OSWikiHK: 請協力 GPLv3 的中文翻譯工作。

產生一張 SSL 電子證書

OSWikiHK，自由中文開源知識庫

標準文章
作者:	Roy Chan
協力:	Anthony Wong
校對:	-
分享本文:	如要連結本文，強烈建議使用英文連結: http://wiki.linux.org.hk/w/Generate_SSL_Cert

基本流程

[编辑]

在 Debian 系統

[编辑]

使用 make-ssl-cert

由於 Etch (4.0) 版本未能提供慣用的 apache2-ssl-certificate 命令，因此若你的 Debian 版本是 Etch，你可以使用 make-ssl-cert 命令，該程式使用 debconf 界面進行操作。

先安裝 ssl-cert 套件，然後以 root 身份鍵入以下命令：

make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache-ssl/apache.pem

[编辑]

使用 apache2-ssl-certificate (Apache 2.x)

注意，本方法不適用於 Etch (4.0) 版本，只適用於 Sarge 或以前的版本。

先安裝 apache2-common 套件，然後以 root 身份鍵入命令：

apache2-ssl-certificate

操作過程如下：

creating selfsigned certificate
replace it with one signed by a certification authority (CA)

enter your ServerName at the Common Name prompt

If you want your certificate to expire after x days call this programm
with -days x
Generating a 1024 bit RSA private key
..............++++++
........................++++++
writing new private key to '/etc/apache2/ssl/apache.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Some-State]:HKSAR
Locality Name (eg, city) []:Hong Kong
Organization Name (eg, company; recommended) []:Example Ltd.
Organizational Unit Name (eg, section) []:Web Team
server name (eg. ssl.domain.tld; required!!!) []:www.example.net
Email Address []:info@example.net

[编辑]

使用 mod-ssl-makecert (Apache 1.3 + Mod_SSL)

先安裝 libapache-mod-ssl 套件，然後以 root 身份鍵入以下命令：

mod-ssl-makecert

操作過程如下，完畢後將會產生5個檔案：

What type of certificate do you want to create?

  1. dummy     (dummy self-signed Snake Oil cert)
  2. test      (test cert signed by Snake Oil CA)
  3. custom    (custom cert signed by own CA)
  4. existing  (existing cert)

Use  dummy     when you are a vendor package maintainer,
     test      when you are an admin but want to do tests only,
     custom    when you are an admin willing to run a real server
     existing  when you are an admin who upgrades a server.

Normally you would choose 2.

your choice: 3
Which algorithm should be used to generate required key(s)?

  1. RSA
  2. DSA

Normally you would choose 1.

your choice: 1
SSL Certificate Generation Utility (mkcert.sh)
Copyright (c) 1998-2000 Ralf S. Engelschall, All Rights Reserved.

Generating custom certificate signed by own CA [CUSTOM]
______________________________________________________________________

STEP 1: Generating RSA private key for CA (1024 bit) [ca.key]
2460226 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
...++++++
....................++++++
e is 65537 (0x10001)
______________________________________________________________________

STEP 2: Generating X.509 certificate signing request for CA [ca.csr]
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
1. Country Name             (2 letter code) [XY]:CN
2. State or Province Name   (full name)     [Snake Desert]:HKSAR
3. Locality Name            (eg, city)      [Snake Town]:Hong Kong
4. Organization Name        (eg, company)   [Snake Oil, Ltd]:Example Ltd.
5. Organizational Unit Name (eg, section)   [Certificate Authority]:
6. Common Name              (eg, CA name)   [Snake Oil CA]:Example CA
7. Email Address            (eg, name@FQDN) [ca@snakeoil.dom]:ca@example.net
8. Certificate Validity     (days)          [365]:
______________________________________________________________________

STEP 3: Generating X.509 certificate for CA signed by itself [ca.crt]
Certificate Version (1 or 3) [3]:
Signature ok
subject=/C=CN/ST=HKSAR/L=Hong Kong/O=Example Ltd./OU=Certificate Authority/CN=Example
CA/emailAddress=ca@example.net
Getting Private key
Verify: matching certificate & key modulus
Verify: matching certificate signature
/etc/apache/ssl.crt/ca.crt: /C=CN/ST=HKSAR/L=Hong Kong/O=Example Ltd./OU=Certificate Authority/CN=Example
CA/emailAddress=ca@example.net
error 18 at 0 depth lookup:self signed certificate
OK
______________________________________________________________________

STEP 4: Generating RSA private key for SERVER (1024 bit) [server.key]
2460226 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
..........++++++
....++++++
e is 65537 (0x10001)
______________________________________________________________________

STEP 5: Generating X.509 certificate signing request for SERVER [server.csr]
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
1. Country Name             (2 letter code) [XY]:CN
2. State or Province Name   (full name)     [Snake Desert]:HKSAR
3. Locality Name            (eg, city)      [Snake Town]:Hong Kong
4. Organization Name        (eg, company)   [Snake Oil, Ltd]:Example Ltd.
5. Organizational Unit Name (eg, section)   [Webserver Team]:Web Team
6. Common Name              (eg, FQDN)      [www.snakeoil.dom]:www.example.net
7. Email Address            (eg, name@fqdn) [www@snakeoil.dom]:info@example.net
8. Certificate Validity     (days)          [365]:
______________________________________________________________________

STEP 6: Generating X.509 certificate signed by own CA [server.crt]
Certificate Version (1 or 3) [3]:
Signature ok
subject=/C=CN/ST=HKSAR/L=Hong Kong/O=Example Ltd./OU=Web Team/CN=www.example.net/emailAddress=info@example.net
Getting CA Private Key
Verify: matching certificate & key modulus
Verify: matching certificate signature
/etc/apache/ssl.crt/server.crt: OK

輸入 CA 的密碼

______________________________________________________________________

STEP 7: Enrypting RSA private key of CA with a pass phrase for security
[ca.key]The contents of the ca.key file (the generated private key) has to be
kept secret. So we strongly recommend you to encrypt the server.key file
with a Triple-DES cipher and a Pass Phrase.
Encrypt the private key now? [Y/n]: y
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
______________________________________________________________________

STEP 8: Enrypting RSA private key of SERVER with a pass phrase for security [server.key]
The contents of the server.key file (the generated private key) has to be
kept secret. So we strongly recommend you to encrypt the server.key file
with a Triple-DES cipher and a Pass Phrase.
Encrypt the private key now? [Y/n]: n
Warning, you're using an unencrypted RSA private key.
Please notice this fact and do this on your own risk.
______________________________________________________________________

RESULT: CA and Server Certification Files

o  /etc/apache/ssl.key/ca.key
   The PEM-encoded RSA private key file of the CA which you can
   use to sign other servers or clients. KEEP THIS FILE PRIVATE!

o  /etc/apache/ssl.crt/ca.crt
   The PEM-encoded X.509 certificate file of the CA which you use to
   sign other servers or clients. When you sign clients with it (for
   SSL client authentication) you can configure this file with the
   'SSLCACertificateFile' directive.

o  /etc/apache/ssl.key/server.key
   The PEM-encoded RSA private key file of the server which you configure
   with the 'SSLCertificateKeyFile' directive (automatically done
   when you install via APACI). KEEP THIS FILE PRIVATE!

o  /etc/apache/ssl.crt/server.crt
   The PEM-encoded X.509 certificate file of the server which you configure
   with the 'SSLCertificateFile' directive (automatically done
   when you install via APACI).

o  /etc/apache/ssl.csr/server.csr
   The PEM-encoded X.509 certificate signing request of the server file which
   you can send to an official Certificate Authority (CA) in order
   to request a real server certificate (signed by this CA instead
   of our own CA) which later can replace the /etc/apache/ssl.crt/server.crt
   file.

Congratulations that you establish your server with real certificates.

[编辑]

使用 mkimapdcert 和 mkpop3dcert (Courier IMAPd/POP3d)

/usr/lib/courier/mkimapdcert
/usr/lib/courier/mkpop3dcert

[编辑]

使用 CA.pl

$ /usr/lib/ssl/misc/CA.pl -newreq
Generating a 1024 bit RSA private key
....................++++++
........++++++
writing new private key to 'newreq.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:HKSAR
Locality Name (eg, city) []:Hong Kong
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Ltd.
Organizational Unit Name (eg, section) []:Web Team
Common Name (eg, YOUR name) []:www.example.com
Email Address []:webmaster@example.com
　
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abc123
An optional company name []:Example Ltd.
Request (and private key) is in newreq.pem

以上方法會把新產生的私鑰用 DES3 加密，每次要使用這個私鑰時都要用輸入密碼。如果你的電子證書是用在 apache 等伺服器中，你每次啟動伺服器時都要輸入密碼一次，會非常麻煩。所以一般人都會用 /usr/lib/ssl/misc/CA.pl -newreq-nodes ，這和以上的指令一樣，只是不會問你輸入密碼，也不會把私鑰加密。

完成後，現行的目錄會多了個檔案 newreq.pem 。這個檔案包含了私鑰和 Certificate Signing Request (CSR)。

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED                   (這表示私鑰已被加密了)
DEK-Info: DES-EDE3-CBC,2A7A7EA67186C5DE  (這表示私鑰被 DES-EDE3-CDE 加密了)

4dnl5DYqcWsG5+9fJoQOA79yOwNOkWCLh02h9yKSR78+7Lre5Dixm/QD0IuqVliD
ShWYCYz5DaMGwnEu9NbZqR37Lv+ZsHUL2eT8Gh284kQv/B+V9UggFPzPhfH41IV5
TMmbQHI69w8VUxiko7caqbUGmYCKLjdzrFETip5CqxIUqalHt5pdys1MzyfjhgoK
VGwS7xQiQQHBPPUz4+C2rrwM14K0fMWY9oFHEbPPDmf7H6AEtNptbUp0Rhgw489h
7oZuTcCAFzM8GDJl7LQ9yF3M6sCF/q2znhqsF6MvIIpnyrDebZCGPMu645ScD7V4
p5CzFEHs11D9aRNvFYHfOD13ocDydgHnWVapI/y/EUIMOcJrXhrMEWDMpRCnv2wQ
HNcWmP8fGiREuiq0m0lXW5vGkKH1+L6+Oh1tvVxfJRk2Kw3H+hNLiRI3+IPgwdqV
hGjZeUqZdjtDiKyaDKIhc0W18YHOQgScs/Wxed+m0VvF79BLqyB3c42CBHavvPky
B3CfgKYtMFzoyTrCLurmY8Vf6CA5xOUaZTG0rZ/uwLQoqm8He19b0Rr74fvzwpzs
nUJntM9l0gkmg1N/BanvWZx1362imqpKCu292uvKaDAcodUC9nzqFfI1jFg8KZoi
CXfu/FWLYnKjr4QoTGwyK0B/24VgOeeUDveJCPcVFURw8svg8bu1u1HPlBGXi7DL
9XsyhVhymRxztfF49xBTVcmT6b3R/p95tLnqnOF06IrW1yM5yfTGfbeIuVOYvC5a
7Mu2OxGk4H6RQEBuJabu/yr78YIuvLi648YWiNs5l69wmVbgNufdWw==
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE REQUEST-----
MIICEDCCAXkCAQAwgZsxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIEwVIS1NBUjESMBAG
A1UEBxMJSG9uZyBLb25nMRUwEwYDVQQKEwxFeGFtcGxlIEx0ZC4xETAPBgNVBAsT
CFdlYiBUZWFtMRgwFgYDVQQDEw93d3cuZXhhbXBsZS5jb20xJDAiBgkqhkiG9w0B
CQEWFXdlYm1hc3RlckBleGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
gYkCgYEAucC/Gxdd1v/5kGMLr6OoQN3BHFsFuAaNRUZs4/JITGaw7fhKwOyZux04
AUQTjeyVTfH6TTX1A0GWISwfKkqxNg4jx9LOqiecMnjKH/fzBvCZE1iNhz1mtkPh
pxWV9K6keuf6nuLXfU/NSWd9EY/VWUQX0PUDmjynrVYI29Zl1sMCAwEAAaA0MBUG
CSqGSIb3DQEJBzEIEwZhYmMxMjMwGwYJKoZIhvcNAQkCMQ4TDEV4YW1wbGUgTHRk
LjANBgkqhkiG9w0BAQQFAAOBgQAxdevQ9KuHhUf+XYHrDS04+yhesSmg2muC65mq
WHn9iIMQZIcWlcm5WtZZlamDnSxui8Utyh15U0cJDeIo8jebht+DDfC3BXc5LUaV
1TjbieB5gaM+oCNJFI3STC77ldwowCqgrbAQTpO3mx84M1gunJgGPKy/SHR3DwfN
Drzq2A==
-----END CERTIFICATE REQUEST-----

不過你需要有人證明這個私鑰屬於你所有，所以需要把 CSR 交給 CA 簽署。你要把 newreq.pem 中 -----BEGIN CERTIFICATE REQUEST----- ... -----END CERTIFICATE REQUEST----- 包住的部份交給 CA 。 (-----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY----- 包住的部份是你的私鑰，切勿給任何人看到。)

[编辑]

使用 openssl

首先你需要產生一個私鑰 (private key) ：

$ openssl genrsa -des3 1024 >www.example.com.key

不過以上方法會把新產生的私鑰用 DES3 加密，每次要使用這個私鑰時都要用輸入密碼。如果你的電子證書是用在 apache 等伺服器中，你每次啟動伺服器時都要輸入密碼一次，會非常麻煩。所以一般人都會省去選項 -des3 來產生一個不被加密的私鑰：只是不會問你輸入密碼，也不會把私鑰加密。

$ openssl genrsa 1024 >www.example.com.key

這個命令和上面幾乎沒有分別，只是這次不會問你輸入密碼了。完成後，新私鑰會記錄在檔案 www.example.com.key 中。不過我們需要有人證明這個私鑰屬於我們所有，所以我們需要產生這個私鑰的 Certificate Signing Request (CSR) 給一個 CA 簽署才可以使用。要產生 CSR ，打：

$ openssl req -new -key www.example.com.key > www.example.com.csr

CSR 會放在 www.example.com.csr 中：

你只要把這個檔案放給有關 CA ，就可以了。

[编辑]

如何造一張自簽 (Self-signed) 的電子證書

如果你只是想做一張測試用的電子證書或不想花錢去找個 CA 簽署，你可以造一張自簽 (Self-signed) 的電子證書。當然這類電子證書沒有任何保證，大部份軟件偶到這證書會發出警告，甚至不接收這類證書。

$ openssl req -x509 -key www.example.com.key -in www.example.com.csr \
  > www.example.com.crt

完成後， www.example.com.crt 就是自簽證書。

[编辑]

安裝 SSL 證書

[编辑]

安裝證書在 Apache 中

把私鑰、CSR和電字證書放在 Apache 配署目錄 (Redhat 系在 /etc/httpd/conf ， Debian 系在 /etc/apache*/ ) 下這幾個目錄：

私鑰 (www.example.com.key) 放在 ssl.key 下：

CSR (www.example.com.csr) 放在 ssl.csr 下：

電子證書 (www.example.com.crt) 放在 ssl.crt 下：

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b2:7f:68:4d:80:d1:7b:a9
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=CN, ST=HKSAR, L=Hong Kong, O=Example Ltd., OU=Certificate
Authority, CN=Example CA/emailAddress=ca@example.com
        Validity
            Not Before: Nov 20 18:15:25 2004 GMT
            Not After : Nov 20 18:15:25 2005 GMT
        Subject: C=CN, ST=HKSAR, L=Hong Kong, O=Example Ltd., OU=Web Team,
CN=www.example.com/emailAddress=webmaster@example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:b9:c0:bf:1b:17:5d:d6:ff:f9:90:63:0b:af:a3:
                    a8:40:dd:c1:1c:5b:05:b8:06:8d:45:46:6c:e3:f2:
                    48:4c:66:b0:ed:f8:4a:c0:ec:99:bb:1d:38:01:44:
                    13:8d:ec:95:4d:f1:fa:4d:35:f5:03:41:96:21:2c:
                    1f:2a:4a:b1:36:0e:23:c7:d2:ce:aa:27:9c:32:78:
                    ca:1f:f7:f3:06:f0:99:13:58:8d:87:3d:66:b6:43:
                    e1:a7:15:95:f4:ae:a4:7a:e7:fa:9e:e2:d7:7d:4f:
                    cd:49:67:7d:11:8f:d5:59:44:17:d0:f5:03:9a:3c:
                    a7:ad:56:08:db:d6:65:d6:c3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                76:6F:7F:4C:9C:2A:87:40:5A:D4:0E:40:EE:B6:AD:3D:6E:12:0C:2D
            X509v3 Authority Key Identifier:
               keyid:51:D8:8E:8B:63:1D:F3:AF:CC:24:48:73:52:C9:F1:53:F6:B2:65:45
                DirName:/C=CN/ST=HKSAR/L=Hong Kong/O=Example Ltd./OU=Certificate
Authority/CN=Example CA/emailAddress=ca@example.com
                serial:B2:7F:68:4D:80:D1:7B:A8

    Signature Algorithm: md5WithRSAEncryption
        2e:63:b0:8c:59:54:2c:ff:ea:3d:cb:d9:60:08:cf:53:c6:b2:
        dc:e2:74:4e:a3:33:05:15:13:89:e5:f2:27:b4:6b:a8:fb:7a:
        87:18:63:d6:4d:25:4a:c5:58:f6:cd:af:7f:12:a9:d3:ce:2e:
        dd:6d:d0:1f:70:88:c2:9c:06:f0:bd:97:f9:a7:40:a2:8e:1d:
        eb:ef:59:5d:6c:e2:fa:fc:b2:e2:20:f9:e5:d7:e4:c9:30:b5:
        1b:c5:d6:0f:33:0c:40:05:7a:17:e5:8e:bb:4d:6d:a1:dd:8d:
        56:4a:34:58:d7:8f:c5:ba:f4:bd:84:79:a2:5a:44:a2:b1:3c:
        4f:7c
-----BEGIN CERTIFICATE-----
MIID6TCCA1KgAwIBAgIJALJ/aE2A0XupMA0GCSqGSIb3DQEBBAUAMIGcMQswCQYD
VQQGEwJDTjEOMAwGA1UECBMFSEtTQVIxEjAQBgNVBAcTCUhvbmcgS29uZzEVMBMG
A1UEChMMRXhhbXBsZSBMdGQuMR4wHAYDVQQLExVDZXJ0aWZpY2F0ZSBBdXRob3Jp
dHkxEzARBgNVBAMTCkV4YW1wbGUgQ0ExHTAbBgkqhkiG9w0BCQEWDmNhQGV4YW1w
bGUuY29tMB4XDTA0MTEyMDE4MTUyNVoXDTA1MTEyMDE4MTUyNVowgZsxCzAJBgNV
BAYTAkNOMQ4wDAYDVQQIEwVIS1NBUjESMBAGA1UEBxMJSG9uZyBLb25nMRUwEwYD
VQQKEwxFeGFtcGxlIEx0ZC4xETAPBgNVBAsTCFdlYiBUZWFtMRgwFgYDVQQDEw93
d3cuZXhhbXBsZS5jb20xJDAiBgkqhkiG9w0BCQEWFXdlYm1hc3RlckBleGFtcGxl
LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAucC/Gxdd1v/5kGMLr6Oo
QN3BHFsFuAaNRUZs4/JITGaw7fhKwOyZux04AUQTjeyVTfH6TTX1A0GWISwfKkqx
Ng4jx9LOqiecMnjKH/fzBvCZE1iNhz1mtkPhpxWV9K6keuf6nuLXfU/NSWd9EY/V
WUQX0PUDmjynrVYI29Zl1sMCAwEAAaOCATAwggEsMAkGA1UdEwQCMAAwLAYJYIZI
AYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQW
BBR2b39MnCqHQFrUDkDutq09bhIMLTCB0QYDVR0jBIHJMIHGgBRR2I6LYx3zr8wk
SHNSyfFT9rJlRaGBoqSBnzCBnDELMAkGA1UEBhMCQ04xDjAMBgNVBAgTBUhLU0FS
MRIwEAYDVQQHEwlIb25nIEtvbmcxFTATBgNVBAoTDEV4YW1wbGUgTHRkLjEeMBwG
A1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRMwEQYDVQQDEwpFeGFtcGxlIENB
MR0wGwYJKoZIhvcNAQkBFg5jYUBleGFtcGxlLmNvbYIJALJ/aE2A0XuoMA0GCSqG
SIb3DQEBBAUAA4GBAC5jsIxZVCz/6j3L2WAIz1PGstzidE6jMwUVE4nl8ie0a6j7
eocYY9ZNJUrFWPbNr38SqdPOLt1t0B9wiMKcBvC9l/mnQKKOHevvWV1s4vr8suIg
+eXX5MkwtRvF1g8zDEAFehfljrtNbaHdjVZKNFjXj8W69L2EeaJaRKKxPE98
-----END CERTIFICATE-----

[编辑]

產生一張 SSL 電子證書

OSWikiHK，自由中文開源知識庫

目录

基本流程

在 Debian 系統

使用 make-ssl-cert

使用 apache2-ssl-certificate (Apache 2.x)

使用 mod-ssl-makecert (Apache 1.3 + Mod_SSL)

使用 mkimapdcert 和 mkpop3dcert (Courier IMAPd/POP3d)

使用 CA.pl

使用 openssl

如何造一張自簽 (Self-signed) 的電子證書

安裝 SSL 證書

安裝證書在 Apache 中

相關頁面

Views

Personal tools

导航

DebianHK

搜索

工具