Yuav Ua Li Cas Rau Koj Tus Kheej Daim Ntawv Pov Thawj (nrog Duab)

Kauj Ruam 4. Sau koj tus kheej daim ntawv pov thawj:

• openssl ca -extensions v3_ca -out server. CA -signed.crt -keyfile server. CA.key -verbose -selfsign -md sha256 -enddate 330630235959Z -infiles server. CA.csr

• Cov kev xaiv piav qhia:

  • ca - Loads Daim Ntawv Tso Cai Tso Cai
  • -extension v3_ca -Loads v3_ca txuas ntxiv, yuav tsum -muaj rau siv ntawm cov browser niaj hnub no
  • -out server. CA -signed.crt -Lub npe ntawm koj tus lej kos npe tshiab
  • -keyfile server. CA.key - Tus yuam sij ntiag tug uas koj tau tsim hauv qib 1
  • -verbose - qhia koj cov ntsiab lus hais txog qhov kev thov raws li nws tau tsim (yeem)
  • -selfsign - Qhia openssl tias koj siv tus lej tseem ceeb los kos npe rau qhov kev thov
  • -md sha256 - Lub encryption algorithm siv rau cov lus. (Yog tias koj tsis paub tias qhov no yog dab tsi, tsis txhob hloov qhov no. Koj yuav tsum hloov qhov no tsuas yog koj paub tias koj tab tom ua dab tsi)
  • -tej hnub 330630235959Z - Hnub kawg ntawm daim ntawv pov thawj. Cov cim yog YYMMDDHHMMSSZ qhov twg Z nyob hauv GMT, qee zaum hu ua "Zulu" sijhawm.
  • -infiles server. CA.csr - daim ntawv thov kos npe uas koj tau tsim cov kauj ruam saum toj no.

Kauj Ruam 5. Tshawb xyuas koj daim ntawv pov thawj CA

• openssl x509 -noout -text -in server. CA.crt

• Cov kev xaiv piav qhia:

  • x509 - Loads x509 module los tshuaj xyuas daim ntawv pov thawj kos npe.
  • -noout - Tsis txhob tso cov ntawv nkag
  • -text - tso tawm cov ntaub ntawv ntawm qhov screen
  • -in server. CA.crt - Thauj daim ntawv pov thawj kos npe
• Cov ntaub ntawv server. CA.crt tuaj yeem faib rau txhua tus neeg uas yuav siv koj lub vev xaib lossis siv daim ntawv pov thawj uas koj npaj yuav kos npe.

Ntu 2 ntawm 4: Tsim SSL Daim Ntawv Pov Thawj rau Kev Pabcuam, xws li Apache

Kauj Ruam 1. Tsim tus yuam sij ntiag tug

• openssl genrsa -des3 -out server.apache.key 2048

• Cov kev xaiv piav qhia:

  • openssl - lub npe ntawm cov software
  • genrsa - tsim tus yuam sij ntiag tug tshiab
  • -des3 - encrypt tus yuam sij siv DES cipher
  • -out server.apache.key - lub npe ntawm koj tus yuam sij tshiab
  • 2048 - qhov ntev, hauv qhov me, ntawm tus yuam sij ntiag tug (Thov saib cov lus ceeb toom)
• Khaws daim ntawv pov thawj no thiab tus password rau hauv qhov chaw nyab xeeb.

Kauj Ruam 2. Tsim daim ntawv thov kos npe rau daim ntawv pov thawj

• openssl req -verbose -new -key server.apache.key -out server.apache.csr -sha256

• Cov kev xaiv piav qhia:

  • req - Tsim Daim Ntawv Thov Kos Npe
  • -verbose - qhia koj cov ntsiab lus hais txog qhov kev thov raws li nws tau tsim (yeem)
  • -new - tsim qhov kev thov tshiab
  • -key server.apache.key - Tus yuam sij ntiag tug koj nyuam qhuav tsim saum toj no.
  • -out server.apache.csr - Lub npe cov ntaub ntawv ntawm kev kos npe thov uas koj tab tom tsim
  • sha256 - Cov txheej txheem encryption los siv rau kev kos npe thov (Yog tias koj tsis paub tias qhov no yog dab tsi, tsis hloov qhov no. Koj yuav tsum tsuas yog hloov qhov no yog tias koj paub tias koj tab tom ua dab tsi)

Kauj Ruam 3. Siv koj daim ntawv pov thawj CA los kos npe tus yuam sij tshiab

• openssl ca -out server.apache.pem -keyfile server. CA.key -infiles server.apache.csr

• Cov kev xaiv piav qhia:

  • ca - Loads Daim Ntawv Tso Cai Tso Cai
  • -out server.apache.pem - Cov ntaub ntawv lub npe kos npe rau daim ntawv pov thawj
  • -keyfile server. CA.key - Cov ntaub ntawv npe ntawm daim ntawv pov thawj CA uas yuav kos npe rau qhov kev thov
  • -infiles server.apache.csr - Lub npe cov ntaub ntawv ntawm Daim Ntawv Pov Thawj Kos Npe Thov

Kauj Ruam 4. Sau cov ntaub ntawv kom ntau li ntau tau:

• Lub Tebchaws Lub Npe (2 tsab ntawv code) [AU]:

  US

• Xeev lossis Xeev Lub Npe (lub npe tag nrho) [Qee Lub Xeev]:

  CA

• Lub Nroog Lub Npe (piv txwv, lub nroog) :

  Silicon Valley

• Lub Npe Lub Npe (piv txwv li, tuam txhab) [Internet Widgits Pty Ltd]:

  wikiHow, Inc.

• Lub Koom Haum Lub Npe Lub Npe (piv txwv li, ntu) :

• Common Name (e.g., server FQDN or YOUR name) :

• Email Chaw Nyob :

Kauj Ruam 5. Khaws ib daim qauv ntawm koj tus yuam sij ntiag tug rau lwm qhov chaw

Tsim tus yuam sij ntiag tug yam tsis muaj tus password tiv thaiv Apache los ntawm kev nug koj tus password:

• openssl rsa -in server.apache.key -out server.apache.unsecured.key

• Cov kev xaiv piav qhia:

  • rsa - Ua haujlwm RSA encryption program
  • -in server.apache.key - Lub npe tseem ceeb uas koj xav hloov pauv.
  • -out server.apache.unsecured.key - Lub npe cov ntaub ntawv ntawm tus yuam sij tshiab tsis muaj kev nyab xeeb

Kauj Ruam 6. Siv cov txiaj ntsig server.apache.pem ua ke nrog tus yuam sij ntiag tug uas koj tau tsim hauv qib 1 txhawm rau teeb tsa koj cov ntaub ntawv apache2.conf

Ntu 3 ntawm 4: Tsim Tus Neeg Siv Daim Ntawv Pov Thawj rau Kev Pom Zoo

Kauj Ruam 1. Ua raws txhua qib hauv _Creating SSL Certificates for Apache_

Kauj Ruam 2. Hloov koj daim ntawv pov thawj kos npe rau PKCS12

openssl pkcs12 -export -in user_cert.pem -inkey user_private_key.pem -out user_cert.p12

Ntu 4 ntawm 4: Tsim S/MIME E-mail Daim Ntawv Pov Thawj

Kauj Ruam 1. Tsim tus yuam sij ntiag tug

openssl genrsa -des3 -out private_email.key 2048

Kauj Ruam 2. Tsim Daim Ntawv Pom Zoo Kos Npe

openssl req -new -key private_email.key -out private_email.csr

Kauj Ruam 3. Siv koj daim ntawv pov thawj CA los kos npe tus yuam sij tshiab

openssl ca -out private_email.pem -keyfile server. CA.key -infiles private_email.csr

Kauj Ruam 4. Hloov daim ntawv pov thawj rau PKCS12

openssl pkcs12 -export -in private_email.crt -inkey private_email.key -out private_email.p12

Kauj Ruam 5. Tsim daim ntawv pov thawj Public Key rau kev faib khoom

openssl pkcs12 -export -out public_cert.p12 -in private_email.pem -clcerts -nokeys -name "WikiHow's Public Key"

Lub tswv yim

Koj tuaj yeem sib txawv cov ntsiab lus ntawm PEM yuam sij los ntawm kev tshaj tawm cov lus txib hauv qab no: openssl x509 -noout -text -in certificate.pem

Lus ceeb toom

• 1024-ntsis cov yuam sij raug txiav txim tias tsis siv lawm. 2048-tus yuam sij tau txiav txim siab kom muaj kev nyab xeeb rau cov neeg siv daim ntawv pov thawj txog xyoo 2030, tab sis suav tias tsis txaus rau daim ntawv pov thawj. Xav txog cov kev phom sij no thaum koj tsim koj daim ntawv pov thawj.
• Los ntawm lub neej ntawd, feem ntau cov browser niaj hnub no yuav qhia "Daim ntawv pov thawj tsis ntseeg siab" ceeb toom thaum ib tus neeg mus ntsib koj lub xaib. Muaj kev sib cav ntau dhau ntawm cov lus ntawm cov lus ceeb toom no, vim tias cov neeg siv tsis siv txuj ci tuaj yeem raug ntes-tiv thaiv. Feem ntau nws yog qhov zoo tshaj los siv txoj cai tseem ceeb kom cov neeg siv tsis tau txais cov lus ceeb toom.