openssl 사설 인증서 만들기

##openssl로 사설 인증서 만들기

Test Environment

• Test OS : CentOS 7.2
• Test Version : apache

---

###command line

[root@lopdzmb-web01 test]# openssl genrsa -des3 -out test.vn.key 2048..........................+++e is 65537 (0x10001)Enter pass phrase for test.vn.key:[root@lopdzmb-web01 test]# openssl genrsa -des3 -out test.vn.key 2048..........................+++e is 65537 (0x10001)Enter pass phrase for test.vn.key:-----Country Name (2 letter code) [XX]:VNPlease enter the following 'extra' attributesto be sent with your certificate request#개인키 패스워드 지우기#인증서 생성#openssl x509 -req -days 365 -in test.vn.csr -signkey test.vn.key -out test.vn.crt#개인키 확인[root@lopdzmb-web01 test]# cat test.vn.key | head -3-----BEGIN RSA PRIVATE KEY-----MIIEpAIBAAKCAQEA9JYu6T71jmxqeu3rKhDL73sojqBSXJlmODPT3wEcdkoJwUl7#사설인증서 확인[root@lopdzmb-web01 test]# cat test.vn.csr | head -3-----BEGIN CERTIFICATE REQUEST-----MIIC3jCCAcYCAQAwZTELMAkGA1UEBhMCVk4xDjAMBgNVBAgMBUhhbm9pMQ4wDAYD#httpd.conf 설정SSLEngine on

openssl genrsa -des3 -out test.vn.key 2048

Generating RSA private key, 2048 bit long modulus
........+++
small:ui_lib.c:869:You must type in 4 to 8191 characters
Enter pass phrase for test.vn.key:
Verifying - Enter pass phrase for test.vn.key:
#openssl req -new -key test.vn.key -out test.vn.csr
Generating RSA private key, 2048 bit long modulus
........+++


140564056057760:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:869:You must type in 4 to 8191 characters
Enter pass phrase for test.vn.key:
Verifying - Enter pass phrase for test.vn.key:
[root@lopdzmb-web01 test]# openssl req -new -key test.vn.key -out test.vn.csr
Enter pass phrase for test.vn.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.


State or Province Name (full name) []:Hanoi
Locality Name (eg, city) [Default City]:lotte
Organization Name (eg, company) [Default Company Ltd]:admin
Organizational Unit Name (eg, section) []:admin
Common Name (eg, your name or your server's hostname) []:*.test.vn
Email Address []:


A challenge password []:Admin12#$
An optional company name []:Admin12#$

#cp test.vn.key test.vn.key.old
#openssl rsa -in test.vn.key.old -out test.vn.key

[root@lopdzmb-web01 test]# openssl rsa -in test.vn.key.old -out test.vn.key
Enter pass phrase for test.vn.key.old:
writing RSA key

[root@lopdzmb-web01 test]# openssl x509 -req -days 365 -in test.vn.csr -signkey test.vn.key -out test.vn.crt
Signature ok
subject=/C=VN/ST=Hanoi/L=lotte/O=admin/OU=admin/CN=*.test.vn
Getting Private key

KwyUN+98KhWkbxBKX8slvaGmOPU6IBQAam2vXJf9mpbREfMPjYAE4MaSs5G1sjiP
VQQHDAVsb3R0ZTEOMAwGA1UECgwFYWRtaW4xDjAMBgNVBAsMBWFkbWluMRYwFAYD

• SSLCertificateFile /etc/httpd/conf/test.vn.crt
• SSLCertificateKeyFile /etc/httpd/conf/test.vn.key