1、KPI ：公共秘钥体系

签证机构：CA

注册机构：RA

证书吊销列表：CRL

证书存取库

509：定义了证书的结构以及认证协议标准

版本号
序列号
签名算法                   主体公钥        
颁发者                      CRL分发点
有效期限                    扩展信息
主体名称                   发行者签名

证书类型：

证书授权机构的证书

服务器

用户证书

获取证书两种方法：

•使用证书授权机构

生成签名请求（csr）

将csr发送给CA

从CA处接收签名

•自签名的证书
自已签发自己的公钥

安全协议

SSL：Secure  Socket  Layer

TLS：Transport  Layer  Security

功能：机密性，认证，完整性，重放保护(重新发一遍用户名和密码，跨过网站检查，危险)

HTTPS 协议：就是“HTTP 协议”和“SSL/TLS 协议”的组合。

openssl  rand  -base64   9   (3的倍数 就不用添加=号)   ，生成随机数，适合当口令

openssl  rand  -base 64    12  | tr  -dc '[:alnum:]'   生成一个12位随机密码，并且只留下数字和字母

生成密钥对儿

  生成私钥    （umask 066;openssl  genrsa -out  private.key 1024）

  私钥加密    （umask 066;openssl  genrsa -out  private.key -des 1024）

  生成公钥     （openssl rsa -in private.key -pubout -out public.key）将加密key解密

从私钥中提取出公钥

[root@laobai ~#cd /etc/pki/CA
[root@laobai /etc/pki/CA#(umask 077;openssl genrsa -out private/cakey.pem 4096)
Generating RSA private key, 4096 bit long modulus
...........++
.................................................................................................................++
e is 65537 (0x10001)

[root@laobai /etc/pki/CA#openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----

[root@laobai /etc/pki/CA#(umask 077;openssl genrsa -out app.key 1024)
Generating RSA private key, 1024 bit long modulus
.......++++++
.................................................................................++++++
e is 65537 (0x10001)

[root@laobai /etc/pki/CA#openssl req -new -key app.key -out app.csrCountry Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:magedu
Organizational Unit Name (eg, section) []:m30
Common Name (eg, your name or your server's hostname) []:www.magedu.com
Email Address []:Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

[root@laobai /etc/pki/CA#sz certs/app.crt 

[root@centos7 CA]#scp app.csr 172.20.110.62:/etc/pki/CA
root@172.20.110.62's password:
app.csr                                                        100%  651     1.2MB/s   00:00    

[root@laobai /etc/pki/CA#touch index.txt

[root@laobai /etc/pki/CA#echo 0F > serial

[root@laobai /etc/pki/CA#openssl ca -in app.csr -out certs/app.crt -days 100
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok