1.2. Initialize RSA Root CA
该文章根据 CC-BY-4.0 协议发表，转载请遵循该协议。
本文地址：https://fenying.net/en/book/pki-tutorials/1.2.generate-rsa-ca-root/
This chapter describes how to generate a root CA with RSA key, using OpenSSL command-line tools.
Initialize Working Directory
Assuming the working directory of the RSA CA is /data/ca/RSA/Root, let’s begin by executing the following script:
1export MY_CA_WORKDIR=/data/ca
2mkdir -p $MY_CA_WORKDIR
3
4MY_CA_ROOT_DIR=$MY_CA_WORKDIR/RSA/Root
5
6mkdir -p $MY_CA_ROOT_DIR
7
8cd $MY_CA_ROOT_DIR
9
10MY_CA_RAND_FILE=$MY_CA_ROOT_DIR/.rand
11
12mkdir -p issued_certs crl
13touch index.txt
14
15openssl rand -out $MY_CA_RAND_FILE 65535
16md5sum $MY_CA_RAND_FILE | grep -Po '^\w+' > serial
17
18openssl rand -out $MY_CA_RAND_FILE 1048576
Generate RSA private key for the root CA
1MY_CA_ROOT_KEY_PATH=$MY_CA_ROOT_DIR/key.pem
2
3openssl genrsa \
4 -rand $MY_CA_RAND_FILE \
5 -aes-256-cfb \
6 -out $MY_CA_ROOT_KEY_PATH \
7 4096 # 4096-bit RSA private key for a root CA is secure enough
Generate Certificate Signing Request (CSR) File
Firstly, let’s create a text file named req.cnf as a draft for the certificate signing request (CSR),
which describes the detailed information of the certificate to be applied for.
You can replace the content of
req_distinguished_namesection with your own information.
1MY_CA_ROOT_REQ_PATH=$MY_CA_ROOT_DIR/req.cnf
2
3cat > $MY_CA_ROOT_REQ_PATH << EOL
4[ req ]
5
6distinguished_name = req_distinguished_name
7string_mask = utf8only
8prompt = no
9
10# SHA-1 is deprecated, so use SHA-2 instead.
11default_md = sha384
12
13# Extension to add when the -x509 option is used.
14x509_extensions = v3_ca
15req_extensions = v3_ca
16
17[ req_distinguished_name ]
18# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
19countryName = US
200.organizationName = Demo ORG
21organizationalUnitName = www.demo.org
22commonName = Demo CA RSA Root
23
24[ v3_ca ]
25
26subjectKeyIdentifier = hash
27authorityKeyIdentifier = keyid:always,issuer:always
28basicConstraints = critical, CA:true
29keyUsage = critical, digitalSignature, cRLSign, keyCertSign
30EOL
Sign the Self-Signed CA Root Certificate
1MY_CA_ROOT_CERT_PATH=$MY_CA_ROOT_DIR/ca.pem
2
3# Make a self-signed CA root certificate valid for 30 years
4openssl req -config $MY_CA_ROOT_REQ_PATH \
5 -new \
6 -x509 \
7 -extensions v3_ca \
8 -days 10950 \
9 -key $MY_CA_ROOT_KEY_PATH \
10 -out $MY_CA_ROOT_CERT_PATH
Now you can view the detailed information of the generated certificate with the following command.
1openssl x509 -noout -text -in $MY_CA_ROOT_CERT_PATH
And verify that the self-signed CA certificate with itself.
1openssl verify -CAfile $MY_CA_ROOT_CERT_PATH $MY_CA_ROOT_CERT_PATH
Setup the CA
Finally, configure the CA for issuing other certificates.
Still, you can modify the configuration file
ca.cnfto meet your requirements. Especially, you can change thereq_distinguished_namesection to match your organization’s information.
1MY_CA_ROOT_CONF_PATH=$MY_CA_ROOT_DIR/ca.cnf
2
3cat > $MY_CA_ROOT_CONF_PATH << EOL
4[ ca ]
5default_ca = CA_default
6
7[ CA_default ]
8# Directory and file locations.
9dir = $MY_CA_ROOT_DIR
10certs = \$dir/certs
11crl_dir = \$dir/crl
12new_certs_dir = \$dir/issued_certs
13database = \$dir/index.txt
14serial = \$dir/serial
15RANDFILE = \$dir/.rand
16
17# The root key and root certificate.
18private_key = \$dir/key.pem
19certificate = \$dir/ca.pem
20
21# For certificate revocation lists.
22crlnumber = \$dir/crlnumber
23crl = \$dir/crl/ca.crl.pem
24crl_extensions = crl_ext
25default_crl_days = 30
26copy_extensions = copy
27
28# SHA-1 is deprecated, so use SHA-2 instead.
29default_md = sha256
30
31name_opt = ca_default
32cert_opt = ca_default
33default_days = 375
34preserve = no
35policy = policy_strict
36
37[ policy_strict ]
38# The root CA should only sign intermediate certificates that match.
39countryName = match
40stateOrProvinceName = optional
41organizationName = match
42organizationalUnitName = optional
43commonName = supplied
44emailAddress = optional
45
46[ policy_loose ]
47# Allow the intermediate CA to sign a more diverse range of certificates.
48countryName = optional
49stateOrProvinceName = optional
50localityName = optional
51organizationName = optional
52organizationalUnitName = optional
53commonName = supplied
54emailAddress = optional
55
56[ req ]
57default_bits = 4096
58distinguished_name = req_distinguished_name
59string_mask = utf8only
60prompt = no
61
62# SHA-1 is deprecated, so use SHA-2 instead.
63default_md = sha384
64
65# Extension to add when the -x509 option is used.
66x509_extensions = v3_ca
67
68[ req_distinguished_name ]
69# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
70countryName = US
710.organizationName = Demo ORG
72organizationalUnitName = www.demo.org
73commonName = Demo CA RSA Root
74
75[ v3_ca ]
76subjectKeyIdentifier = hash
77authorityKeyIdentifier = keyid:always,issuer:always
78basicConstraints = critical, CA:true
79keyUsage = critical, digitalSignature, cRLSign, keyCertSign
80
81[ v3_intermediate_ca ]
82keyUsage = critical, digitalSignature, cRLSign, keyCertSign
83extendedKeyUsage = critical, clientAuth, serverAuth
84basicConstraints = critical, CA:true, pathlen:0
85subjectKeyIdentifier = hash
86authorityKeyIdentifier = keyid:always,issuer:always
87# authorityInfoAccess = caIssuers;URI:http://demo.org/ca.html
88# crlDistributionPoints = URI:http://demo.org/ca.crl
89# certificatePolicies = 2.23.140.1.2.1,@policy_issuer_info
90
91# [ policy_issuer_info ]
92# policyIdentifier = 1.3.6.1.4.1.44947.1.2.3.4.5.6.7.8
93
94[ crl_ext ]
95authorityKeyIdentifier=keyid:always
96
97[ ocsp ]
98basicConstraints = CA:FALSE
99subjectKeyIdentifier = hash
100authorityKeyIdentifier = keyid:always,issuer:always
101keyUsage = critical, digitalSignature
102extendedKeyUsage = critical, OCSPSigning
103EOL
Well, remember to update the index.txt.attr file to allow the CA to reissue certificates with the same commonName.
1echo 'unique_subject = no' > $MY_CA_ROOT_DIR/index.txt.attr
Finally, a root CA is ready.
comments powered by Disqus