4.2. 创建证书颁发机构

使用以下步骤创建证书颁发机构(CA)。

流程

  1. 输入以下命令生成 root CA 密钥:

    $ openssl genrsa -out rootCA.key 2048
  2. 输入以下命令生成 root CA 证书:

    $ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
  3. 输入将合并到证书请求中的信息,包括服务器主机名,例如:

    Country Name (2 letter code) [XX]:IE
    State or Province Name (full name) []:GALWAY
    Locality Name (eg, city) [Default City]:GALWAY
    Organization Name (eg, company) [Default Company Ltd]:QUAY
    Organizational Unit Name (eg, section) []:DOCS
    Common Name (eg, your name or your server's hostname) []:quay-server.example.com

4.2.1. 签名证书

使用以下步骤为证书签名。

流程

  1. 输入以下命令生成服务器密钥:

    $ openssl genrsa -out ssl.key 2048
  2. 输入以下命令生成签名请求:

    $ openssl req -new -key ssl.key -out ssl.csr
  3. 输入将合并到证书请求中的信息,包括服务器主机名,例如:

    Country Name (2 letter code) [XX]:IE
    State or Province Name (full name) []:GALWAY
    Locality Name (eg, city) [Default City]:GALWAY
    Organization Name (eg, company) [Default Company Ltd]:QUAY
    Organizational Unit Name (eg, section) []:DOCS
    Common Name (eg, your name or your server's hostname) []:quay-server.example.com
  4. 创建配置文件 openssl.cnf,指定服务器主机名,例如:

    openssl.cnf

    [req]
    req_extensions = v3_req
    distinguished_name = req_distinguished_name
    [req_distinguished_name]
    [ v3_req ]
    basicConstraints = CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    subjectAltName = @alt_names
    [alt_names]
    DNS.1 = quay-server.example.com
    IP.1 = 192.168.1.112

  5. 使用配置文件生成证书 ssl.cert

    $ openssl x509 -req -in ssl.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ssl.cert -days 356 -extensions v3_req -extfile openssl.cnf