如何创build一个内部使用的不带自签名的CA的内部SSL证书？

我最终试图获得一个PHP CAS客户端（带有Apache的zend服务器8）来信任一个CAS服务器（tomcat 7），为此我已经尽了自己的私钥基础设施，在这里看到了密码取而代之的是臀部：

PKI GEN

#root key openssl genrsa -out rootCA.key -aes256 -passout pass:butts 4096 openssl req -x509 -new -key rootCA.key -out rootCA.crt -subj '/C=US/O=World Domination/CN=WorldDom Root CA' -days 3650 -sha256 -passin pass:butts #intermdiate key openssl genrsa -out intermediateCA.key -aes256 -passout pass:butts 4096 openssl req -new -key intermediateCA.key -out intermediateCA.csr -subj '/C=US/O=<orgname>/CN=<orgname> Intermediate CA' -passin pass:butts #X509V3 extension config file cat <<EOF > v3_ca.ext subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always basicConstraints=CA:true EOF #sign intermediate with root key & X509V3 extensions openssl x509 -req -in intermediateCA.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -CAserial rootCA.srl -extfile v3_ca.ext -out intermediateCA.crt -days 365 -sha256 -passin pass:butts #works at this stage openssl verify -CAfile rootCA.crt intermediateCA.crt openssl x509 -in intermediateCA.crt -text #server openssl genrsa -out server.key -aes256 -passout pass:butts 4096 openssl req -new -key server.key -out server.csr -subj '/C=US/O=<orgDiv>/CN=CASsrv' -passin pass:butts openssl x509 -req -in server.csr -CA intermediateCA.crt -CAkey intermediateCA.key -CAcreateserial -CAserial intermediateCA.srl -out server.crt -days 365 -sha256 -passin pass:butts #decrypt for web server use mv server.key server.key.secure openssl rsa -in server.key.secure -out server.key -passin pass:butts #client openssl genrsa -out client.key -aes256 -passout pass:butts 4096 openssl req -new -key client.key -out client.csr -subj '/C=US/O=<orgSubDiv>/CN=ZServer/[email protected]' -passin pass:butts openssl x509 -req -in client.csr -CA intermediateCA.crt -CAkey intermediateCA.key -CAcreateserial -CAserial intermediateCA.srl -out client.crt -days 365 -sha256 -passin pass:butts cat intermediateCA.crt rootCA.crt > CAchain.pem openssl pkcs12 -export -passout pass:butts -in client.crt -inkey client.key -certfile CAchain.pem -out client.p12 -passin pass:butts #works here too openssl verify -CAfile CAchain.pem server.crt (or client.crt) openssl x509 -in server.crt -text 

现在可以在Apache HTTP Server中使用CAchain.pem，server.crt和server.key文件，例如启用HTTPS。 rootCA.crt证书应该被导入到浏览器或邮件客户端的可信权限。

表面上，rootCA.crt证书应该被导入到浏览器或邮件客户端的信任机构。 这也是一个奇怪的旅程：

rootCA导入

 sudo cp rootCA.crt /etc/ssl/certs/worldDomCA.crt #symlink named after its hash.4, hash result is same after rename so I used the local version rather than the renamed etc/ssl version sudo ln -s /etc/ssl/certs/worldDomCA.crt /etc/ssl/certs/'openssl x509 -hash -noout -in rootCA.crt'.4 #this just hangs, disturbingly openssl verify -CApath /etc/ssl/certs/worldDomCA.crt 

无可否认，我不确定哪里放CAchain和服务器证书文件，但更值得注意的是s_client抱怨证书仍然自签名，而不是像挂钩validation。 从主题和发行人的路线来看

• 在CentOS 7中升级openssl
• OpenSSL – 是否有必要对每个密码进行testing
• 在Linux上pipe理ca-certificates的常用方法是什么？
• SSL和Apache：GeoTrust CryptoReport说“OK”，但openssl说“无法获得本地颁发者证书”
• 将密钥文件和Cer文件转换为密钥库

 subject=/C=US/ST=test/L=test/O=test/OU=test/CN=servername.domain.int issuer=/C=US/ST=test/L=test/O=test/OU=test/CN=servername.domain.int 

证书包括他们伪造的盒子的DN。 如果我在另一个盒子上做了我的CA，然后把它拿来用来签署我的服务器/客户端证书，我可以逃脱吗？ 值得注意的是，两台服务器都运行在同一个盒子上，因为这整个混乱仍在探索评估。

 $ openssl verify -CApath /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt -untrusted intermediateCA.crt server.crt server.crt: OK 

 SSLEngine on SSLCertificateFile /etc/pki/tls/certs/server.crt SSLCertificateKeyFile /etc/pki/tls/private/server.key SSLCertificateChainFile /etc/pki/tls/certs/world-domination.ca-bundle 

 openssl pkcs12 -export -chain -passout pass:butts -in server.crt -inkey server.key -out server.p12 -name alias -CAfile (intermediateCA.crt or CAchain.crt) -caname steeve 

 keytool -changealias -alias tomcat -destalias derpcat -storepass changeit keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore server.keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass butts -alias tomcat