https和server-status配置案例

 1 [root@yinzhengjie ~]# more /etc/pki/tls/openssl.cnf  | grep countryName_default
 2 #countryName_default            = XX            
 3 countryName_default             = CN            ------>修改国家名字为中国
 4 [root@yinzhengjie ~]# 
 5 [root@yinzhengjie ~]# more /etc/pki/tls/openssl.cnf  | grep stateOrProvinceName_default
 6 #stateOrProvinceName_default    = Default Province
 7 stateOrProvinceName_default     = BeiJing    ------->修改省份为北京
 8 [root@yinzhengjie ~]# 
 9 [root@yinzhengjie ~]# more /etc/pki/tls/openssl.cnf  | grep localityName_default
10 #localityName_default   = Default City
11 localityName_default    = Yizhuang Economic Development Zone        ----->修改所在区域
12 [root@yinzhengjie ~]# 
13 [root@yinzhengjie ~]# more /etc/pki/tls/openssl.cnf  | grep 0.organizationName_default
14 #0.organizationName_default     = Default Company Ltd
15 0.organizationName_default      = Chinese Academy of Medical Sciences    ---->修改你所在的单位
16 [root@yinzhengjie ~]# 
17 [root@yinzhengjie ~]# 
18 [root@yinzhengjie ~]# more /etc/pki/tls/openssl.cnf  | grep organizationalUnitName_default
19 #organizationalUnitName_default = World Wide Web Pty Ltd
20 organizationalUnitName_default  = LinuxOperation        ------>修改你担任的职位
21 [root@yinzhengjie ~]# 
22 [root@yinzhengjie CA]# openssl req -new -x509 -key private/cakey.pem -days 3650 -out cacert.pem    
23 You are about to be asked to enter information that will be incorporated
24 into your certificate request.
25 What you are about to enter is what is called a Distinguished Name or a DN.
26 There are quite a few fields but you can leave some blank
27 For some fields there will be a default value,
28 If you enter ‘.‘, the field will be left blank.
29 -----
30 Country Name (2 letter code) [CN]:
31 State or Province Name (full name) [BeiJing]:
32 Locality Name (eg, city) [Yizhuang Economic Development Zone]:
33 Organization Name (eg, company) [Chinese Academy of Medical Sciences]:
34 Organizational Unit Name (eg, section) [LinuxOperation]:
35 Common Name (eg, your name or your server‘s hostname) []:ca.yinzhengjie.org.cn      
36 Email Address []:caadmin@yinzhengjie.org.cn
37 You have new mail in /var/spool/mail/root
38 [root@yinzhengjie CA]# 
39 [root@yinzhengjie CA]# ls
40 cacert.pem  certs  crl  newcerts  private
41 [root@yinzhengjie CA]# 
42 [root@yinzhengjie CA]# touch index.txt serial crlnumber
43 [root@yinzhengjie CA]# echo 01 > serial
44 [root@yinzhengjie CA]# ls
45 cacert.pem  certs  crl  crlnumber  index.txt  newcerts  private  serial
46 [root@yinzhengjie CA]# 

 1 [root@yinzhengjie ssl]# openssl ca -in httpd.csr -out httpd.crt        ----->进行CA签名生成一个证书。
 2 Using configuration from /etc/pki/tls/openssl.cnf
 3 Check that the request matches the signature
 4 Signature ok
 5 Certificate Details:
 6         Serial Number: 2 (0x2)
 7         Validity
 8             Not Before: Oct 22 15:38:27 2017 GMT
 9             Not After : Oct 22 15:38:27 2018 GMT
10         Subject:
11             countryName               = CN
12             stateOrProvinceName       = BeiJing
13             organizationName          = Chinese Academy of Medical Sciences
14             organizationalUnitName    = LinuxOperation
15             commonName                =  www.yinzhengjie.org.cn   
16             emailAddress              = webadmin@yinzhengjie.org.cn
17         X509v3 extensions:
18             X509v3 Basic Constraints: 
19                 CA:FALSE
20             Netscape Comment: 
21                 OpenSSL Generated Certificate
22             X509v3 Subject Key Identifier: 
23                 34:91:A0:33:0C:2C:FB:16:64:9D:E8:D7:1D:B5:10:84:F7:E5:40:6A
24             X509v3 Authority Key Identifier: 
25                 keyid:3E:ED:2C:12:AF:F5:98:40:31:01:E7:8F:51:39:0B:24:4C:ED:41:4B
26 
27 Certificate is to be certified until Oct 22 15:38:27 2018 GMT (365 days)
28 Sign the certificate? [y/n]:y
29 
30 
31 1 out of 1 certificate requests certified, commit? [y/n]y
32 Write out database with 1 new entries
33 Data Base Updated
34 [root@yinzhengjie ssl]# 
35 [root@yinzhengjie ssl]# ll
36 total 16
37 -rw-r--r--. 1 root root 4203 Oct 22 08:38 httpd.crt
38 -rw-r--r--. 1 root root  822 Oct 22 08:37 httpd.csr
39 -rw-------. 1 root root  887 Oct 22 08:37 http.key
40 [root@yinzhengjie ssl]#