CA

#cd /etc/pki/CA
#touch index.txt serial
#echo 01 > serial
#(umask 077; openssl genrsa -out private/cakey.pem 2048)
#vim /etc/pki/tls/openssl.cnf

#openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Shandong]:
Locality Name (eg, city) [Qingdao]:
Organization Name (eg, company) [LIMEXC]:
Organizational Unit Name (eg, section) [Tech]:
Common Name (eg, your name or your server's hostname) []:ca.720.com
Email Address []:admin@720.com

WEB

#(umask 077; openssl genrsa 1024 > httpd.key)
#openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [Shandong]:Shandong
Locality Name (eg, city) [Qingdao]:Qingdao
Organization Name (eg, company) [LIMEXC]:LIMEXC
Organizational Unit Name (eg, section) [Tech]:Tech
Common Name (eg, your name or your server's hostname) []:www.720.com
Email Address []:xian@720.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

#scp httpd.csr 172.16.0.134:/tmp/ 将证书发送至CA

CA

#openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jan 27 22:12:13 2018 GMT
Not After : Jan 25 22:12:13 2028 GMT
Subject:
countryName = CN
stateOrProvinceName = Shandong
organizationName = LIMEXC
organizationalUnitName = Tech
commonName = www.720.com
emailAddress = xian@720.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
2C:D3:94:C0:AD:01:63:3F:4C:34:DB:4F:3C:8F:4C:46:7F:CE:1B:15
X509v3 Authority Key Identifier:
keyid:9E:1E:CE:67:EE:78:09:B3:E1:B4:E3:71:70:82:D7:01:80:51:04:55
Certificate is to be certified until Jan 25 22:12:13 2028 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

#scp httpd.crt 172.16.0.132:/etc/httpd/ssl/ 将证书发送回WEB

WEB

#vim ssl.conf
在web端配置证书，测试。

将cacert.pem拷贝到客户端，修改后缀为crt。将证书导入。