此内容没有您所选择的语言版本。

E.2. Creating an SSL Certificate

Summary

The following procedure creates an SSL certificate and signs it with the CA key. SSL/TLS certificates provide a layer of security for accessing your installation over HTTPS. This procedure provides instructions for creating certificates and configuring the server with them.

The following procedure requires openssl. To install this tool, run the following command on your server:

#yum install openssl

#yum install openssl

Copy to Clipboard

Toggle word wrap

Procedure E.2. Creating an SSL Certificate

Create a key for your server:
```
#openssl genrsa -out ssl.key
```
```
#openssl genrsa -out ssl.key
```
Copy to Clipboard Toggle word wrap
This creates an ssl.key file.

Use the key to create a signing request for your certificate:

#openssl req -new -key ssl.key -out ssl.csr

#openssl req -new -key ssl.key -out ssl.csr

Copy to Clipboard

Toggle word wrap

The signing request asks for some organization details to form the Distinguished Name (DN) in your certificate.

Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Karnataka
Locality Name (eg, city) [Default City]:Bangalore
Organization Name (eg, company) [Default Company Ltd]:Red Hat
Organizational Unit Name (eg, section) []:Engineering Content Services
Common Name (eg, your name or your server's hostname) []:www.example.com
Email Address []:psriniva@redhat.com

Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Karnataka
Locality Name (eg, city) [Default City]:Bangalore
Organization Name (eg, company) [Default Company Ltd]:Red Hat
Organizational Unit Name (eg, section) []:Engineering Content Services
Common Name (eg, your name or your server's hostname) []:www.example.com
Email Address []:psriniva@redhat.com

Copy to Clipboard

Toggle word wrap

This creates an ssl.csr signing request file.

Create the signed SSL certificate:
```
Create the signed SSL certificate:
```
```
Create the signed SSL certificate:
```
Copy to Clipboard Toggle word wrap
openssl asks for your CA key's password.
This creates a certificate file named ssl.crt.

Important

The above command may result in the following error:

Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ca.key:
/etc/pki/CA/index.txt: No such file or directory
unable to open '/etc/pki/CA/index.txt'
139883256969032:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('/etc/pki/CA/index.txt','r')
139883256969032:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:

Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ca.key:
/etc/pki/CA/index.txt: No such file or directory
unable to open '/etc/pki/CA/index.txt'
139883256969032:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('/etc/pki/CA/index.txt','r')
139883256969032:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:

Copy to Clipboard

Toggle word wrap

Procedure E.3. Resolving this error

Create the index.txt file.
```
#touch /etc/pki/CA/index.txt
```
```
#touch /etc/pki/CA/index.txt
```
Copy to Clipboard Toggle word wrap
Create a serial file to label the CA and all subsequent certificates.
```
#echo '1000' > /etc/pki/CA/serial
```
```
#echo '1000' > /etc/pki/CA/serial
```
Copy to Clipboard Toggle word wrap

You will only need to do this the first time you set up the SSL certificate. Re-run the command:

#openssl ca -cert ca.crt -keyfile ca.key -out ssl.crt -infiles ssl.csr

#openssl ca -cert ca.crt -keyfile ca.key -out ssl.crt -infiles ssl.csr

Copy to Clipboard

Toggle word wrap

The ssl.crt and ssl.key form the certificate pair that your server uses to encrypt data via HTTPS.

Conclusion

You have created an SSL certificate and signed it with the CA key. openssl creates two files: ca.key, which is a key that administrators use to sign certificates, and ca.crt, which is the public CA certificate that users obtain to verify the validity of signed certificates they receive. Make sure users accessing your server have a copy of the ca.crt so that they can import it into their client's trusted CA store.

22632%2C+Console+Developer+Guide-322-09-2014+17%3A11%3A35Report a bug

返回顶部

此内容没有您所选择的语言版本。

E.2. Creating an SSL Certificate

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links