[ ca ] default_ca = CA_default # The default ca section <--启用的CA名字
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept <--相关文件存放目录
certs = $dir/certs # Where the issued certs are kept <--存档颁发证书文件
crl_dir = $dir/crl # Where the issued crl are kept <--吊销证书列表
database = $dir/index.txt # database index file. <--证书索引数据库
#unique_subject = no # Set to 'no' to allow creation of <--是否允许创建具有相同主题的多个证书
# several certificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate <--自签名的证书
serial = $dir/serial # The current serial number <--当前可用的序列号(下一个要颁发证书的序列号)
crlnumber = $dir/crlnumber # the current crl number <--吊销证书编号
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key <--CA的私钥文件
RANDFILE = $dir/private/.rand # private random number file
default_days = 365 # how long to certify for <--证书有效期
default_crl_days= 30 # how long before next CRL <--发布吊销证书列表周期
default_md = sha256 # use SHA-256 by default <--算法
policy = policy_match <--使用哪个策略
# For the CA policy
[ policy_match ]
countryName = match <--CA与客户端的申请信息必须一致
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional <--可填可不填
commonName = supplied <--必须填
emailAddress = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[root@centos7 ~]#openssl req -new -x509 \ <-- -x509 专用于CA生成自签证书
> -key /etc/pki/CA/private/cakey.pem \ <-- 生成请求时用到的私钥文件
> -out /etc/pki/CA/cacert.pem \ <-- 证书的保存路径
> -days 365 <-- 证书的有效期限
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:ffu
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:ca.ffu.com
Email Address []:ffu@outlook.com
[root@centos6 app]#openssl req -new -key /app/service.key -out /app/service.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN <--按照所选policy，必须和申请CA的信息一致
State or Province Name (full name) []:BeiJing <--按照所选policy，必须和申请CA的信息一致
Locality Name (eg, city) [Default City]:Zhengzhou
Organization Name (eg, company) [Default Company Ltd]:ffu <--按照所选policy，必须和申请CA的信息一致
Organizational Unit Name (eg, section) []:cs
Common Name (eg, your name or your server's hostname) []:*.ffu.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@centos7 CA]#openssl ca -revoke /etc/pki/CA/newcerts/01.pem
Using configuration from /etc/pki/tls/openssl.cnf
Revoking Certificate 01.
Data Base Updated
[root@centos7 CA]#cat index.txt
R 171024094451Z 170716112929Z 01 unknown /C=CN/ST=BeiJing/O=ffu/OU=cs/CN=ffu <--R代表removed
