潇湘夜雨移动版

1.配置颁发证书的根机构

[root@localhost ~]# cd /etc/pki

[root@localhost pki]# ls

CA  ca-trust  java  nssdb  rpm-gpg  rsyslog  tls

[root@localhost pki]# vim tls/openssl.cnf 

dir             = /etc/pki/CA ##查看证书路径，避免生产证书时找不到文件

[root@localhost pki]# cd CA/

[root@localhost CA]# ls #创建如下目录，一般都已创建

certs  crl  newcerts  private

[root@localhost CA]# ls certs/

[root@localhost CA]# touch index.txt serial

[root@localhost CA]# ls

certs  crl  index.txt  newcerts  private  serial

[root@localhost CA]# echo '01' >serial ##证书的序列号从1开始

[root@localhost CA]# open

open           open_init_pty  openssl        openvt         

[root@localhost CA]# openssl genrsa 1024 > private/cakey.pem ##产生私钥

Generating RSA private key, 1024 bit long modulus

...........++++++

...................................++++++

e is 65537 (0x10001)

[root@localhost CA]# chmod 600 private/* ##更改权限

[root@localhost CA]# openssl req -new -key private/cakey.pem -x509 -out cacert.pem -days 3650 ##产生证书

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:cn

State or Province Name (full name) []:sichuan

Locality Name (eg, city) [Default City]:chendu

Organization Name (eg, company) [Default Company Ltd]:liangzonghua.com.cn

Organizational Unit Name (eg, section) []:lzh

Common Name (eg, your name or your server's hostname) []:liangzonghua #一般输入ca服务器的主机名

Email Address []:2606380155@qq.com #可省略

 

2.为ftp申请证书

[root@localhost CA]# mkdir /etc/vsftpd/certs #创建存放私有钥匙，证书等信息的目录

[root@localhost CA]# cd /etc/vsftpd/certs/

[root@localhost certs]# openssl genrsa 1024 >vsftpd.key #产生钥匙

[root@localhost certsopenssl req -new -key vsftpd.key -out vsftpd.csr #向根机构请求证书

[root@localhost certs]# openssl req -new -key vsftpd.key -out vsftpd.csr

[root@localhost certs]# openssl req -new -key vsftpd.key -out vsftpd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:cn

State or Province Name (full name) []:sichuan

Locality Name (eg, city) [Default City]:chendu

Organization Name (eg, company) [Default Company Ltd]:liangzonghua.com.cn

Organizational Unit Name (eg, section) []:lzh #前面的选项和根证书一致

Common Name (eg, your name or your server's hostname) []:ftp.liangzonghua #主机名自定义

Email Address []: #不填

 

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []: (责任编辑：liangzh)