CA证书和密钥对的基本问题
1、在 CentOS7 中使用 gpg 创建 RSA 非对称密钥对
[root@centos7 ~]#gpg --gen-key gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) Requested keysize is 2048 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) Key does not expire at all Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: centos Email address: Comment: You selected this USER-ID: "centos" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O You need a Passphrase to protect your secret key. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: /root/.gnupg/trustdb.gpg: trustdb created gpg: key C8EA44DE marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u pub 2048R/C8EA44DE 2020-09-05 Key fingerprint = 3DE2 C6AF B0B5 0D82 79F8 770C EF64 9FA5 C8EA 44DE uid centos sub 2048R/13943D46 2020-09-05 [root@centos7 ~]#ll .gnupg/ total 28 -rw------- 1 root root 7680 Sep 5 18:55 gpg.conf drwx------ 2 root root 6 Sep 5 19:11 private-keys-v1.d -rw------- 1 root root 1166 Sep 5 19:14 pubring.gpg -rw------- 1 root root 1166 Sep 5 19:14 pubring.gpg~ -rw------- 1 root root 600 Sep 5 19:14 random_seed -rw------- 1 root root 2543 Sep 5 19:14 secring.gpg srwxr-xr-x 1 root root 0 Sep 5 19:14 S.gpg-agent -rw------- 1 root root 1280 Sep 5 19:14 trustdb.gpg [root@centos7 ~]#gpg --list-key /root/.gnupg/pubring.gpg ------------------------ pub 2048R/C8EA44DE 2020-09-05 uid centos sub 2048R/13943D46 2020-09-05
2、将 CentOS7 导出的公钥，拷贝到 CentOS8 中，在 CentOS8 中使用 CentOS7 的公钥加密一个文件
[root@centos7 ~]#gpg -a --export -o centos.pubkey [root@centos7 ~]#scp centos.pubkey 10.0.0.8:/data/ root@10.0.0.8's password: centos.pubkey 100% 1683 1.4MB/s 00:00 [root@centos8 data]#ls centos.pubkey [root@centos8 data]#echo linux > file.txt [root@centos8 data]#gpg --import centos.pubkey gpg: key EF649FA5C8EA44DE: public key "centos" imported gpg: Total number processed: 1 gpg: imported: 1 [root@centos8 data]#gpg --list-key /root/.gnupg/pubring.kbx ------------------------ pub rsa2048 2020-09-05 [SC] 3DE2C6AFB0B50D8279F8770CEF649FA5C8EA44DE uid [ unknown] centos sub rsa2048 2020-09-05 [E] [root@centos8 data]#gpg -e -r centos file.txt gpg: 8314610013943D46: There is no assurance this key belongs to the named user sub rsa2048/8314610013943D46 2020-09-05 centos Primary key fingerprint: 3DE2 C6AF B0B5 0D82 79F8 770C EF64 9FA5 C8EA 44DE Subkey fingerprint: E190 BD7D CFF2 4D26 8206 CF0E 8314 6100 1394 3D46 It is NOT certain that the key belongs to the person named in the user ID. If you *really* know what you are doing, you may answer the next question with yes. Use this key anyway? (y/N) y [root@centos8 data]#ls centos.pubkey file.txt file.txt.gpg
3、回到 CentOS7 服务器，远程拷贝 file.txt.gpg 文件到本地，使用 CentOS7的私钥解密文件
[root@centos7 ~]#scp 10.0.0.8:/data/file.txt.gpg /data/ root@10.0.0.8's password: file.txt.gpg 100% 346 225.7KB/s 00:00 [root@centos7 data]#ls file.txt.gpg [root@centos7 data]#gpg -o file.txt -d file.txt.gpg You need a passphrase to unlock the secret key for user: "centos" 2048-bit RSA key, ID 13943D46, created 2020-09-05 (main key ID C8EA44DE) gpg: encrypted with 2048-bit RSA key, ID 13943D46, created 2020-09-05 "centos" [root@centos7 data]#cat file.txt linux
4、在 CentOS7 中使用 openssl 软件创建 CA
[root@centos7 pki]#cd /etc/pki/CA/ [root@centos7 CA]#ls certs crl newcerts private [root@centos7 CA]#touch index.txt [root@centos7 CA]#echo 01 > serial [root@centos7 CA]#tree . ├── certs ├── crl ├── index.txt ├── newcerts ├── private └── serial 4 directories, 2 files [root@centos7 CA]#(umask 066; openssl genrsa -out private/cakey.pem 4096) Generating RSA private key, 4096 bit long modulus .....................................................................++ .++ e is 65537 (0x10001) [root@centos7 CA]#openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:bj Locality Name (eg, city) [Default City]:bj Organization Name (eg, company) [Default Company Ltd]:magedu Organizational Unit Name (eg, section) []:M42 Common Name (eg, your name or your server's hostname) []:ca.magedu.com Email Address []: [root@centos7 CA]#tree . ├── cacert.pem ├── certs ├── crl ├── index.txt ├── newcerts ├── private │ └── cakey.pem └── serial 4 directories, 4 files [root@centos7 CA]#openssl x509 -in cacert.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 93:cc:7f:8a:ad:90:9a:61 Signature Algorithm: sha256WithRSAEncryption Issuer: C=CN, ST=bj, L=bj, O=magedu, OU=M42, CN=ca.magedu.com Validity Not Before: Sep 5 11:49:19 2020 GMT Not After : Sep 3 11:49:19 2030 GMT Subject: C=CN, ST=bj, L=bj, O=magedu, OU=M42, CN=ca.magedu.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:9c:e8:9a:c9:2d:4d:52:78:68:0d:3f:b2:d9:21: d6:eb:9e:1d:25:02:4e:f2:3d:dc:a5:a7:dc:6f:70: e2:aa:37:1e:44:41:28:60:d5:7c:ae:2c:8d:55:95: 86:05:4d:db:a5:ad:a2:fb:66:b0:ff:e4:20:72:ab: b6:b4:2b:ae:1d:d9:ff:97:6a:3b:58:48:a8:31:51: b5:46:67:c3:7d:f9:4e:41:ea:a8:b0:08:91:4c:4b: 88:9c:8d:38:9c:c0:ce:c1:51:7b:5e:5d:a2:f7:ba: 61:7d:85:51:a4:e9:b2:cf:84:8b:36:b0:10:10:b9: 37:ee:51:1e:1e:b7:b0:31:68:4b:c7:dc:93:37:8a: 76:e3:66:86:d8:f7:f1:55:b6:d6:63:5b:c2:44:71: f5:c6:6e:b5:c3:ea:5a:f9:19:04:8a:44:2a:0a:ea: 0f:ff:3b:2d:a0:61:fe:7c:c3:45:18:16:05:44:8c: 90:fc:6f:fc:9a:ae:b3:16:3a:01:44:4b:4b:95:83: 56:89:72:02:17:1a:be:31:9c:75:ce:42:f3:c3:d9: b1:ab:e4:26:4f:ff:30:ce:5c:0b:de:f8:12:63:5d: 5f:29:47:61:3c:db:a3:c4:37:4f:64:0f:8d:94:9b: bb:17:56:2f:b4:8d:b2:a0:5f:ca:cc:81:90:58:d4: 08:c7:82:36:f0:f4:60:bc:e3:5d:c7:48:a0:0c:b5: 23:a3:90:f1:44:c8:80:99:20:26:9e:4c:d7:0b:bf: 85:e5:e5:93:fd:da:ae:39:b2:ff:f2:2f:e6:fd:87: 07:27:31:79:63:ac:a1:4c:9d:b0:30:7a:1f:70:b9: a1:ca:b6:3f:e3:4b:01:6d:71:c2:b4:3a:71:0b:94: 33:78:20:85:ec:9b:2d:18:25:73:0e:b0:2f:57:a9: 96:9f:5e:45:e7:36:4b:8f:76:82:89:8f:72:13:12: 1b:c4:80:06:92:52:f5:cd:2c:4a:cb:bc:e4:d5:04: 39:a6:8a:2c:90:ae:a3:a3:8b:5b:2b:79:69:bc:5a: 55:67:7f:40:ed:65:46:b9:be:ad:32:08:24:14:ea: a9:0f:4b:78:71:2f:48:ba:d3:d0:fd:1b:56:16:da: 1e:8d:48:bb:9b:8d:29:ea:b9:81:86:c5:26:46:c8: f3:d3:d3:21:19:2c:08:dd:3c:f5:49:c2:cd:34:7a: 7c:58:57:8e:04:74:48:4f:17:9f:1b:c1:6c:c4:7f: b8:ec:fa:00:8c:6e:e6:6d:9d:54:69:16:aa:53:6d: f9:4e:2a:31:60:07:bd:98:f9:42:ad:f0:d9:21:0a: d9:a6:d3:e8:0e:6e:97:7f:ab:67:13:f1:e2:7c:aa: 3f:4f:17 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 80:AA:D3:C7:05:37:57:44:2E:7E:26:19:7A:76:02:47:F6:47:FD:6C X509v3 Authority Key Identifier: keyid:80:AA:D3:C7:05:37:57:44:2E:7E:26:19:7A:76:02:47:F6:47:FD:6C X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption 60:67:2f:a8:6d:15:3d:d2:5b:21:0e:e0:80:02:35:6e:40:4a: 85:a2:31:26:6c:e0:8b:0d:10:53:b8:4c:25:46:78:dd:e6:41: 03:dd:b1:91:1a:96:56:3a:bf:0b:8c:16:98:b8:21:44:71:a2: 5c:5d:49:55:34:cb:74:58:84:21:ba:ea:75:d7:4c:f5:f1:d7: 76:a2:53:56:26:1b:88:dc:b7:4b:28:18:34:9b:4c:56:dc:ed: a9:e4:2a:33:dd:93:09:c6:43:bf:67:22:7a:7b:fe:a5:21:1c: 71:67:75:83:64:62:7f:b3:d0:2d:4f:ab:42:f8:95:91:01:fe: 71:77:36:9d:37:12:ef:39:93:f9:56:68:da:69:09:9a:50:f1: 87:af:ab:5b:37:39:7a:27:69:98:a6:c5:c2:61:17:1c:b7:fe: fe:b6:5e:e9:10:fb:34:fa:55:72:88:ff:20:6e:40:fd:ba:d7: 7f:56:f9:8b:4d:cd:96:85:2a:6c:88:51:d5:f6:a3:70:b9:a2: 9f:fd:a1:6d:57:48:00:dc:cd:fe:e0:31:d7:67:2b:ce:88:b1: 4c:dd:49:ef:03:f3:9e:1e:b9:be:73:82:7c:aa:a2:06:d6:48: 66:7a:da:84:df:bb:03:9b:41:b3:1b:f2:12:7d:75:a6:12:7f: b8:f6:58:06:e0:f1:94:6c:ab:42:c6:d5:98:f1:03:3e:5e:14: a8:f3:ad:c5:37:df:fe:21:24:62:d4:21:86:d9:0a:ea:d4:07: 49:b6:82:a6:67:70:7e:f4:7f:ed:f9:1d:07:86:41:48:3f:e1: a9:e0:07:fe:63:5a:eb:fd:92:c7:16:d2:d0:3f:15:98:57:03: f2:cc:0b:58:5f:00:19:c3:4e:df:40:d7:07:10:de:f5:5c:a9: 73:c2:83:03:78:31:92:68:5a:8d:7b:d8:00:8f:99:39:ec:0f: 19:5f:7a:ae:c6:85:e5:2c:12:f7:ed:4a:f4:20:b9:15:48:b9: cc:c0:f2:1c:1c:31:3d:82:38:f2:b7:e0:02:94:c2:de:ba:70: bb:6e:94:d9:58:5a:24:2d:17:44:2b:cf:ac:f4:e5:b2:ca:e4: 7a:2b:af:c2:6a:70:53:34:91:ae:12:66:12:8b:fa:21:03:4d: 18:5f:71:67:f0:04:cc:27:1a:b6:3d:61:cc:e0:b8:fb:14:05: a6:26:f9:44:95:7a:d4:0e:32:fb:5e:38:ea:52:6f:f5:dc:8e: 25:22:c7:e7:94:22:5f:d2:1c:ac:05:d6:30:68:6f:ee:a3:96: 72:c3:09:52:88:c1:4a:d8:30:3b:05:80:cd:ad:89:7e:89:a8: 80:d3:bf:76:59:21:40:4e
5、 在 CentOS7 中使用 openssl 软件创建一个证书申请请求文件，并使用上面的跟证书对其进行签署
[root@centos7 CA]#mkdir /data/app [root@centos7 CA]#(umask 066; openssl genrsa -out /data/app/app.key 1024) Generating RSA private key, 1024 bit long modulus ....++++++ .................................++++++ e is 65537 (0x10001) [root@centos7 CA]#openssl req -new -key /data/app/app.key -out /data/app/app.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:bj Locality Name (eg, city) [Default City]:bj Organization Name (eg, company) [Default Company Ltd]:magedu Organizational Unit Name (eg, section) []:app Common Name (eg, your name or your server's hostname) []:app.magedu.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@centos7 CA]#openssl ca -in /data/app/app.csr -out /etc/pki/CA/app.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Sep 5 11:59:03 2020 GMT Not After : Sep 5 11:59:03 2021 GMT Subject: countryName = CN stateOrProvinceName = bj localityName = bj organizationName = magedu organizationalUnitName = app commonName = app.magedu.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 9B:DD:AE:3A:59:B7:8E:1D:70:65:17:86:18:5C:46:D7:B0:2E:E1:81 X509v3 Authority Key Identifier: keyid:80:AA:D3:C7:05:37:57:44:2E:7E:26:19:7A:76:02:47:F6:47:FD:6C Certificate is to be certified until Sep 5 11:59:03 2021 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@centos7 CA]#tree . ├── app.crt ├── app.csr ├── cacert.pem ├── certs ├── crl ├── index.txt ├── index.txt.attr ├── index.txt.old ├── newcerts │ └── 01.pem ├── private │ └── cakey.pem ├── serial └── serial.old 4 directories, 10 files [root@centos7 CA]#openssl x509 -in app.crt -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C=CN, ST=bj, L=bj, O=magedu, OU=M42, CN=ca.magedu.com Validity Not Before: Sep 5 11:59:03 2020 GMT Not After : Sep 5 11:59:03 2021 GMT Subject: C=CN, ST=bj, L=bj, O=magedu, OU=app, CN=app.magedu.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: 00:ad:0c:b4:cc:e1:e2:63:cb:ff:c4:25:47:26:1c: d3:e6:ce:03:94:ae:61:38:d1:d8:ac:cf:f4:16:60: cd:e9:8c:b3:43:25:a3:2e:de:26:92:33:a6:eb:53: ea:13:61:df:0a:62:76:2c:46:35:37:04:de:a4:f9: cc:58:20:fe:86:fd:97:b7:54:61:1f:32:86:e4:c6: 47:0d:1f:fa:0a:55:47:b1:2d:ea:52:15:40:e7:c7: 5d:a5:ab:93:97:4c:98:9d:b6:e9:f2:af:1e:95:4c: 67:69:58:4c:e5:a9:01:22:78:5c:14:9c:5f:aa:93: ff:27:f8:79:b5:69:e9:6e:97 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 9B:DD:AE:3A:59:B7:8E:1D:70:65:17:86:18:5C:46:D7:B0:2E:E1:81 X509v3 Authority Key Identifier: keyid:80:AA:D3:C7:05:37:57:44:2E:7E:26:19:7A:76:02:47:F6:47:FD:6C Signature Algorithm: sha256WithRSAEncryption 78:db:3c:9d:bc:60:f2:0b:2a:b7:ec:7c:c9:95:e0:e6:ef:5c: b8:67:f2:62:81:b9:22:fb:33:19:12:4e:66:2c:96:4d:6e:79: a9:d5:fd:c0:34:d9:b1:9c:82:0a:79:77:fc:d0:a6:cd:f9:88: b7:6a:77:e2:a1:33:1d:94:3c:37:4c:d7:4c:cd:ae:79:a6:c9: 6f:4b:d3:70:c6:5c:19:8f:38:68:f2:13:7b:56:42:a0:fd:01: 85:23:64:b3:48:e1:6f:2d:ab:ea:b4:67:ab:1a:94:47:e1:ca: 47:77:55:e8:e3:fb:a7:4c:02:56:e5:8c:03:0d:a0:d1:2b:c8: 27:e7:8e:c4:26:9b:fb:43:38:df:2b:5b:c5:81:65:87:f5:4a: 5a:43:ca:e3:ee:64:83:20:37:2f:5d:6e:e3:e0:5b:c0:9c:d8: bb:04:49:3e:95:2c:30:f5:0e:03:b1:ab:bb:70:7d:17:22:1a: a0:1c:f1:62:4f:f5:f4:df:f4:09:90:6e:41:9d:f3:e6:6d:45: e6:9a:14:f3:65:71:13:2a:44:84:71:71:c2:d8:3d:45:f1:37: 33:3c:d0:4f:55:9e:1e:8e:db:98:e5:58:23:90:95:d3:00:ae: e2:de:81:e5:2f:49:d0:2b:a1:fe:51:12:31:56:12:6c:9e:9d: 68:f5:1f:e3:d1:64:08:29:bb:de:01:9e:94:67:f0:57:3e:8c: 6c:99:b0:f8:44:b9:97:c7:d6:6b:84:36:fb:16:97:fe:b2:09: e3:ea:e8:44:cd:86:17:b5:1e:3b:7b:3d:39:b5:41:38:4a:e5: da:22:fb:76:b3:d6:93:f7:0a:ab:2f:5a:cf:8c:72:ef:0c:04: a6:8a:76:73:c7:41:62:83:be:6a:a8:30:42:ec:54:d5:25:48: 27:e9:90:0a:4a:43:c1:53:54:e5:c3:a0:a2:39:eb:bf:9d:06: a5:60:ff:06:b2:d0:8d:51:38:8b:a1:ba:96:d8:9e:3c:95:55: 30:d5:df:b5:3a:66:26:a1:30:77:a8:1b:72:bb:23:93:de:30: ba:f1:f4:56:a5:39:76:22:d0:e2:f0:9b:aa:ac:7b:63:a8:dd: 8e:9b:d1:60:77:99:fe:5e:c5:95:d4:f9:1c:a3:75:28:58:db: 16:de:fc:dc:ad:be:0a:97:6a:85:38:d1:a2:30:ab:7c:cd:3b: 41:72:02:0f:9e:a3:51:f1:2d:10:64:44:d0:df:77:f0:a5:e9: d9:23:32:62:51:9a:ea:28:03:59:e1:81:f0:d4:3e:0a:e4:be: f6:eb:55:65:a5:66:7f:af:6f:e0:94:30:b8:22:c9:94:1d:a3: a1:e1:e6:97:20:7b:8d:0a
6、吊销已经签署成功的证书
[root@centos7 CA]#cat index.txt V 210905115903Z 01 unknown /C=CN/ST=bj/L=bj/O=magedu/OU=app/CN=app.magedu.com [root@centos7 CA]#openssl ca -status 01 Using configuration from /etc/pki/tls/openssl.cnf 01=Valid (V) [root@centos7 CA]#openssl ca -revoke newcerts/01.pem Using configuration from /etc/pki/tls/openssl.cnf Revoking Certificate 01. Data Base Updated [root@centos7 CA]#openssl ca -status 01 Using configuration from /etc/pki/tls/openssl.cnf 01=Revoked (R)
浙公网安备 33010602011771号