CA:
openssl req -new -nodes -text \
-out root.csr \
-keyout root.key \
-subj "/CN=IBM <IM or Zen service> Intermidiate Certificate Authority"
openssl x509 -req -in root.csr \
-text \
-days 3650 \
-extfile /etc/pki/tls/openssl.cnf \
-extensions v3_ca \
-signkey root.key -out root.crt
openssl req -new -nodes -text \
-out server.csr \
-keyout server.key \
-subj "/CN=*.fyre.ibm.com"
openssl req -new -nodes -text \
-out client.csr \
-keyout client.key \
-subj "/CN=<username>"
openssl x509 -req \
-in client.csr -text -days 730\
-CA root.crt -CAkey root.key -CAcreateserial \
-out client.crt
- Generate csr
openssl req -newkey rsa:2048 -----钥的结构和编码知识。RSA-2048表示模数n为2048
-keyout Pserver.key
-out Pserver.csr
-config san-Pserver.cnf
Pass phrase: XXXX ------------------解密密码
C = HK
ST = Hong Kong
L = Hong Kong
O = ABC Company Limited
OU = Prod
CN = Pserver.prod.abc.local
openssl x509 是 OpenSSL 工具包中用于处理 X.509 数字证书的命令
------------san-Pserver.cnf------------------DNS 列出所有server的名字，--IP 写不写？？？？---
req
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
req_distinguished_name
countryName = Country Name (2 letter code)
stateOrProvinceName = State or Province Name (full name)
localityName = Locality Name (eg, city)
organizationName = Organization Name (eg, company)
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (e.g. server FQDN or YOUR name)
req_ext
subjectAltName = @alt_names
alt_names
DNS.1 = p1abc0004.prod.abc.local
DNS.2 = p1abc0005.prod.abc.local
DNS.3 = p1abc0006.prod.abc.local
DNS.4 = p2abc0004.prod.abc.local
DNS.5 = p2abc0005.prod.abc.local
DNS.6 = p2abc0006.prod.abc.local
- Verify csr content
openssl req -noout -text -in Pserver.csr
3 Verify if the private key and csr are matched
openssl rsa -modulus -noout -in Pserver.key | openssl sha256
openssl req -noout -modulus -in Pserver.csr | openssl sha256
openssl rsa -check -noout -in Pserver.key
-
Copy csr & key out
-
Send csr file to IT Support
req_distinguished_name
countryName = Country Name (2 letter code)
stateOrProvinceName = State or Province Name (full name)
localityName = Locality Name (eg, city)
organizationName = Organization Name (eg, company)
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (e.g. server FQDN or YOUR name)
req_ext
subjectAltName = @alt_names
oracle@Redhat9 rick$ openssl req -newkey rsa:2048 -keyout Pserver.key -out Pserver.csr -config san-Pserver.cnf
Generating a RSA private key
......................................+++++
..........................................................................................+++++
writing new private key to 'Pserver.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) \[\]:HK
State or Province Name (full name) \[\]:Hong Kong
Locality Name (eg, city) \[\]:Hong Kong
Organization Name (eg, company) \[\]:ABC Company Limited
Organizational Unit Name (eg, section) \[\]:Prod
Common Name (e.g. server FQDN or YOUR name) \[\]:Pserver.prod.abc.local
oracle@Redhat9 rick$ openssl req -noout -text -in Pserver.csr
Certificate Request:
Data:
Version: 1 (0x0)
Subject: C = HK, ST = Hong Kong, L = Hong Kong, O = ABC Company Limited, OU = Prod, CN = Pserver.prod.abc.local
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:af:31:36:ee:ed:a8:8d:9d:af:6d:4e:16:da:c5:
fa:da:97:02:9f:e7:33:45:6a:7c:f0:0d:6e:d1:75:
33:11
Exponent: 65537 (0x10001)
Attributes:
Requested Extensions:
X509v3 Subject Alternative Name:
DNS:Pserver.prod.abc.local, DNS:p1abc0005.prod.abc.local, DNS:p1abc0006.prod.abc.local, DNS:p2abc0004.prod.abc.local, DNS:p2abc0005.prod.abc.local, DNS:p2abc0006.prod.abc.local
Signature Algorithm: sha256WithRSAEncryption
8a:bc:33:1a:b1:50:cc:8b:c6:d6:1b:54:b1:3c:4a:c3:26:c3:
f3:b4:86:52:af:49:d3:17:43:a8:8b:e5:4d:74:44:a1:99:42:
20:e5:86:3d
oracle@Redhat9 $ openssl rsa -modulus -noout -in Pserver.key | openssl sha256
Enter pass phrase for Pserver.key:
(stdin)= 5c6af34339befc5492f48c04c503ce8cea88f75100a6a872d1ae221b2aac9a4a
oracle@Redhat9 $ openssl req -noout -modulus -in Pserver.csr | openssl sha256
(stdin)= 5c6af34339befc5492f48c04c503ce8cea88f75100a6a872d1ae221b2aac9a4a
oracle@Redhat9 $ openssl rsa -check -noout -in Pserver.key
Enter pass phrase for Pserver.key:
RSA key ok
openssl req -newkey rsa:2048 -keyout Pserver.key -out Pserver.csr -config san-Pserver.cnf -nodes ----------- -nodes 不加密
----解密
这条命令的作用是读取名为 key 的 RSA 密钥文件，并将其内容原样写回 key 文件 。因为 -in 和 -out 指向同一个文件，实际操作中通常是用来去除私钥的密码保护（解密），或者在不指定加密参数时重写一遍密钥文件。
具体说明：
- 如果输入的
key文件是加密的私钥，执行时会提示输入密码 ，读取后直接以明文 PEM 格式写回，相当于移除了密码保护。 - 如果输入文件本身是明文私钥，这条命令只是读取后重新写出，内容基本不变，一般没有实际意义。
- 输出文件默认是 PEM 格式，除非用
-outform指定其他格式。
⚠️ 注意：
-in和-out指向同一文件时，如果处理中途出错，可能会损坏原文件。建议先备份原文件，或先输出到临时文件再替换。
常用变体
- 移除密码并输出到新文件 ：
openssl rsa -in encrypted.key -out decrypted.key - 用 3DES 加密私钥 ：
openssl rsa -in key.pem -des3 -out keyout.pem - 从私钥提取公钥 ：
openssl rsa -in key.pem -pubout -out pubkey.pem
openssl rsa -in Pserver.key -out Pserver_no.key
openssl rsa -in client.key -outform PEM -out client_key.pem
openssl x509 -in client.crt -outform PEM -out client.pem
openssl x509 -in root.crt -outform PEM -out root.pem