第 6 章 使用本地证书配置智能卡验证

流程

1. 创建可生成证书的目录，例如：

   # mkdir /tmp/ca
   # cd /tmp/ca

   Copy to Clipboard Toggle word wrap

2. 设置证书（将此文本复制到 ca 目录中的命令行）:

   # cat > ca.cnf <<EOF
   [ ca ]
   default_ca = CA_default
   
   [ CA_default ]
   dir              = .
   database         = \$dir/index.txt
   new_certs_dir    = \$dir/newcerts
   
   certificate      = \$dir/rootCA.crt
   serial           = \$dir/serial
   private_key      = \$dir/rootCA.key
   RANDFILE         = \$dir/rand
   
   default_days     = 365
   default_crl_days = 30
   default_md       = sha256
   
   policy           = policy_any
   email_in_dn      = no
   
   name_opt         = ca_default
   cert_opt         = ca_default
   copy_extensions  = copy
   
   [ usr_cert ]
   authorityKeyIdentifier = keyid, issuer
   
   [ v3_ca ]
   subjectKeyIdentifier   = hash
   authorityKeyIdentifier = keyid:always,issuer:always
   basicConstraints       = CA:true
   keyUsage               = critical, digitalSignature, cRLSign, keyCertSign
   
   [ policy_any ]
   organizationName       = supplied
   organizationalUnitName = supplied
   commonName             = supplied
   emailAddress           = optional
   
   [ req ]
   distinguished_name = req_distinguished_name
   prompt             = no
   
   [ req_distinguished_name ]
   O  = Example
   OU = Example Test
   CN = Example Test CA
   EOF

   Copy to Clipboard Toggle word wrap

3. 创建以下目录：

   # mkdir certs crl newcerts

   Copy to Clipboard Toggle word wrap

4. 创建以下文件：

   # touch index.txt crlnumber index.txt.attr

   Copy to Clipboard Toggle word wrap

5. 在串行文件中写入数字 01:

   # echo 01 > serial

   Copy to Clipboard Toggle word wrap

   该命令在串行文件中写入数字 01。它是证书的序列号。当这个 CA 发布一个新证书时这个数字会加一。

6. 创建一个 OpenSSL root CA 密钥：

   # openssl genrsa -out rootCA.key 2048

   Copy to Clipboard Toggle word wrap

7. 创建自签名 root 认证认证机构证书：

   # openssl req -batch -config ca.cnf \ -x509 -new -nodes -key rootCA.key -sha256 -days 10000 \ -set_serial 0 -extensions v3_ca -out rootCA.crt

   Copy to Clipboard Toggle word wrap

8. 为您的用户名创建密钥：

   # openssl genrsa -out example.user.key 2048

   Copy to Clipboard Toggle word wrap

   这个密钥是在本地系统中生成的，因此当密钥保存在卡中时，从系统中删除密钥。

   您还可以直接在智能卡中创建密钥。要做到这一点，请遵循智能卡生产商生成的说明。

9. 创建证书签名请求配置文件（将这个文本复制到 ca 目录中的命令行中）:

   # cat > req.cnf <<EOF
   [ req ]
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   O = Example
   OU = Example Test
   CN = testuser
   
   [ req_exts ]
   basicConstraints = CA:FALSE
   nsCertType = client, email
   nsComment = "testuser"
   subjectKeyIdentifier = hash
   keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, emailProtection, msSmartcardLogin
   subjectAltName = otherName:msUPN;UTF8:testuser@EXAMPLE.COM, email:testuser@example.com
   EOF

   Copy to Clipboard Toggle word wrap

10. 为 example.user 证书创建证书签名请求：

    # openssl req -new -nodes -key example.user.key \ -reqexts req_exts -config req.cnf -out example.user.csr

    Copy to Clipboard Toggle word wrap

11. 配置新证书。过期期限设定为 1 年：

    # openssl ca -config ca.cnf -batch -notext \ -keyfile rootCA.key -in example.user.csr -days 365 \ -extensions usr_cert -out example.user.crt

    Copy to Clipboard Toggle word wrap