unknown /C=CN/ST=Beijing/O=magedu/OU=web/CN=*.ifeier.tech/emailAddress=1353250703@qq.com
[root@centos7 CA]#tree
.
├── app2.csr
├── app.csr
├── cacert.pem
├── certs
│   ├── app2_2.crt
│   ├── app2.crt
│   └── app.crt
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── newcerts
│   ├── 01.pem
│   └── 02.pem
├── private
│   └── cakey.pem
├── serial
└── serial.old
4 directories, 15 files

吊销成功

[root@centos7 CA]#openssl ca -revoke newcerts/02.pem  
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Revoking Certificate 02.
Data Base Updated
[root@centos7 CA]#cat index.txt
V       190107081928Z           01      unknown /C=CN/ST=Beijing/O=magedu/OU=web/CN=*.ifeier.tech/emailAddress=1353250703@qq.com
R(R表示吊销了)       190107084106Z   180107085540Z   02      unknown /C=CN/ST=Beijing/O=magedu/OU=web/CN=*.ifeier.tech/emailAddress=1353250703@qq.com

吊销证书的编号

注意：第一次更新证书吊销列表前，才需要执行

[root@centos7 CA]#openssl ca -gencrl -out cal.pem //更新证书吊销列表
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
[root@centos7 CA]#cat cal.pem 
-----BEGIN X509 CRL-----
MIIB+jCB4wIBATANBgkqhkiG9w0BAQsFADCBijELMAkGA1UEBhMCQ04xEDAOBgNV
BAgMB0JlaWppbmcxEDAOBgNVBAcMB0JlaWppbmcxDzANBgNVBAoMBm1hZ2VkdTEM
MAoGA1UECwwDb3B0MRYwFAYDVQQDDA1jYS5tYWdlZHUuY29tMSAwHgYJKoZIhvcN
AQkBFhExMzUzMjUwNzAzQHFxLmNvbRcNMTgwMTA3MDkwMDI3WhcNMTgwMjA2MDkw
MDI3WjAUMBICAQIXDTE4MDEwNzA4NTU0MFqgDjAMMAoGA1UdFAQDAgEBMA0GCSqG
SIb3DQEBCwUAA4IBAQBLXorc8bwR18Kwyd6OuPTcmhXzRxk603BPf2/noVNwVfs4
wyIaF31XQprCvA2aMQjgcRmU+V9bTlgpzdUurxwbMkDw/EniWqULgaELEjKitHDr
aas8yvc0c4VvHt9w6BTDa/p9Duct+7hQxEjI7E/01fVHJQlMQjflfNpoduG+XrNu
y8tLlCmgMSaUmsecmimtP5diodQEMfixYZZb34LwDGSKKSU9mB+gobO+OmQJtl4W
oEFhXO0lrXlUkblLyD2oIergU0unOrJ9+TGopg9fPqkI8zhppLAetCP1YlQgPUka
WQrXcT0FvVcU8VFxB1D04TTTCPCEwXOkYKUN/SzV
-----END X509 CRL-----
[root@centos7 CA]#cat crlnumber //编号
02
[root@centos7 CA]#openssl crl -in cal.pem -noout -text  //详细查看   
Certificate Revocation List (CRL):
        Version 2 (0x1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: /C=CN/ST=Beijing/L=Beijing/O=magedu/OU=opt/CN=ca.magedu.com/emailAddress=1353250703@qq.com
        Last Update: Jan  7 09:00:27 2018 GMT
        Next Update: Feb  6 09:00:27 2018 GMT
        CRL extensions:
            X509v3 CRL Number: 
                1
Revoked Certificates:
    Serial Number: 02
        Revocation Date: Jan  7 08:55:40 2018 GMT
    Signature Algorithm: sha256WithRSAEncryption
         4b:5e:8a:dc:f1:bc:11:d7:c2:b0:c9:de:8e:b8:f4:dc:9a:15:
         f3:47:19:3a:d3:70:4f:7f:6f:e7:a1:53:70:55:fb:38:c3:22:
         1a:17:7d:57:42:9a:c2:bc:0d:9a:31:08:e0:71:19:94:f9:5f:
         5b:4e:58:29:cd:d5:2e:af:1c:1b:32:40:f0:fc:49:e2:5a:a5:
         0b:81:a1:0b:12:32:a2:b4:70:eb:69:ab:3c:ca:f7:34:73:85:
         6f:1e:df:70:e8:14:c3:6b:fa:7d:0e:e7:2d:fb:b8:50:c4:48:
         c8:ec:4f:f4:d5:f5:47:25:09:4c:42:37:e5:7c:da:68:76:e1:
         be:5e:b3:6e:cb:cb:4b:94:29:a0:31:26:94:9a:c7:9c:9a:29:
         ad:3f:97:62:a1:d4:04:31:f8:b1:61:96:5b:df:82:f0:0c:64:
         8a:29:25:3d:98:1f:a0:a1:b3:be:3a:64:09:b6:5e:16:a0:41:
         61:5c:ed:25:ad:79:54:91:b9:4b:c8:3d:a8:21:ea:e0:53:4b:
         a7:3a:b2:7d:f9:31:a8:a6:0f:5f:3e:a9:08:f3:38:69:a4:b0:
         1e:b4:23:f5:62:54:20:3d:49:1a:59:0a:d7:71:3d:05:bd:57:
         14:f1:51:71:07:50:f4:e1:34:d3:08:f0:84:c1:73:a4:60:a5:
         0d:fd:2c:d5

这就是全部过程，把证书发送到windows里面会看的很清楚！

问题

给已经颁发证书的人再次颁发证书,解决出现问题

[root@centos7 CA]#openssl ca -in app.csr -out certs/app2.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Jan  7 08:37:56 2018 GMT
            Not After : Jan  7 08:37:56 2019 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Beijing
            organizationName          = magedu
            organizationalUnitName    = web
            commonName                = *.ifeier.tech
            emailAddress              = 1353250703@qq.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                AE:97:38:A0:F1:8A:B1:47:F6:18:21:2C:5A:B7:D9:72:8A:EA:CC:22
            X509v3 Authority Key Identifier: 
                keyid:FD:64:65:51:4C:4E:65:95:82:43:3C:1D:FE:08:C1:C0:C3:72:7E:AB
Certificate is to be certified until Jan  7 08:37:56 2019 GMT (365 days)
Sign the certificate? [y/n]:y
failed to update database //更新数据库失败
TXT_DB error number 2

解决

[root@centos7 CA]#cat index.txt.attr //修改这个文件 把yes改为no
unique_subject = yes

成功

[root@centos7 CA]#cat index.txt //两条记录
V       190107081928Z           01      unknown /C=CN/ST=Beijing/O=magedu/OU=web/CN=*.ifeier.tech/emailAddress=1353250703@qq.com
V       190107084106Z           02      unknown /C=CN/ST=Beijing/O=magedu/OU=web/CN=*.ifeier.tech/emailAddress=1353250703@qq.com
[root@centos7 CA]#cat serial //编号
03
[root@centos7 CA]#tree
.
├── app.csr
├── cacert.pem
├── certs
│   ├── app2.crt
│   └── app.crt
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── newcerts
│   ├── 01.pem
│   └── 02.pem
├── private
│   └── cakey.pem
├── serial
└── serial.old
4 directories, 13 files

默认国家，省，公司名称三项有错误的话。

[root@centos6 app]#openssl req -new -key app.key -days 365 -out app2.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HeBei
Locality Name (eg, city) [Default City]:Shijiazhuang
Organization Name (eg, company) [Default Company Ltd]:linux
Organizational Unit Name (eg, section) []:dev
Common Name (eg, your name or your server's hostname) []:www.linux.org
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
You have new mail in /var/spool/mail/root

发送给CA申请证书

[root@centos6 app]#scp app2.csr 172.18.101.118:/etc/pki/CA/
root@172.18.101.118's password: 
app2.csr                                                    100%  655     0.6KB/s   00:00

出现错误

[root@centos7 CA]#openssl ca -in app2.csr -out certs/app2_2.crt 
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
The stateOrProvinceName field needed to be the same in the
CA certificate (Beijing) and the request (HeBei) //不匹配

这是只能修改配置文件

[root@centos7 CA]#vim /etc/pki/tls/openssl.cnf 
# For the CA policy
# and supplied fields are just that :-)                                    
policy          = policy_match //找到这一行改为 policy_anything

完成

利用openssl命令搭建私有CA管理证书

1、创建所需要的文件

2、CA自签证书

3、颁发证书

4、吊销证书

问题

给已经颁发证书的人再次颁发证书,解决出现问题

默认国家，省，公司名称三项有错误的话。

内容目录