Openssl 如何创建自己的自签名根证书和要导入Java密钥库的中间CA？

如何创建自签名根证书和要导入Java密钥库的中间CA

我们将把它用于SSL和TLS，然后用于基于客户端证书的客户端身份验证

---

使用OpenSSL和KeyTool。

基于以下指南，特别感谢Jamie Nguyen制作的指南，使之成为可能，谢谢

按照上的指南执行以下操作：

• 安装Windows的OpenSSL：

• 将

  bin

  文件夹添加到环境变量

  PATH

• 为证书创建一个目录，我称之为

  cert test

• 将以下

  openssl.cfg

  数据用于[CA_default]标记：

这个

• 在

  cert\u test

  中创建目录：

  certs crl newcerts private

• 使用以下命令创建

根CA：

openssl genrsa -aes256 -out /etc/pki/CA/private/ca.key.pem 4096

openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/ca.key.pem -sha256 -extensions v3_ca -out /etc/pki/CA/certs/ca.cert.pem

• 创建文件夹

  intermediate

• 创建文件夹

  certs crl newcerts private

• 创建文件

  index.txt

• 创建文件

  serial

  并在其中写入一个数字，如

  1000

• 执行下列命令

命令：

openssl genrsa -aes256 -out intermediate/private/intermediate.key.pem 4096

openssl req -config intermediate/openssl.cfg -sha256 -new -key intermediate/private/intermediate.key.pem -out intermediate/certs/intermediate.csr.pem

openssl ca -keyfile private/ca.key.pem -cert certs/ca.cert.pem -extensions v3_ca -notext -md sha256 -in intermediate/certs/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem

• 使用创建链文件

cat

：

cat intermediate/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem

• 使用从链创建JKS文件

keytool

：

keytool -importkeystore -srckeystore ia.p12 -srcstoretype PKCS12 -destkeystore ia.jks

keytool -import -noprompt -trustcacerts -alias test_certificate -file ia.crt -keystore ia.jks -storepass helloworld

keytool -importcert -alias test_cert_ca -keystore "c:\Program Files\Java\jdk1.8.0\jre\lib\security\cacerts" -file ca.crt

keytool -importcert -alias test_cert_ia -keystore "c:\Program Files\Java\jdk1.8.0\jre\lib\security\cacerts" -file ia.crt

---

您可能需要将CA证书导入到ia.jks中。

对于任何想要生成链和多个证书的人来说，这只是一个附带说明。精炼@EpicPandaForce自己的答案，下面是一个脚本，它在

根CA/

中创建一个根CA，在

中间CA/

中创建一个中间CA，以及三个指向

out/

的证书，每个证书都用中间CA签名

#!/bin/bash -x

set -e

for C in `echo root-ca intermediate`; do

  mkdir $C
  cd $C
  mkdir certs crl newcerts private
  cd ..

  echo 1000 > $C/serial
  touch $C/index.txt $C/index.txt.attr

  echo '
[ ca ]
default_ca = CA_default
[ CA_default ]
dir            = '$C'                     # Where everything is kept
certs          = $dir/certs               # Where the issued certs are kept
crl_dir        = $dir/crl                 # Where the issued crl are kept
database       = $dir/index.txt           # database index file.
new_certs_dir  = $dir/newcerts            # default place for new certs.
certificate    = $dir/cacert.pem          # The CA certificate
serial         = $dir/serial              # The current serial number
crl            = $dir/crl.pem             # The current CRL
private_key    = $dir/private/ca.key.pem  # The private key
RANDFILE       = $dir/.rnd                # private random number file
nameopt        = default_ca
certopt        = default_ca
policy         = policy_match
default_days   = 365
default_md     = sha256

[ policy_match ]
countryName            = optional
stateOrProvinceName    = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[v3_req]
basicConstraints = CA:TRUE
' > $C/openssl.conf
done

openssl genrsa -out root-ca/private/ca.key 2048
openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'

openssl genrsa -out intermediate/private/intermediate.key 2048
openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=Interm.'
openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt

mkdir out

for I in `seq 1 3` ; do
  openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048
  openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request
done

---

我一定错过了什么。我不知道如何从“openssl”步骤中的pem文件获取“keytool”使用的“ca.crt”和“ia.crt”文件。@mnemotronic不幸的是，我在将近一年前写过这篇文章，我手头没有这些步骤，但不幸的是，我认为你是正确的。您需要使用私钥和证书（公钥）创建PKCS12密钥库文件。查看如何从pem文件创建密钥库，我认为如果您指定密钥库的类型和提供程序（我记得使用它使用bouncycastle提供程序创建BKS密钥库），Keytool可以做到这一点。为什么要向信任库添加中间证书（或任何

ia.crt

是什么）？根证书应该足够了，因为中间层由根签署，并且此信息存储在中间层通过扩展签署的所有证书中。即使在您提供的手册（jammielinux页面）中，也说明根证书应该足够了。您可以使用git获得OpenSSL二进制文件（以及大多数*nix实用程序……，这一切都使git成为一个可爱的turd）。

#!/bin/bash -x

set -e

for C in `echo root-ca intermediate`; do

  mkdir $C
  cd $C
  mkdir certs crl newcerts private
  cd ..

  echo 1000 > $C/serial
  touch $C/index.txt $C/index.txt.attr

  echo '
[ ca ]
default_ca = CA_default
[ CA_default ]
dir            = '$C'                     # Where everything is kept
certs          = $dir/certs               # Where the issued certs are kept
crl_dir        = $dir/crl                 # Where the issued crl are kept
database       = $dir/index.txt           # database index file.
new_certs_dir  = $dir/newcerts            # default place for new certs.
certificate    = $dir/cacert.pem          # The CA certificate
serial         = $dir/serial              # The current serial number
crl            = $dir/crl.pem             # The current CRL
private_key    = $dir/private/ca.key.pem  # The private key
RANDFILE       = $dir/.rnd                # private random number file
nameopt        = default_ca
certopt        = default_ca
policy         = policy_match
default_days   = 365
default_md     = sha256

[ policy_match ]
countryName            = optional
stateOrProvinceName    = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[v3_req]
basicConstraints = CA:TRUE
' > $C/openssl.conf
done

openssl genrsa -out root-ca/private/ca.key 2048
openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'

openssl genrsa -out intermediate/private/intermediate.key 2048
openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=Interm.'
openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt

mkdir out

for I in `seq 1 3` ; do
  openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048
  openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request
done