• Jak na OpenSSL
• konfigurace SSL je buď v /etc/openssl nebo /usr/share/ssl

• generovani privátniho klíce
  openssl genrsa -des3 -out localhost.key 1024
• vygenerovani privatniho klice bez hesla
  openssl rsa -in localhost.key -out localhost.key.unsecure
• pozadavek pro certifikacni autoritu
  openssl req -new -key localhost.key -out localhost.key.csr
• vygenerovani certifikatu provizornim podpisem certifikatu

openssl x509 -req \
    -days 30 \
    -in localhost.key.csr \
    -signkey localhost.key \
    -out localhost.cert

Program na vytvoření SSL klíče a certifikátu

#!/bin/sh
if test -z $1 then
    exit
fi
 
echo "---------------------------------------"
echo "generovani privatniho klice"
openssl genrsa -des3 -out $1.key 1024
 
echo "---------------------------------------"
echo "vygenerovani privatniho klice bez hesla"
openssl rsa \
    -in $1.key \
    -out $1.key.unsecure
 
echo "-----------------------------------"
echo "pozadavek pro certifikacni autoritu"
openssl req -new \
    -key $1.key \
    -days 730 \
    -out $1.key.csr
 
echo "-----------------------------------------------------------"
echo "vytvoreni certifikatu podepsani pozadavku vlastnim podpisem"
openssl x509 -req \
    -days 730 \
    -in $1.key.csr \
    -signkey $1.key \
    -out $1.crt 

• vytvoření klíče bez hesla a žádosti pro podpis na CaCert.org pro mailserver

  openssl req -nodes -newkey rsa:2048 -keyout server.key -out server.csr -subj "/C=CZ/ST=CZ/L=Ceska Lipa/O=-/OU=-/CN=bart.datron.cz/subjectAltName=DNS:*.talman.cz/subjectAltName=DNS:*.talman.eu/subjectAltName=DNS:*.talman.org/subjectAltName=DNS:*.killy.cz/subjectAltName=DNS:*.jaromir.org/subjectAltName=DNS:*.strojaruv.net/subjectAltName=DNS:*.jlatal.com"

#!/bin/sh
DIR=/etc/openssl
mkdir $DIR
mkdir $DIR/certs
mkdir $DIR/crl
mkdir $DIR/newcerts
mkdir $DIR/private
echo "01" > $DIR/serial
touch $DIR/index.txt

[ ca ]
default_ca	= CA_default		# odkaz na sekci

[ CA_default ]
dir			= /opt/openssl		# root adresar
certs			= $dir/certs		# adresarova struktura
crl_dir		= $dir/crl			# CRL
database		= $dir/index.txt		# index soubor
new_certs_dir	= $dir/newcerts		# nove certifikaty

certificate		= $dir/private/CAcert.pem 	# CA certifikat
serial		= $dir/serial 		# poradove cislo certifikatu
crl			= $dir/clr/crl.pem 		# soucasny CRL
private_key		= $dir/private/CAkey.pem	# privatni klic CA
RANDFILE		= $dir/private/.rand	# soubor pro nahodna cilsla

#x509_extensions	= x509v3_extensions	# sekce pro x509
default_days	= 365		# jak dlouho plati
default_crl_days	= 30			# jak dlouho pred novym CRL
default_md		= md5			# jakou md pouzit
preserve		= no			# DN trideni

# CA - policy_match = odkaz z predchozi sekce
# match - musi byt stejne
# supplied - doplneno
# optional - nemusi byt

policy			= policy_match		# odkaz na zabezpeceni

[ policy_match ]
countryName			= match
stateOrProvinceName	= match
localityName		= match
organizationName		= match
organizationalUnitName	= match
commonName			= supplied
emailAddress		= optional

# jina moznost
[ policy_anything ]
countryName			= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName		= optional
organizationalUnitName	= optional
commonName			= supplied
emailAddress		= optional

### zadosti o certifikát
#
[ req ]
default_bits		= 512	#delka
default_keyfile 		= privkey.pem # klic
distinguished_name	= req_distinguished_name # odkaz do sekce
attributes			= req_attributes	# odkaz do sekce

[ req_distinguished_name ]
countryName				= Zeme (2 znaky)
countryName_default		= CZ
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= Oblast
stateOrProvinceName_default	= 

localityName			= Mesto
localityName_default		= 

organizationName			= Organizace
organizationName_default	= 

organizationalUnitName		= Sekce organizace
organizationalUnitName_default= Projekt-blabla

commonName				= Common Name (mail, server)
commonName_default		= 
commonName_max			= 64

emailAddress			= Email
emailAddress_max			= 40
emailAddress_default		= 

[ req_attributes ]
challengePassword			= Heslo
challengePassword_min		= 4
challengePassword_max		= 20

#!/bin/sh
openssl req -new -x509 -days 3650 -nodes -keyout ./private/CAkey.pem -out ./private/CAcert.pem  -config ./openssl.cnf

#!/bin/sh
openssl req -new -keyout $1-key.pem -out $1-req.pem -config ./openssl.cnf

• Výsledkem je žádost newreq.pem a privátní klíč k zatím nepodepsanému certifikátu newkey.pem (tyto soubory mohou mít stejný název, pak je žádost i klíč v jednom souboru)

#!/bin/sh
openssl rsa -in $1-key.pem -out  $1-unsec-key.pem

#!/bin/sh
openssl ca -out $1-cert.pem -config openssl.cnf -infiles $1-req.pem

#!/bin/sh
openssl ca -gencrl -out crl.pem -config openssl.cnf

 openssl ca -gencrl -out cert.crl -config openssl.cnf

openssl crl -text -in crl.pem