文章目录

• • openssl3.2/test/certs - 004 - cross root and root cross cert
  • 概述
  • 笔记
  • END

openssl3.2/test/certs - 004 - cross root and root cross cert

概述

索引贴 openssl3.2 - 官方demo学习 - test - certs

笔记

// file my_openssl_linux_log_doc_004.txt
// openssl3.2/test/certs - 004 - cross root and root cross cert

// --------------------------------------------------------------------------------
// 官方脚本原始内容
// --------------------------------------------------------------------------------

// # cross root and root cross cert
./mkcert.sh genroot “Cross Root” cross-key cross-root
./mkcert.sh genca “Root CA” root-key root-cross-cert cross-key cross-root

// --------------------------------------------------------------------------------
// 修改后的正常命令行
// --------------------------------------------------------------------------------

// cmd1
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out cross-key.pem

// cmd2
// config file = config_cmd2.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Cross Root

openssl req -new -sha256 -key cross-key.pem -config config_cmd2.txt -out cross-key_req.pem

// cmd3
config file = extfile_cmd3.txt
basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid

openssl x509 -req -sha256 -out cross-root.pem -extfile extfile_cmd3.txt -signkey cross-key.pem -set_serial 1 -days 36525 -in cross-key_req.pem

// cmd4
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out root-key.pem

// cmd5
config file = config_cmd5.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Root CA

openssl req -new -sha256 -key root-key.pem -config config_cmd5.txt -out root-key-req.pem

// cmd6
config file = extfile_cmd6.txt
basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid

openssl x509 -req -sha256 -out root-cross-cert.pem -extfile extfile_cmd6.txt -CA cross-root.pem -CAkey cross-key.pem -set_serial 2 -days 36525 -in root-key-req.pem

// --------------------------------------------------------------------------------
// 改版的openssl记录下的命令行信息和管道输入的配置文件内容
// --------------------------------------------------------------------------------

// cmd1
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out cross-key.pem

// cmd2
openssl req -new -sha256 -key cross-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Cross Root

// cmd3
openssl x509 -req -sha256 -out cross-root.pem -extfile /dev/fd/63 -signkey cross-key.pem -set_serial 1 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid

// cmd4
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out root-key.pem

// cmd5
openssl req -new -sha256 -key root-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Root CA

// cmd6
openssl x509 -req -sha256 -out root-cross-cert.pem -extfile /dev/fd/63 -CA cross-root.pem -CAkey cross-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid

END