📄 keygensign.htm
字号:
<HTML><HEAD><TITLE>User/Server key generation and signing</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.55"><LINKREL="HOME"TITLE="The Open–source PKI Book"HREF="ospki-book.htm"><LINKREL="UP"TITLE="General implementation overview"HREF="implementation-overview.htm"><LINKREL="PREVIOUS"TITLE="Initialisation of the Certification Authority"HREF="initialisation.htm"><LINKREL="NEXT"TITLE="PKI standards and specifications"HREF="standards-specifications.htm"></HEAD><BODYCLASS="SECT1"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><DIVCLASS="NAVHEADER"><TABLEWIDTH="100%"BORDER="0"CELLPADDING="0"CELLSPACING="0"><TR><THCOLSPAN="3"ALIGN="center">The Open–source PKI Book: A guide to PKIs and Open–source Implementations</TH></TR><TR><TDWIDTH="10%"ALIGN="left"VALIGN="bottom"><AHREF="initialisation.htm">Prev</A></TD><TDWIDTH="80%"ALIGN="center"VALIGN="bottom">Chapter 4. General implementation overview</TD><TDWIDTH="10%"ALIGN="right"VALIGN="bottom"><AHREF="standards-specifications.htm">Next</A></TD></TR></TABLE><HRALIGN="LEFT"WIDTH="100%"></DIV><DIVCLASS="SECT1"><H1CLASS="SECT1"><ANAME="KEYGENSIGN">User/Server key generation and signing</A></H1><P> The user generates a key pair for a certificate to be used by that user or any entity that needs to be authenticated by the CA. We also show the signing procedure. </P><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="GENERATEKEY">Generate the RSA key–pair for a user/server</A></H2><P> Use this command to generate the RSA key pair </P><P> <PCLASS="LITERALLAYOUT"><TTCLASS="PROMPT">User% </TT><TTCLASS="USERINPUT"><B>openssl genrsa –des3 –out user.key 2048</B></TT></P> <P></P><DIVCLASS="VARIABLELIST"><P><B>Parameters</B></P><DL><DT>genrsa</DT><DD><P> the <SPANCLASS="APPLICATION">openssl</SPAN> component to generate an <SPANCLASS="ACRONYM">RSA</SPAN> key–pair, </P></DD><DT>-des3</DT><DD><P> the symmetric algorithm to encrypt the key–pair, </P></DD><DT>-out <TTCLASS="FILENAME">user.key</TT></DT><DD><P> the filename to store the key–pair, </P></DD><DT>2048</DT><DD><P> size of RSA modulus in bits. </P></DD></DL></DIV> </P><P> Execution of the above command presents the user with the following dialogue:<TABLEBORDER="0"BGCOLOR="#E0E0E0"WIDTH="100%"><TR><TD><PRECLASS="PROGRAMLISTING">1112 semi-random bytes loadedGenerating RSA private key, 2048 bit long modulus.+++++........................................................++++++++++++e is 65537 (0x10001)Enter PEM pass phrase: <ICLASS="EMPHASIS">enter the pass–phrase here</I>Verifying password - Enter PEM pass phrase: <ICLASS="EMPHASIS">re–enter pass–phrase here</I></PRE></TD></TR></TABLE> </P><P> This creates an RSA key pair stored in the file <TTCLASS="FILENAME">user.key</TT>. The key pair is encrypted with 3DES with a password supplied by the user during key generation. The N in RSA is 2048 bits long. </P><P> The reader should note that this is the same procedure as the generation of the CA key–pair. For sample key–pairs, please see the appendices listed in <AHREF="initialisation.htm#GENERATEKEYPAIR">the section called <I>Generate the RSA key–pair for the CA</I></A>. </P></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="GENERATECSR">Generate a certificate request</A></H2><P> The user generates a certificate request with this command. The CSR is sent to the CA for signing. The CA returns the the signed certificate. </P><P><PCLASS="LITERALLAYOUT"><TTCLASS="PROMPT">User% </TT><TTCLASS="USERINPUT"><B>openssl req –new –key user.key –out user.csr</B></TT></P> <P></P><DIVCLASS="VARIABLELIST"><P><B>Parameters</B></P><DL><DT>req</DT><DD><P> the <SPANCLASS="APPLICATION">openssl</SPAN> component to generate a certificate request, </P></DD><DT>-new</DT><DD><P> this is a new certificate, </P></DD><DT>-key <TTCLASS="FILENAME">user.key</TT></DT><DD><P> the key–pair file to be used, </P></DD><DT>-out <TTCLASS="FILENAME">user.csr</TT></DT><DD><P> the filename that the new certificate request will be written onto </P></DD></DL></DIV> </P><P> By executing the above command, we are presented with the following dialogue: </P><TABLEBORDER="0"BGCOLOR="#E0E0E0"WIDTH="100%"><TR><TD><PRECLASS="PROGRAMLISTING">Using configuration from /usr/local/ssl/openssl.cnfEnter PEM pass phrase: <ICLASS="EMPHASIS">type the pass–phrase here</I>You are about to be asked to enter information that will be incorporated into your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:<TTCLASS="USERINPUT"><B>GB</B></TT>State or Province Name (full name) [Some-State]:<TTCLASS="USERINPUT"><B>Surrey</B></TT>Locality Name (eg, city) []:<TTCLASS="USERINPUT"><B>Egham</B></TT>Organization Name (eg, company) [MyCo Ltd]:<TTCLASS="USERINPUT"><B>Arts Building Ltd</B></TT>Organizational Unit Name (eg, section) []:<TTCLASS="USERINPUT"><B>Dept. History</B></TT>Common Name (eg, YOUR name) []:<TTCLASS="USERINPUT"><B>Simos Xenitellis</B></TT>Email Address []:<TTCLASS="USERINPUT"><B>S.Xenitellis@rhbnc.ac.uk</B></TT>Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:<TTCLASS="USERINPUT"><B>.</B></TT>An optional company name []:<TTCLASS="USERINPUT"><B>.</B></TT><TTCLASS="PROMPT">User% </TT></PRE></TD></TR></TABLE><P> This command creates a certificate request stored in the file <TTCLASS="FILENAME">user.csr</TT>. In this phase, the user enters the values of the fields for the X.509 Certificate as shown. For a certificate request in <SPANCLASS="ACRONYM">PEM</SPAN> format, please see <AHREF="sample-cr.htm">the section called <I>Sample certificate request in PEM format</I> in Appendix B</A>. For a <SPANCLASS="ACRONYM">TXT</SPAN> or human–readable version, please check <AHREF="sample-cr-txt.htm">the section called <I>Sample certificate request in TXT format</I> in Appendix B</A>. </P></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="SIGNCSR">Ask the CA to sign the certificate request</A></H2><P> The CA receives the certificate request, and depending on the policy used, will decide whether to sign the CSR. If it trusts the user, it signs the CSR as follows: </P><P><TABLEBORDER="0"BGCOLOR="#E0E0E0"WIDTH="100%"><TR><TD><PRECLASS="PROGRAMLISTING"><TTCLASS="PROMPT">CA_Admin% </TT><TTCLASS="USERINPUT"><B>./sign.sh user.csr</B></TT>CA signing: user.csr -> user.crt:Using configuration from ca.configEnter PEM pass phrase: <ICLASS="EMPHASIS">enter the pass–phrase</I>Check that the request matches the signatureSignature okThe Subjects Distinguished Name is as followscountryName :PRINTABLE:'GB'stateOrProvinceName :PRINTABLE:'Surrey'localityName :PRINTABLE:'Egham'organizationName :PRINTABLE:'Arts Building Ltd'organizationalUnitName:PRINTABLE:'Dept. History'commonName :PRINTABLE:'Simos Xenitellis'emailAddress :IA5STRING:'S.Xenitellis@rhbnc.ac.uk'Certificate is to be certified until Feb 6 13:30:41 2001 GMT (365 days)Sign the certificate? [y/n]:<TTCLASS="USERINPUT"><B>y</B></TT>1 out of 1 certificate requests certified, commit? [y/n]<TTCLASS="USERINPUT"><B>y</B></TT>Write out database with 1 new entriesData Base UpdatedCA verifying: user.crt <-> CA certuser.crt: OK<TTCLASS="PROMPT">CA_Admin% </TT></PRE></TD></TR></TABLE> </P><P> This command produces a file called <TTCLASS="FILENAME">user.crt</TT>, the Certificate of the user. The <BCLASS="COMMAND">sign.sh</B> script can be found in the modssl package, described above, at the <TTCLASS="FILENAME">/pkg.contrib/</TT> directory. This script uses <SPANCLASS="APPLICATION">openssl</SPAN> as a backend. We use the script and not the manual procedure because with the latter we would have to perform rather several steps and this would be out of the scope of this book. In a future version of this document, we shall revisit this issue. </P></DIV></DIV><DIVCLASS="NAVFOOTER"><HRALIGN="LEFT"WIDTH="100%"><TABLEWIDTH="100%"BORDER="0"CELLPADDING="0"CELLSPACING="0"><TR><TDWIDTH="33%"ALIGN="left"VALIGN="top"><AHREF="initialisation.htm">Prev</A></TD><TDWIDTH="34%"ALIGN="center"VALIGN="top"><AHREF="ospki-book.htm">Home</A></TD><TDWIDTH="33%"ALIGN="right"VALIGN="top"><AHREF="standards-specifications.htm">Next</A></TD></TR><TR><TDWIDTH="33%"ALIGN="left"VALIGN="top">Initialisation of the Certification Authority</TD><TDWIDTH="34%"ALIGN="center"VALIGN="top"><AHREF="implementation-overview.htm">Up</A></TD><TDWIDTH="33%"ALIGN="right"VALIGN="top">PKI standards and specifications</TD></TR></TABLE></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -