RHEL5.2+Apach+OpenSSL 證書管理

火星人 @ 2014-03-04 , reply:0
←手機掃碼閱讀

RHEL5.2+Apach+OpenSSL 證書管理

RHEL5+Apache+Openssl證書管理

【測試環境】
OS:RHEL5.2
Apache:httpd-2.2.3-11.el5_1.3
Openssl:openssl-0.9.8b-10.el5
IPAddress:192.168.254.80
Site:www.example.com

【操作步驟】
1.        安裝相應軟體包
# rpm -qa |grep httpd
httpd-2.2.3-11.el5_1.3
# rpm -qa |grep mod_ssl
mod_ssl-2.2.3-11.el5_1.3
# rpm -qa |grep openssl
openssl-0.9.8b-10.el5
openssl-devel-0.9.8b-10.el5
#

2.        修改證書生成時的默認參數
a)        以下修改生成證書的默認參數
vi /etc/pki/tls/openssl.cnf
[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = CN
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = SHANGHAI

localityName                    = Locality Name (eg, city)
localityName_default            = SHANGHAI

0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = example.com

# we can do this but it is not needed normally :-)
#1.organizationName             = Second Organization Name (eg, company)
#1.organizationName_default     = World Wide Web Pty Ltd

organizationalUnitName          = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
organizationalUnitName_default  = IT Deps.

commonName                      = Common Name (eg, your name or your server\'s hostname)
commonName_max                  = 64

emailAddress                    = Email Address
emailAddress_max                = 64

# SET-ex3                       = SET extension number 3

cd /etc/pki/tls/misc/

b)        生成CA證書                //此步很重要
./CA –newca
完成後會生成根證書的私鑰(/etc/pki/CA/private/cakey.pem)及根證書(/etc/pki/CA/cacert.pem)。

3.        伺服器證書生成及配置
注意:此處將所有證書都生成到/etc/httpd/ca目錄下,建立/etc/httpd/ca目錄:
# mkdir /etc/httpd/ca
# cd /etc/httpd/ca

a)        生成伺服器端的私鑰(server.key文件):
# openssl genrsa -des3 -out server.key
注意這裡會讓您輸入一下密碼,請記住這個密碼,(例如:key_password)
Generating RSA private key, 512 bit long modulus
...........................++++++++++++
......++++++++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
以下指令執行完成後,會在當前目錄下生成server.key 的文件。

b)        你可以使用以下方法查看key文件(注意:需要提供剛才設置的密碼喲)
# openssl rsa -noout -text -in server.key
Enter pass phrase for server.key:
Private-Key: (512 bit)
modulus:
    00:cc:f5:d5:68:89:1a:5d:80:83:b5:52:77:7f:9b:
    c7:3a:1c:ea:87:f5:37:cb:17:a5:bd:63:18:94:bc:
    69:e7:6f:a0:ee:42:46:6d:d8:33:75:d4:f1:b3:18:
    4d:4f:33:27:6d:76:65:36:25:cb:4d:04:96:7b:b2:
    8d:53:eb:a2:ed
publicExponent: 65537 (0x10001)
privateExponent:
    00:c6:d1:6d:8b:b2:fb:5d:5a:2d:e9:35:2e:f0:1d:
    57:9c:1a:b2:b2:e1:ff:96:45:c1:23:be:bd:f8:81:
    f0:a5:6b:99:79:12:c8:af:2b:73:55:99:68:f6:2a:
    a1:4b:32:87:db:51:e7:db:df:e9:bd:10:44:67:6d:
    08:17:1a:ad:01
prime1:
    00:f1:fa:fc:1a:6e:73:97:ea:95:b5:ec:4f:7d:78:
    00:31:81:7a:bb:a7:de:37:62:74:70:e0:45:02:5f:
    aa:b2:c1
prime2:
    00:d8:d5:c5:b2:16:a4:c1:f0:9d:c9:3d:f6:10:5f:
    31:f3:1d:9d:7a:2b:22:91:84:2f:19:ff:b9:2b:56:
    f2:f7:2d
exponent1:
    00:da:05:71:2f:bf:64:96:f3:dd:7f:d4:32:aa:b1:
    7c:3b:1e:96:1e:8d:d9:41:bd:8b:7c:48:14:e5:56:
    9c:ce:01
exponent2:
    2d:58:1e:fc:8c:01:ae:50:ec:1e:2e:67:eb:aa:8c:
    9e:83:9d:ef:f3:5f:4a:40:f3:3c:a3:9e:8c:72:a5:
    62:8d
coefficient:
    00:dd:9a:2e:10:ae:47:ba:40:75:a2:17:de:72:2c:
    8d:ee:29:02:b6:ff:a6:e9:6d:84:7b:e1:c0:87:24:
    83:46:d3
c)        去除啟動時的密碼(啟動時說不需要輸入密碼了)
這裡將去除密碼的私鑰另存為server.key.nopw
# openssl rsa < server.key > server.key.nopw
Enter pass phrase:
writing RSA key
完成後會在當前目錄下生成一個server.key.nopw的文件。

d)        生成伺服器證書請求文件
# openssl req -new -key server.key > server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) :
Organizational Unit Name (eg, section) :
Common Name (eg, your name or your server's hostname) []:www.example.com
Email Address []:root@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
完成後當前目錄下會生成一個server.csr的文件。

e)        創建伺服器公鑰
# openssl x509 -req -days 3650 < server.csr -signkey server.key > server.crt
Signature ok
subject=/C=CN/ST=ShangHai/L=ShangHai/O=example.com/OU=IT Deps./CN=www.example.com/emailAddress=root@example.com
Getting Private key
Enter pass phrase for server.key:
完成後,會在當前目錄下生成server.crt文件。

f)        修改Apache關於ssl的配置文件
修改/etc/httpd/conf.d/ssl.conf:
# vi /etc/httpd/conf.d/ssl.conf
修改以下兩個屬性:
SSLCertificateFile /etc/httpd/ca/server.crt
SSLCertificateKeyFile /etc/httpd/ca/server.key
SSLCACertificateFile /etc/pki/CA/cacert.pem                #指定CA證書位置,客戶端證書驗證的時候會要用到

g)        重啟Apache,會要求輸入生成私鑰時的密碼
# service httpd restart
Stopping httpd: [  OK  ]
Starting httpd: Apache/2.2.3 mod_ssl/2.2.3 (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Server www.example.com:443 (RSA)
Enter pass phrase:

OK: Pass Phrase Dialog successful.
[  OK  ]

h)        設置重啟apache時不用輸入密碼
將/etc/httpd/conf.d/ssl.conf中的
SSLCertificateKeyFile /etc/httpd/ca/server.key
修改成為:
SSLCertificateKeyFile /etc/httpd/ca/server.key.nopw
完成後,重啟apache時不需要輸入密碼了。
# service httpd restart
Stopping httpd: [  OK  ]
Starting httpd: [  OK  ]

4.        客戶端證書生成及安裝
a)        創建目錄client存放客戶端證書
# mkdir client
# cd client/

b)        創建訪問用戶的csr文件(computer1)
這裡會要求輸入一些信息,按需要信息輸入就行,這裡密碼設置為「clientpassword」。
# openssl req –new > computer1.csr
Generating a 1024 bit RSA private key
…++++++
….....++++++
writing new private key to 『privkey.pem』
Enter PEM pass phrase:
Verifying – Enter PEM pass phrase:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter 『.』, the field will be left blank.
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) :
Organizational Unit Name (eg, section) :
Common Name (eg, your name or your server』s hostname) []:computer1

Email Address []:
Please enter the following 『extra』 attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
完成後會在當前目錄下生成以下兩個文件:computer1.csr privkey.pem

c)        創建訪問用戶的crt證書文件
注意這裡要輸入CA根證書的私鑰密碼。
# openssl x509 –req < computer1.csr  > computer1.crt –signkey /etc/pki/CA/private/cakey.pem –CA /etc/pki/CA/cacert.pem –Cakey /etc/pki/CA/private/cakey.pem –Cacreateserial –days 3650
Signature ok
subject=/C=CN/ST=ShangHai/L=ShangHai/O=example.com/OU=IT Deps./CN=computer1
Getting CA Private Key
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
完成後會在當前目錄下生成computer1.crt文件。

d)        將crt文件導出為pfx文件(ie中只能導入pfx格式證書)
注意:這裡設置的Export Password是安裝證書時要使用的喲!我這裡設置為「clientpassword」。
# openssl pkcs12 –export –in computer1.crt –inkey /etc/pki/CA/private/cakey.pem –out computer1.pfx
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Enter Export Password:
Verifying – Enter Export Password:
完成後會在當前目錄下生成computer1.pfx文件。

e)        修改apache要求客戶端必須使用證書訪問
修改/etc/httpd/conf.d/ssl.conf文件:
SSLVerifyClient require
SSLVerifyDepth  10
        修改完成後重啟Apache服務:
# /etc/init.d/httpd restart
Stopping httpd: [  OK  ]
Starting httpd: [  OK  ]

f)        下載並安裝客戶端證書





g)        以上完成後,可以在客戶端通過證書訪問本站點了,沒有證書則訪問不了!



5.        客戶端證書撤消,更新
a)        目錄切換後勁/etc/pki/tls/misc
cd /etc/pki/tls/misc

b)        撤銷客戶端證書computer1.crt
# openssl ca -keyfile /etc/pki/CA/private/cakey.pem -cert /etc/pki/CA/cacert.pem -revoke /etc/httpd/ca/client/computer1.crt
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Adding Entry with serial number 8B962ECF679FB9AB to DB for /C=CN/ST=ShangHai/L=ShangHai/O=example.com/OU=IT Deps./CN=computer1
Revoking Certificate 8B962ECF679FB9AB.
Data Base Updated

c)        生成新的證書撤銷列表
請注意,此時的操作會報錯。
# openssl ca -gencrl -keyfile /etc/pki/CA/private/cakey.pem -cert /etc/pki/CA/cacert.pem -out /etc/httpd/ca/example.com.crl
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
../../CA/crlnumber: No such file or directory
error while loading CRL number
12727:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('../../CA/crlnumber','r')
12727:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354:
此處有些問題,不知道為什麼?我是手動建立文件來解決的:
# echo "01" >../../CA/crlnumber
然後創建成功
# openssl ca -gencrl -keyfile /etc/pki/CA/private/cakey.pem -cert /etc/pki/CA/cacert.pem -out /etc/httpd/ca/example.com.crl
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:

d)        查看證書撤銷列表
# openssl crl -noout -text -in example.com.crl
Certificate Revocation List (CRL):
        Version 2 (0x1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: /C=CN/ST=ShangHai/O=example.com/OU=IT Deps./CN=www.example.com/emailAddress=root@example.com
        Last Update: Feb 24 14:40:04 2009 GMT
        Next Update: Mar 26 14:40:04 2009 GMT
        CRL extensions:
            X509v3 CRL Number:
                2
Revoked Certificates:
    Serial Number: 8B962ECF679FB9AB
        Revocation Date: Feb 24 14:28:44 2009 GMT
    Signature Algorithm: sha1WithRSAEncryption
        86:45:16:c7:0b:7d:15:6e:3c:eb:4e:92:1c:4f:62:ec:64:44:
        cd:59:68:28:23:4b:ff:b0:93:1a:13:b7:cf:10:91:4f:da:6d:
        25:48:99:9c:9d:f5:03:91:8b:c7:45:cb:92:68:79:ba:d5:68:
        1f:e8:0f:a7:fa:ff:15:f8:a6:8b:9f:2f:c8:14:7d:9c:7a:c6:
        36:6b:03:d8:c2:90:40:3a:24:51:43:71:47:84:5d:f8:38:44:
        f3:06:df:cf:81:3a:ef:ac:99:29:fc:ed:44:4e:79:79:ee:aa:
        15:1a:61:cc:e0:9f:23:75:fb:4a:a2:af:4a:cc:c9:9b:88:be:
        8a:7b

e)        修改Apache配置,添加證書吊銷列表
修改ssl配置文件/etc/httpd/conf.d/ssl.conf,修改以下一行:
SSLCARevocationFile "/etc/pki/tls/misc/example.com.crl"
重啟Apache:
# service httpd restart
Stopping httpd: [  OK  ]
Starting httpd: [  OK  ]

f)        客戶端訪問測試,訪問失敗,提示證書已經撤銷

《解決方案》

收藏了,非常感謝
《解決方案》

謝謝,正想好好學習一下證書,難得有那麼詳細的文檔。
《解決方案》

不錯




[火星人 via ] RHEL5.2+Apach+OpenSSL 證書管理已經有297次圍觀

http://www.coctec.com/docs/service/show-post-16093.html