如何创建自己的自签名根证书和要在Java密钥库中导入的中间CA?
问题描述:
如何创建要在Java密钥库中导入的自签名根证书和中间CA?如何创建自己的自签名根证书和要在Java密钥库中导入的中间CA?
我们将此用于SSL和TLS,以及稍后用于基于客户端证书的CLIENT-AUTH身份验证。
使用OpenSSL和KeyTool。请帮忙。
答
只是一个旁注,任何人想要生成一个链和一些证书。精炼@ EpicPandaForce自己的答案,这里是一个脚本,它在root-ca/
中创建一个根CA,在intermediate/
中创建一个中间CA,三个证书到out/
,每个都使用中间CA签名。
#!/bin/bash -x
set -e
for C in `echo root-ca intermediate`; do
mkdir $C
cd $C
mkdir certs crl newcerts private
cd ..
echo 1000 > $C/serial
touch $C/index.txt $C/index.txt.attr
echo '
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = '$C' # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/.rnd # private random number file
nameopt = default_ca
certopt = default_ca
policy = policy_match
default_days = 365
default_md = sha256
[ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req]
basicConstraints = CA:TRUE
' > $C/openssl.conf
done
openssl genrsa -out root-ca/private/ca.key 2048
openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'
openssl genrsa -out intermediate/private/intermediate.key 2048
openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=Interm.'
openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt
mkdir out
for I in `seq 1 3` ; do
openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048
openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request
done
答
根据以下指南,特别感谢Jamie Nguyen制作指南使其成为可能,谢谢!
通过以下对https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/指导做到以下几点:
将OpenSSL安装的Windows:http://slproweb.com/products/Win32OpenSSL.html
的
bin
文件夹添加到环境变量PATH
创建一个目录对于证书,我会打电话给
cert-test
使用以下
openssl.cfg
数据为[CA_default]标签:
这
[ CA_default ]
dir = . # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca.key.pem # The private key
RANDFILE = $dir/.rnd # private random number file
在
cert_test
创建目录:certs crl newcerts private
使用下面的命令创建
根CA:
openssl genrsa -aes256 -out /etc/pki/CA/private/ca.key.pem 4096
openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/ca.key.pem -sha256 -extensions v3_ca -out /etc/pki/CA/certs/ca.cert.pem
创建文件夹
intermediate
创建文件夹
certs crl newcerts private
创建文件
index.txt
创建文件
serial
,写一个数字,它像1000
执行以下
命令:
openssl genrsa -aes256 -out intermediate/private/intermediate.key.pem 4096
openssl req -config intermediate/openssl.cfg -sha256 -new -key intermediate/private/intermediate.key.pem -out intermediate/certs/intermediate.csr.pem
openssl ca -keyfile private/ca.key.pem -cert certs/ca.cert.pem -extensions v3_ca -notext -md sha256 -in intermediate/certs/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem
- 创建
链文件:从链
cat intermediate/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem
- 创建JKS文件,
keytool
:
keytool -importkeystore -srckeystore ia.p12 -srcstoretype PKCS12 -destkeystore ia.jks
keytool -import -noprompt -trustcacerts -alias test_certificate -file ia.crt -keystore ia.jks -storepass helloworld
keytool -importcert -alias test_cert_ca -keystore "c:\Program Files\Java\jdk1.8.0\jre\lib\security\cacerts" -file ca.crt
keytool -importcert -alias test_cert_ia -keystore "c:\Program Files\Java\jdk1.8.0\jre\lib\security\cacerts" -file ia.crt
,你可能需要导入CA证书到ia.jks。
我必须缺少一些东西。我没有看到如何从“openssl”步骤中的pem文件获取“keytool”使用的“ca.crt”和“ia.crt”文件。 – mnemotronic 2015-08-15 19:18:36
@mnemotronic不幸的是我近一年前写过这篇文章,而且我手边没有这些步骤,但我认为你很不幸是正确的。您需要从私钥和证书(公钥)创建PKCS12密钥库文件。查看如何从pem文件创建密钥库,如果您指定密钥库和提供者的类型(我记得使用它来使用bouncycastle提供者创建BKS密钥库),我认为Keytool可以做到这一点。 – EpicPandaForce 2015-08-15 19:24:58
为什么要将中间证书添加到信任库(或任何'ia.crt')?根证书应该足够了,因为中间名是由root签名的,并且此信息存储在由中间通过扩展名签署的所有证书中。即使在您提供的手册(jammielinux页面)中,也声明根证书应该足够了。 – waste 2016-08-21 12:47:22