openssl 安裝

 

 

6、運行「nmake -f ms\ntdll.mak install」安裝編譯後的OpenSSL到指定目錄。

7、查看安裝結果C:\usr\local\ssl或C:\openssl-0.9.8.e下包含了三個文件夾Bin、include、lib。bin下包括openssl.exe（openssl指令程序）、ssleay32.dll（ssl協議動態庫）、libeay32.dll（密碼算法庫）。lib下包括libeay32.lib，ssleay32.lib。Include目錄包括了OpenSSL開發設計的頭文件。

　　至此，OpenSSL在windows下編譯完成了。

最後一步編譯時可能出現錯誤：「NMAKE : fatal error U1077: 'ml' : return code '0x1' Stop.」，產生這種錯誤的可能緣由是vc6的bin目錄下沒有ml.exe這個文件。該文件包含在MASM程序中。個人解決辦法是到網上下載了一個MASM程序(http://www.masm32.com/masmdl.htm)，安裝上以後把ml.exe拷貝到VC6的bin目錄下便可解決。

二．生成證書和祕鑰

打開openssl.exe文件輸入命令

1. 生成RSA密鑰的方法

key通常分爲public key和private key,在openssl中,private key中包含了public key的信息,因此public key不須要單首創建. 如何建立一個RSA key?

openssl.exe genrsa -des3 -out privkey.pem 2048  (須要添加密碼保護)

這個命令會生成一個2048位的密鑰，同時有一個des3方法加密的密碼，若是你不想要每次都輸入密碼，能夠改爲：

openssl.exe genrsa -out privkey.pem 2048

建議用2048位密鑰，少於此可能會不安全或很快將不安全。

 

2. 生成一個證書請求

openssl req -new -key privkey.pem -outcert.csr

這個命令將會生成一個證書請求，固然，用到了前面生成的密鑰privkey.pem文件

這裏將生成一個新的文件cert.csr，即一個證書請求文件。

 

3. 生成證書

   拿到上面的證書請求文件，去數字證書頒發機構（即CA）申請一個數字證書。CA會給你一個新的文件cacert.pem，那纔是你的數字證書。

 

   若是是本身作測試，那麼證書的申請機構和頒發機構都是本身。就能夠用下面這個命令來生成證書：

    openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095

   這個命令將用上面生成的密鑰privkey.pem生成一個數字證書cacert.pem

 

參考文檔：http://blog.chinaunix.net/uid-20479991-id-216269.html

          http://blog.csdn.net/zh516846937/article/details/40188065

          http://blog.sina.com.cn/s/blog_4913c1f3010008r7.html

http://my.oschina.net/sad7girl/blog/73711

 

 

openssl 生成自簽證書

博客分類：

 
• linux

 

在要生成證書的目錄下創建幾個文件和文件夾，有./demoCA/ ./demoCA/newcerts/  ./demoCA/index.txt ./demoCA/serial，在serial文件中寫入第一個序列號「01」 

1.生成X509格式的CA自簽名證書 
$openssl req -new -x509 -keyout ca.key -out ca.crt 

2.生成服務端的私鑰(key文件)及csr文件 
$openssl genrsa -des3 -out server.key 1024 
$openssl req -new -key server.key -out server.csr 

3.生成客戶端的私鑰(key文件)及csr文件 
$openssl genrsa -des3 -out client.key 1024 
$openssl req -new -key client.key -out client.csr 

4.用生成的CA的證書爲剛纔生成的server.csr,client.csr文件簽名 
$openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key 
$openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key 

5.生成p12格式證書 
$openssl pkcs12 -export -inkey client.key -in client.crt -out client.pfx 
$openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx 

6.生成pem格式證書 
有時須要用到pem格式的證書，能夠用如下方式合併證書文件（crt）和私鑰文件（key）來生成 
$cat client.crt client.key> client.pem 
$cat server.crt server.key > server.pem 

7.PFX文件轉換爲X509證書文件和RSA密鑰文件 
$openssl pkcs12 -in server.pfx -nodes -out server.pem 
$openssl rsa -in server.pem -out server2.key 
$openssl x509 -in server.pem -out server2.crt 

這樣生成服務端證書：ca.crt, server.key, server.crt, server.pem, server.pfx，客戶端證書：ca.crt, client.key, client.crt, client.pem, client.pfx

 

 

 

 

 

 

 

 

 

 

 

 

------------------------------------------------------------------------------------------------------------------------------------------

C:\CA256>openssl genrsa -aes256 -out rootca.key 8192
Loading 'screen' into random state - done
Generating RSA private key, 8192 bit long modulus
......................++
...........................................++
e is 65537 (0x10001)
Enter pass phrase for rootca.key:
Verifying - Enter pass phrase for rootca.key:

C:\CA256>openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt
Enter pass phrase for rootca.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:sichuan
Locality Name (eg, city) []:chengdu
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Root Bitnum CA
Organizational Unit Name (eg, section) []:bitnum
Common Name (e.g. server FQDN or YOUR name) []:Root Bitnum CA
Email Address []:Root Bitnum CA

C:\CA256>cd C:\C256

C:\C256>openssl genrsa -out server-key.pem 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
...++++++
.++++++
e is 65537 (0x10001)

C:\C256>openssl req -new -sha256 -out server-req.csr -key server-key.pem
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:sichuan
Locality Name (eg, city) []:chengdu
Organization Name (eg, company) [Internet Widgits Pty Ltd]:bitnun server
Organizational Unit Name (eg, section) []:bitnun
Common Name (e.g. server FQDN or YOUR name) []:192.168.1.116
Email Address []:192.168.1.116

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:bitnum

C:\C256>openssl x509 -req -sha256 -in server-req.csr -out server-cert.pem -signkey server-key.pem -CA rootca.crt -CAkey rootca.key -CAcreateserial -days 3650
Loading 'screen' into random state - done
Signature ok
subject=/C=CN/ST=sichuan/L=chengdu/O=bitnun server/OU=bitnun/CN=192.168.1.116/emailAddress=192.168.1.116
Getting Private key
Getting CA Private Key
Enter pass phrase for rootca.key:

C:\C256>openssl pkcs12 -export -clcerts -in server-cert.pem -inkey server-key.pem -out server.p12
Loading 'screen' into random state - done
Enter Export Password:
Verifying - Enter Export Password:

C:\C256>