| [SuSE9.3/CentOS4.x] # export PATH=/usr/share/ssl/misc:$PATH [FedoraCore5] # export PATH=/etc/pki/tls/misc:$PATH# |
[ usr_cert ] ( snip ) # �ŏ��ɃT�[�o�ؖ������쐬���邽�߁A�unsCertType�v���userver�v # �Ƃ��邽�߁A�R�����g�A�E�g���O���ėL���ɂ���B # This is OK for an SSL server. # nsCertType = server nsCertType = server ( snip ) [ v3_ca ] ( snip ) # CA�ؖ����쐬���̏ؖ����̃^�C�v��SSL/E-mail�p�Ǝw�肷�邽�߁A #�unsCertType�v���usslCA, emailCA�v�Ƃ��邽�߁A�R�����g�A�E�g���O���ėL���ɂ���B # Some might want this also # nsCertType = sslCA, emailCA nsCertType = sslCA, emailCA |
|
|
|
|
|
|
( snip ) #$CATOP="../../CA"; $CATOP="./demoCA"; $CAKEY="cakey.pem"; $CAREQ="careq.pem"; $CACERT="cacert.pem"; ( snip ) |
| # mkdir /usr/local/certs |
# CA.pl -newca
CA certificate filename (or enter to create)
[Enter]�����
Making CA certificate ...
Generating a 1024 bit RSA private key
.................++++++
.................++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:xxxxx[Enter]�@�@�@�@�@ �@�@�@ �� CA�p�p�X�t���[�Y����(��ʏ㉽���ω��͂Ȃ�����������Ă���)
Verifying - Enter PEM pass phrase:xxxxx[Enter]�@�@�� CA�p�p�X�t���[�Y���
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP[Enter]�@(���R�[�h)
State or Province Name (full name) [Berkshire]:Tokyo[Enter]�@(�s���{����)
Locality Name (eg, city) [Newbury]:Edogawa[Enter]�@(�s������)
Organization Name (eg, company) [My Company Ltd]:Private_CA[Enter]�@(�g�D��)
Organizational Unit Name (eg, section) []:Admin[Enter]�@(�g�D�����j�b�g��)
Common Name (eg, your name or your server's hostname) []:Private_CA[Enter]�@(�g�D/�T�[�o��)
Email Address []:[email protected][Enter] (�Ǘ��҃��[���A�h���X)
------------------------�ȉ���0.9.8x�̏ꍇ--------------------------------
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:[Enter]�̂ݓ���
An optional company name []:[Enter]�̂ݓ���
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@�@�� CA�p�p�X�t���[�Y����
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
b9:27:18:0b:ac:12:d7:b0
Validity
Not Before: May 24 12:02:37 2006 GMT
Not After : May 23 12:02:37 2009 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
organizationName = Private_CA
organizationalUnitName = Admin
commonName = Private_CA
emailAddress = [email protected]
X509v3 extensions:
X509v3 Subject Key Identifier:
B6:F1:C9:30:A8:E5:23:AE:B6:DA:16:F3:9D:7B:FC:CD:D1:2C:22:17
X509v3 Authority Key Identifier:
keyid:B6:F1:C9:31:A8:E5:23:AE:B6:DA:15:E3:91:7B:E3:CD:21:2C:22:17
DirName:/C=JP/ST=Tokyo/O=Private_CA/OU=Admin/CN=Private_CA/[email protected]
serial:B9:27:18:0B:AC:12:D7:B0
X509v3 Basic Constraints:
CA:TRUE
Netscape Cert Type:
SSL CA, S/MIME CA
Certificate is to be certified until May 23 12:02:37 2009 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
�@/usr/local/certs [ ���[�g�f�B���N�g���@�n
�@�@�@�@�b
�@�@�@�@�� demoCA �m �e��ؖ������̃��[�g�f�B���N�g�� ]
�@ �@�@�@�@�b
�@�@ �@�@�@�� certs [ �ؖ������̃f�B���N�g��(�o�b�N�A�b�v�ɗ��p) ]
�@�@�@ �@�@�b
�@�@ �@�@�@�� crl [ �j���ؖ����ꗗ�p�̃f�B���N�g�� ]
�@�@ �@�@�@�b
�@�@ �@�@�@�� newcerts [ �N���C�A���g�ؖ���(sireal�ǔ�)�̃f�B���N�g�� ]
�@�@�@�@�@�b �@�b
�@�@�@�@�@�b �@�� xxxxx..pem [ �N���C�A���g�ؖ��� ]
�@�@�@�@�@�b �@�b :
�@�@�@�@�@�b �@�� xxxxx..pem [ �N���C�A���g�ؖ��� ]
�@�@�@�@�@�b
�@ �@ �@�@�@�� private [ CA�p�̔閧���p�f�B���N�g�� ]
�@�@ �@�@�@�b �@�b
�@�@�@�@�@�b �@�� cakey.pem [ CA�p�̔閧�� ]
�@�@�@�@�@�b
�@�@�@�@�@�� cacert.pem [ CA�p�̏ؖ��� ]
�@ �@�@�@�@�� index.txt [ �N���C�A���g�ؖ����pDB ]
�@�@ �@�@�@�� serial [ �N���C�A���g�ؖ����p�V���A�� ]
# openssl x509 -in ./demoCA/cacert.pem -out ./demoCA/cacert.crt
# openssl x509 -inform pem -in ./demoCA/cacert.pem -outform der -out ./demoCA/ca.der
# CA.pl -newreq-nodes
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.........++++++
..............++++++
writing new private key to 'newkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP[Enter] (���R�[�h)
State or Province Name (full name) Some-State]:Tokyo[Enter] (�s���{����)
Locality Name (eg, city) []:Edogawa[Enter] (�s������)
Organization Name (eg, company) [Internet Widgits Pty Ltd]:aconus.com[Enter] (�g�D��)
Organizational Unit Name (eg, section) []:Admin[Enter] (�g�D�����j�b�g��)
Common Name (eg, your name or your server's hostname) []:www.aconus.com[Enter] (�z�X�g���F*)
Email Address []:[email protected][Enter] (�Ǘ��҃��[���A�h���X)
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:[Enter] �@�@�@�@ �@�@�� Enter�̂ݓ���
An optional company name []:[Enter]�@�@ �@ �@�� Enter�̂ݓ���
Request is in newreq.pem, private key is in newkey.pem
�@�@�@�@�@�@*�F�@�����̃z�X�g���́A�K��https://�E�E�E�E���A�A�N�Z�X���鎞�̃z�X�g���Ƃ��邱�ƁB
# openssl rsa -in newreq.pem -out newkey.pem
# CA.pl -sign
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@�@�� CA�p�p�X�t���[�Y����
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
b9:27:18:0b:ac:12:d7:b1
Validity
Not Before: May 24 12:05:30 2006 GMT
Not After : May 24 12:05:30 2007 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
localityName = Edogawa
organizationName = aconus.com
organizationalUnitName = Admin
commonName = www.aconus.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Server
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
FA:CF:7E:2C:F7:DA:81:38:3D:C4:ED:5E:50:D5:52:8A:EF:F6:EB:8A
X509v3 Authority Key Identifier:
keyid:B6:F1:C9:30:A8:E5:22:AE:B6:DA:16:E3:9D:7B:EC:CD:21:2C:22:17
Certificate is to be certified until May 24 12:05:30 2007 GMT (365 days)
Sign the certificate? [y/n]:y[Enter]
1 out of 1 certificate requests certified, commit? [y/n]y[Enter]
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem
# openssl x509 -in newcert.pem -out server.crt
# (cat server.crt ; cat newkey.pem) > mail.pem
# mkdir server
# mv *.pem server
# mv *.key server
# mv *.crt server
[ usr_cert ]
( snip )
# �T�[�o�ؖ����쐬�p����N���C�A���g�ؖ����p�ɁA�unsCertType�v��
#�unsCertType�v�� �ύX����B�R�����g�A�E�g���O�����userver�v���폜���A
#�uclient, email�v�̃R�����g�A�E�g���O���ėL���ɂ���B
# This is OK for an SSL server.
# nsCertType = server�@(���ɖ߂�)
( snip )
# For normal client use this is typical
# nsCertType = client, email
nsCertType = client, email
# CA.pl -newreq
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
........+++++
......................................+++++
writing new private key to 'newreq.pem'
Enter PEM pass phrase:xxxxx[Enter]�@�@�@�@�@ �@�@ �� �N���C�A���g�p�p�X�t���[�Y����
Verifying - Enter PEM pass phrase:xxxxx[Enter]�@�@�� �N���C�A���g�p�p�X�t���[�Y���
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP[Enter]�@(���R�[�h)
State or Province Name (full name) [Berkshire]:Tokyo[Enter]�@(�s���{����)
Locality Name (eg, city) [Newbury]:Edogawa[Enter]�@(�s������)
Organization Name (eg, company) [My Company Ltd]:aconus.com[Enter]�@(�g�D��)
Organizational Unit Name (eg, section) []:user[Enter]�@(�g�D�����j�b�g��)
Common Name (eg, your name or your server's hostname) []:oyaji[Enter]�@(���[�U��)
Email Address []:[email protected][Enter] (�Ǘ��҃��[���A�h���X)
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:[Enter] �@�@�@�@�@�@�@�@�@�� Enter�̂ݓ���
An optional company name []:[Enter]�@�@�@�@�@�@ �@�� Enter�̂ݓ���
Request is in newreq.pem, private key is in newkey.pem
# CA.pl -sign
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@ �� CA�p�p�X�t���[�Y����
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
b9:27:18:0b:ac:12:d7:b2
Validity
Not Before: May 24 12:17:22 2006 GMT
Not After : May 24 12:17:22 2007 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
localityName = Edogawa
organizationName = aconus.com
organizationalUnitName = user
commonName = oyaji
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Client, S/MIME
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
BB:2E:30:29:52:F6:98:D5:24:27:1C:A9:BE:4D:22:E9:DD:AE:58:31
X509v3 Authority Key Identifier:
keyid:B6:F1:C9:30:A8:E5:22:AE:B6:DA:16:E3:9D:7B:EC:CD:21:2C:22:17
Certificate is to be certified until May 24 12:17:22 2007 GMT (365 days)
Sign the certificate? [y/n]:y[Enter]
1 out of 1 certificate requests certified, commit? [y/n]y[Enter]
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem
V 051003025313Z FB4C837477EB7B41 unknown /C=JP/ST=Tokyo/L=Edogawa/O=Acorn/OU=user/CN=oyaji/[email protected]
# CA.pl -pkcs12 oyaji
Loading 'screen' into random state - done
Enter pass phrase for newreq.pem:xxxxx�@�� �N���C�A���g�p�p�X�t���[�Y����
Enter Export Password:xxxxx�@�@�@�@�@ �� Export�p�p�X�t���[�Y����
Verifying - Enter Export Password:xxxxx �� Export�p�p�X�t���[�Y����
PKCS #12 file is in newcert.p12
# mkdir ./demoCA/certs/oyaji
# mv new* ./demoCA/certs/oyaji
# mv *.p12 ./demoCA/certs/oyaji
R 051003025313Z 041003031948Z FB4C837477EB7B41 unknown /C=JP/ST=Tokyo/L=Edogawa/O=Acorn/OU=user/CN=oyaji/[email protected]
# openssl ca -gencrl -revoke ./demoCA/certs/oyaji/newcert.pem -out ./demoCA/crl/crl.pem
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx�@�@ �� CA�p�p�X�t���[�Y����
Revoking Certificate b9:27:18:0b:ac:12:d7:b2.
Data Base Updated
�����������ʓ|�Ȃ̂ŁArevoke�I�v�V������lj������B��Lpkcs12�ŃN���C�A���g�ؖ������쐬�������Ƃ��O��ƂȂ�Auser�����w�肷�邱�ƂŎ��������Ǝ������X�g�̍X�V���s���B
# CA2.pl -pkcs12 oyaji
Enter pass phrase for newkey.pem:xxxxx[Enter]�@�@�@ �� �N���C�A���g�p�p�X�t���[�Y����
Enter Export Password:xxxxx[Enter]�@�@�@�@�@ �@ �� Export�p�p�X�t���[�Y����
Verifying - Enter Export Password:xxxxx[Enter]�@ �@ �� Export�p�p�X�t���[�Y����
PKCS #12 file is in oyaji.p12
# CA2.pl -revoke oyaji
Using configuration from /etc/pki/tls/openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@�@ �� CA�p�p�X�t���[�Y����
Revoking Certificate b927180bac12d7b2.
Data Base Updated