Self-built CA and signed certificate

1. Self-built CA

# cd / etc/pki/CA/# (umask 077 Openssl genrsa-out private/cakey.pem 2048) # openssl req-new-x509-key private/cakey.pem-out cacert.pem-days 3656Country Name (2 letter code) [XX]: CNState or Province Name (full name) []: YunnanLocality Name (eg, city) [Default City]: KunmingOrganization Name (eg, company) [Default Company Ltd]: SanOrganizational Unit Name (eg, section) []: StudentsCommon Name (eg) Your name or your server's hostname) []: ca.san.comEmail Address []: the total amount of caadmin@san.com# ls-lh is 20K, RW, RW, RMI. 1 root root 1.4K March 29 16:18 cacert.pem# touch serial index.txt serial# echo 01 > serial# lscacert.pem certs crl index.txt newcerts private serial

2. Certificate signing

# (umask 077 Openssl genrsa-out / root/mykey2.pri 2048) # generate a private key # openssl req-new-key / root/mykey2.pri-out / root/myreq.csr # generate certificate Country Name (2 letter code) [XX]: CNState or Province Name (full name) []: YunnanLocality Name (eg, city) [Default City]: KunmingOrganization Name (eg, company) [Default Company Ltd]: SanOrganizational Unit Name (eg, section) []: StudentsCommon Name (eg) Your name or your server's hostname) []: www.san.comEmail Address []: admin@san.comPlease enter the following 'extra' attributesto be sent with your certificate requestA challenge password []: An optional company name []: # openssl ca-in myreq.csr-out mycert.crt-days 365signing certificate # lsmycert.crt # certificate signed