openssl建立CA中心..docVIP

openssl建立CA中心 实验用了三台机： CA中心：(54) mail server: (0) mail client: (9) 实验基于Red Hat Enterprise Linux server 5 update 4版 一.CA中心(:54)的设置 [root@server1 tls]# pwd /etc/pki/tls [root@server1 tls]# ls cert.pem certs misc f private [root@server1 tls]# rpm -qa |grep openssl openssl-0.9.8e-12.el5 ##linux下的ssl是由openssl提供的。 ---------------?开始配置f [root@server1 tls]#vim f [ CA_default ] dir = /etc/pki/CA #CA存放的路径 certs = $dir/certs #存放签名的公钥 crl_dir = $dir/crl # 证书过期列表，存放过期证书 database = $dir/index.txt # 证书颁发、吊销的信息 new_certs_dir = $dir/newcerts # 证书副本(吊销凭证) certificate = $dir/my-ca.crt #CA公钥(任何人都可以拥有的) serial = $dir/serial # 序列号(每作一次签名,序列号就增加1) crlnumber = $dir/crlnumber #吊销序列号 crl = $dir/my-ca.crl #吊销证书名单列表 private_key = $dir/private/my-ca.key# The private key RANDFILE = $dir/private/.rand # private random number file x509_extensions = usr_cert # The extentions to add to the cert default_days = 365 # 证书有效期 default_crl_days= 30 #crl更新时间 default_md = sha1 # which md to use. preserve = no # keep passed DN ordering [ policy_match ] countryName = match #国家代码必须完全匹配 stateOrProvinceName = match # organizationName = match organizationalUnitName = optional #optional可以不一样 commonName = supplied #代表唯一身份,必须不匹配 emailAddress = optional [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = CN #国家代码 countryName_min = 2 countryName_max = 2 stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Hubei #洲或省 localityName = Locality Name (eg, city) localityName_default