这篇文章介绍一下如何使用CFSSL的命令创建出来的CA私钥和CA证书签发新的证书。

事前准备

创建CA私钥和CA证书：

[root@liumiaocn ca]# ls
ca.csr  ca-csr.json  ca-key.pem  ca.pem
[root@liumiaocn ca]#

ca-csr.json: CSR的JSON设定文件
ca.csr: 证书签名请求文件
ca-key.pem：CA私钥
ca.pem: CA证书

详细生成方法可参看：https://liumiaocn.blog.csdn.net/article/details/103553480

准备签名CSR配置文件

[root@liumiaocn ca]# cat request-dev.json
{"CN": "dev.com","key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "DaLian","ST": "LiaoNing","O": "devops","OU": "dev"}]
}[root@liumiaocn ca]#
[root@liumiaocn ca]# ls
ca.csr  ca-csr.json  ca-key.pem  ca.pem  request-dev.json
[root@liumiaocn ca]#

准备配置文件

生成证书配置文件模版

[root@liumiaocn ca]# ../cfssl print-defaults config >cert-config.json
[root@liumiaocn ca]# cat cert-config.json
{"signing": {"default": {"expiry": "168h"},"profiles": {"www": {"expiry": "8760h","usages": ["signing","key encipherment","server auth"]},"client": {"expiry": "8760h","usages": ["signing","key encipherment","client auth"]}}}
}[root@liumiaocn ca]#

进行如下修改

[root@liumiaocn ca]# cat cert-config.json
{"signing": {"default": {"expiry": "8760h"},"profiles": {"client": {"expiry": "8760h","usages": ["signing","key encipherment","client auth"]}}}
}
[root@liumiaocn ca]#

signing：表示此证书可以对其他证书进行签名（CA=TRUE）
server auth：客户端可以使用该证书对server端进行验证
client auth：表示server端可以使用该证书对客户端提供的证书进行验证

签发证书

使用CA的私钥和CA证书签发新的证书文件, 执行命令如下所示

执行命令：…/cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -profile=client -config=cert-config.json request-dev.json | …/cfssljson -bare cert-test

[root@liumiaocn ca]# ls
ca.csr  ca-csr.json  ca-key.pem  ca.pem  cert-config.json  request-dev.json
[root@liumiaocn ca]# ../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -profile=client -config=cert-config.json request-dev.json | ../cfssljson -bare cert-test
2019/12/15 07:47:15 [INFO] generate received request
2019/12/15 07:47:15 [INFO] received CSR
2019/12/15 07:47:15 [INFO] generating key: rsa-2048
2019/12/15 07:47:15 [INFO] encoded CSR
2019/12/15 07:47:15 [INFO] signed certificate with serial number 573764368924225845114991454745178519328633833522
2019/12/15 07:47:15 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
[root@liumiaocn ca]# ls
ca.csr  ca-csr.json  ca-key.pem  ca.pem  cert-config.json  cert-test.csr  cert-test-key.pem  cert-test.pem  request-dev.json
[root@liumiaocn ca]#

生成的证书信息如下所示

[root@liumiaocn ca]# ../cfssl-certinfo -cert cert-test.pem
{"subject": {"common_name": "dev.com","country": "CN","organization": "devops","organizational_unit": "dev","locality": "DaLian","province": "LiaoNing","names": ["CN","LiaoNing","DaLian","devops","dev","dev.com"]},"issuer": {"common_name": "devops.com","country": "CN","organization": "devops","organizational_unit": "unicorn","locality": "DaLian","province": "LiaoNing","names": ["CN","LiaoNing","DaLian","devops","unicorn","devops.com"]},"serial_number": "573764368924225845114991454745178519328633833522","not_before": "2019-12-15T12:42:00Z","not_after": "2020-12-14T12:42:00Z","sigalg": "SHA256WithRSA","authority_key_id": "21:21:2E:B:76:F5:30:80:3A:7A:1F:1F:CA:77:4E:7:AE:3D:82:73","subject_key_id": "AB:B7:51:23:6D:65:42:77:2:25:B2:89:8F:5D:53:E5:77:3F:92:BB","pem": "-----BEGIN CERTIFICATE-----\nMIIDzjCCAragAwIBAgIUZIB77+8RLPqJ5ZoAPMXW3fGGyDIwDQYJKoZIhvcNAQEL\nBQAwaTELMAkGA1UEBhMCQ04xETAPBgNVBAgTCExpYW9OaW5nMQ8wDQYDVQQHEwZE\nYUxpYW4xDzANBgNVBAoTBmRldm9wczEQMA4GA1UECxMHdW5pY29ybjETMBEGA1UE\nAxMKZGV2b3BzLmNvbTAeFw0xOTEyMTUxMjQyMDBaFw0yMDEyMTQxMjQyMDBaMGIx\nCzAJBgNVBAYTAkNOMREwDwYDVQQIEwhMaWFvTmluZzEPMA0GA1UEBxMGRGFMaWFu\nMQ8wDQYDVQQKEwZkZXZvcHMxDDAKBgNVBAsTA2RldjEQMA4GA1UEAxMHZGV2LmNv\nbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMiiv3OFHq0dzrWQ9H/t\ncQx2Frn5PwZqNlaE3YwqPKCT6fNhXP/pxEWuRdJSQWk+qKUfj7+hclzu8JbJ/Gt1\ngoNX4TzGGqbK16PTiI04jrXfs++8EBIYw79rbNQNjMJfRbLPODTSzrTW3nHkUj2x\nEOIJVvD67p4+3gzRu4WImSSVyKyku2nce+31YSkru/zR9RGBq8p4BwJJqxfLc4do\npOf5y1saI1d3n9OI+IqXqIBPiDyz3NmfzSKd6GWIQEdzYHDDmSaeGV+ylRFwW4Nf\nluwyNfaHHRk83WHjDL72g5BjShHUfSU5Do81+twA3n7kzVLW4k8Z5xvkpnAy+UKO\nbr8CAwEAAaN1MHMwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMC\nMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFKu3USNtZUJ3AiWyiY9dU+V3P5K7MB8G\nA1UdIwQYMBaAFCEhLgt29TCAOnofH8p3TgeuPYJzMA0GCSqGSIb3DQEBCwUAA4IB\nAQBd8hx8Ef4XgYD/mW6P7IrY53q/Jt0Ghg7x7qB97FNQwUknMunNm8KyZT8ewCvT\nC2OgNQOiHsv0DN1vEWz/qSH6ZDNBkEqI756qR45CXEDTWTOOcrzw8nTEr3A4bOmA\n/2Z3cwbVLIOcJ+aJbcAQNbItZnwc3VZkaX/1WXg5TZD9jWhH2C6liGKIxyn44pF3\nHOLovH0Qdir4sXzpYP4d8RLQjTwT82os57c4yxbH7itpinJ3yVyoIIrKHfeIqnxG\nLK7cl22lPsmGqpLhsnf8zvrKF7l/Ze+Z/CYTczNnuVtqe0zxCtFovLqI0RjPcrJ6\nUEXbv02VjrLbWLn6XcInlEFm\n-----END CERTIFICATE-----\n"
}
[root@liumiaocn ca]#

使用openssl命令确认

[root@liumiaocn ca]# openssl x509 -noout -in cert-test.pem -issuer -subject -dates
issuer=C = CN, ST = LiaoNing, L = DaLian, O = devops, OU = unicorn, CN = devops.com
subject=C = CN, ST = LiaoNing, L = DaLian, O = devops, OU = dev, CN = dev.com
notBefore=Dec 15 12:42:00 2019 GMT
notAfter=Dec 14 12:42:00 2020 GMT
[root@liumiaocn ca]#

CFSSL: 证书管理工具：3:使用CA私钥与证书签发证书相关推荐

CFSSL: 证书管理工具：5:理解CSR文件内容
这篇文章以Kubernetes集群创建时所使用的证书为例,对CRS文件内容结合具体内容进行解释. 事前准备 [root@liumiaocn cert]# ls ca-config.json ca.cs ...
生成CA根证书、公钥、私钥指令（数字证书）
一.生成CA根证书生成 CA 私钥:openssl genrsa -out ca.key 1024 因为是自签名,省略生成证书签名请求csr 的过程,直接执行以下命令生成CA证书:openssl ...
【一】生成CA根证书、公钥、私钥指令（数字证书）
一.生成CA根证书生成 CA 私钥:openssl genrsa -out ca.key 1024 因为是自签名,省略生成证书签名请求csr 的过程,直接执行以下命令生成CA证书:openssl ...
密码学专题证书和CA指令申请证书|建立CA|CA操作|使用证书|验证证书
Req指令介绍功能概述和指令格式 req指令一般来说应该是提供给证书申请用户的工具,用来生成证书请求以便交给CA验证和签发证书.但是,OpenSSL的req指令的功能远比这样的要求强大得多,它不仅可 ...
加密解密概述及openssl应用及其创建CA和签发证书的实现
数据非常重要,这是大家的共识,为了保证数据的安全,就会涉及到加密及其解密,本文主要介绍加密解密相关概念及其在Linux平台下加密解密的具体实现openssl基础,及openssl创建CA和签发证书: ...
安全加密与证书签发工具--openssl
写在前面: 博客书写牢记5W1H法则:What,Why,When,Where,Who,How. 本篇主要内容: ● 安全协议 ● 数据安全问题及解决方案 ● 密钥算法及通讯过程 ● 使用OpenSSL ...
服务器证书签发工具程序
1.建立CA证书生成根证书和对应的私钥 openssl req -new -x509 -days 3650 -keyout ca.pem -out ca.crt -config openssl.cn ...
Linux 创建一个简单的私有CA、发证、吊销证书
操作环境:Centos 6.RHEL 6 操作虚拟机:VMware 本实验基于OpenSSL实现,SSL是Secure Sockets Layer(安全套接层协议)的缩写,可以在Internet上提供 ...
TrustAsia等CA颁发的TLS/SSL证书的四个pem/crt/key/csr文件区别与说明
向Trust Asia等SSL证书颁发机构申请得到证书后,从其下载得到的证书文件一般包含如下四个: xxx_bundle.pem xxx_bundle.crt xxx.key xxx.csr 首先看一 ...

CFSSL: 证书管理工具：3:使用CA私钥与证书签发证书

事前准备

创建CA私钥和CA证书：

准备签名CSR配置文件

准备配置文件

签发证书

CFSSL: 证书管理工具：3:使用CA私钥与证书签发证书相关推荐

最新文章

热门文章