自己証明書作成

淡々と自己証明書を作成していく。 ディレクトリ作成。

$ mkdir -p /opt/pki
$ mkdir -p /opt/pki/configs
$ mkdir -p /opt/pki/crl
$ mkdir -p /opt/pki/RootCA/newcerts
$ mkdir -p /opt/pki/InterCA
$ mkdir -p /opt/pki/Server
$ mkdir -p /opt/pki/Client

CSR（ Certificate Signing Request ）への署名時に必要なconfigファイルを作成しておく。

/opt/pki/configs/openssl_sign.cnf

[ ca ]
default_ca      = CA_default

[ CA_default ]
dir             = ./
certs           = $dir/certs
crl_dir         = $dir/crl
database        = $dir/index.txt
new_certs_dir   = $dir/newcerts
serial          = $dir/serial
crlnumber       = $dir/crlnumber
crl             = $dir/crl.pem
RANDFILE        = $dir/.rand

name_opt        = ca_default
cert_opt        = ca_default

default_days    = 365
default_crl_days= 30
default_bits    = 2048
default_md      = sha256
preserve        = no
policy          = policy_match

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints=CA:true
keyUsage = cRLSign,keyCertSign

[ v3_server ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
crlDistributionPoints = URI:http://192.168.0.254/crl/example.net.crl

[ v3_client ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
crlDistributionPoints = URI:http://192.168.0.254/crl/example.net.crl

1.秘密鍵の生成

cd /opt/pki/RootCA
echo "01" > serial
echo "00" > crlnumber
touch index.txt

$ openssl genrsa  -out RootCA_key.pem  -aes256  -passout pass:rootcaprivkeypass  2048

2.CSR(Certificate Signing Request):証明書要求の生成

openssl req -new -subj "/C=JP/ST=Tokyo/O=EXAMPLE/CN=EXAMPLE Root CA" -out RootCA_csr.pem -key RootCA_key.pem -passin pass:rootcaprivkeypass

3.CSRに署名する
ここで先程作ったopenssl_sign.confを利用する。

$ openssl ca -config ../configs/openssl_sign.conf  -batch -extensions v3_ca  -out RootCA_crt.pem  -in RootCA_csr.pem  -selfsign  -keyfile RootCA_key.pem  -passin pass:rootcaprivkeypass
$ openssl x509 -in RootCA_crt.pem -out RootCA_crt.pem

参考

• OpenSSLでプライベート認証局の構築（ルートCA、中間CA）