Создание сертификатов с помощью OpenSSL

  1. Создание gencert.cnf:

####################################################################
{empty}[ ca ]
default_ca = CA_default # The default ca section
####################################################################
{empty}[ CA_default ]
x509_extensions = usr_cert # The extentions to add to the cert
default_days = 1 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = default # which md to use.
preserve = no # keep passed DN ordering
####################################################################
{empty}[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert
string_mask = nombstr
req_extensions = v3_req # The extensions to add to a certificate request
{empty}[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = RU
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
localityName = Locality Name (eg, city)
0.organizationName = Organization Name (eg, company)
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (eg, your name or your server's hostname)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 40
{empty}[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
unstructuredName = An optional company name
{empty}[ usr_cert ]
basicConstraints=CA:FALSE
nsCertType = client, server
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
{empty}[ server_cert ]
basicConstraints=CA:FALSE
nsCertType = server
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
#crlDistributionPoints=URI:http://127.0.0.1/crl.pem
{empty}[ client_cert ]
basicConstraints=CA:FALSE
nsCertType = client
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
{empty}[ v3_req ]
#Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsCertType = server, client
{empty}[ v3_ca ]
#Extensions for a typical CA
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = CA:true

  1. Генерация корневого сертификата и приватного ключа:

Выполните из директории с файлом gencert.cnf

openssl req -x509 -nodes -newkey rsa:2048 -keyout ca-key.pem -out ca-cert.pem -batch -subj "/CN=ALERTIX-WEF-CA/O=alertix/C=RU/ST=state/L=location" -config gencert.cnf
openssl x509 -outform der -in ca-cert.pem -out ca-cert.crt

  1. Генерация сертификата клиента вместе с PFX для последующего импорта в Windows certificate store на машине клиента:

Формат записи в CN alertix-client.company.local, где alertix-client - это hostname клиента, а company.local - домен.
openssl req -new -newkey rsa:2048 -nodes -keyout client-key.pem -out req.pem -batch -subj "/CN=alertix-client.company.local/O=alertix/C=RU/ST=state/L=location" -config gencert.cnf
openssl x509 -req -days 1024 -in req.pem -CA ca-cert.pem -CAkey ca-key.pem -out client-cert.pem -set_serial 01 -extensions client_cert -extfile gencert.cnf
rm -f req.pem
openssl pkcs12 -export -out client.pfx -inkey client-key.pem -in client-cert.pem -certfile ca-cert.pem

  1. Генерация сертификата WEC сервера:

Формат записи в CN alertix-server.company.local, где alertix-server - это hostname сервера, а company.local - домен.
openssl req -new -newkey rsa:2048 -nodes -keyout server-key.pem -out req.pem -batch -subj "/CN=alertix-server.company.local/O=alertix/C=RU/ST=state/L=location" -config gencert.cnf
openssl x509 -req -days 1024 -in req.pem -CA ca-cert.pem -CAkey ca-key.pem -out server-cert.pem -set_serial 01 -extensions server_cert -extfile gencert.cnf +
rm -f req.pem
openssl x509 -outform der -in server-cert.pem -out server-cert.crt