CA认证介绍及搭建过程

风云

CA认证的介绍

翻译成： 认证中心，主要用途：实现为用户发放数字证书。  认证中心（CA）功能： 证书发放，证书更新，证书撤销和证书验证
总结签证过程：

• 生成请求文件
  
• CA确认申请者的身份的真实性
  
• CA使用根证书私钥加密请求文件-生成证书
  
• 把证书发给申请者
  

问题： CA证书是免费的吗？         个人版是免费的（阿里云申请）         收费的
搭建CA认证

1. 安装ca认证软件包中心

[root@xinsz08-64 桌面]# rpm -qf `which openssl`
openssl-1.0.1e-57.el6.x86_642. 配置一个自己的CA认证中心，生成CA的根证书和私钥。根证书包括 ： CA公钥

[root@xinsz08-64 桌面]# vim /etc/pki/tls/openssl.cnf
basicConstraints=CA:TRUE3. 生成CA的公钥和私钥

[root@xinsz08-64 桌面]# /etc/pki/tls/misc/CA -h -newcert            新证书 -newreq         新请求 -newreq-nodes   新请求节点 -newca          新的CA证书 -sign               签证 -verify            验证
[root@xinsz08-64 桌面]# /etc/pki/tls/misc/CA -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 2048 bit RSA private key
.............+++
............................+++
writing new private key to '/etc/pki/CA/private/./cakey.pem'
Enter PEM pass phrase:123456
Verifying - Enter PEM pass phrase:  123456
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:haidian
Organization Name (eg, company) [Default Company Ltd]:zmedu
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:zmedu.cn
Email Address []:xinsz08@yeah.net

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/./cakey.pem: 123456
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 11528897308301078024 (0x9ffedf04e93e2e08)
        Validity
            Not Before: Mar  5 06:01:52 2020 GMT
            Not After : Mar  5 06:01:52 2023 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = beijing
            organizationName          = zmedu
            organizationalUnitName    = IT
            commonName                = zmedu.cn
            emailAddress              = xinsz08@yeah.net
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E5:76:DA:19:34:76:F6:1D:26:66:57:97:C1:93:F5:BA:4E:B1:50:1A
            X509v3 Authority Key Identifier:
                keyid:E5:76:DA:19:34:76:F6:1D:26:66:57:97:C1:93:F5:BA:4E:B1:50:1A

            X509v3 Basic Constraints:
                CA:TRUE
Certificate is to be certified until Mar  5 06:01:52 2023 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated4.  查看生成的CA根证书

[root@xinsz08-64 桌面]# vim /etc/pki/CA/cacert.pem   查看公钥 [root@xinsz08-64 桌面]# vim /etc/pki/CA/private/cakey.pem   查看私钥

原文地址：https://zhuanlan.zhihu.com/p/138707349