I created a wrapper script, written in Bash, for OpenSSL that might be useful to you here. To me, the easiest sources of user error when using OpenSSL were:
Keeping a consistent and logical naming scheme for configuration/certs/keys so that I can see how every artifact fits into the entire PKI by just looking at the file name/extension
Enforcing a folder structure thats consistent across all CA machines that use the script.
Specifying too many configuration options via CLI and loosing track of some of the details
The strategy is to push all configuration into their own files, saving only execution of a particular action for the CLI. The script also strongly enforces the use of a particular naming scheme for folders/files here which is helpful when looking at any single file.
I like to use the easy-rsa scripts provided with OpenVPN. This is a collection of command line tools used to create the PKI environment required for OpenVPN.
But with a slight change of the (also provided) openssl.cnf file you can create pretty much anything you want with it.
I use that for self signing ssl server certificates as well as with Bacula backup and for creating private keys/csr's for "real" certificates.
just download the OpenVPN community edition source tarball and copy the easy-rsa folder to your linux machine. you'll find lots of documentation on the openvpn community pages.
I used to use CAcert, it's also nice, but you have to create the CSR yourself, so you have to use openssl again and the certs aer only valid for half a year. this is annoying
The XCA software appears reasonably well maintained (copyright 2012, uses Qt4), with a well-documented and simple enough user interface and has packages on debian, ubuntu and fedora.
It's likely that self-signing will give you what you need; here is a page (link resurrected by web.archive.org) that provides a decent guide to self-signing if you would like to know the ins and outs of how it's done and how to create your own script.
The original script link from this response is unfortunately dead and I was unable to find an archive of it, but there are many alternatives for pre-rolled shell scripts out there.
If you're looking for something to support fairly full-featured self-signing, then this guide for 802.1x authentication from tldp.org recommends using the helper scripts for self-signing from FreeRADIUS. Or, if you just need quick-and-dirty, then Ron Bieber offers up his "brain-dead script" for self-signing on his blog at bieberlabs.com.
Of course there are many alternative scripts out there but this seems to give a good range of choices, and with a little additional info from the guide you should be able to tailor these to do whatever you need.
It's also worth checking the SSL Certificates HOWTO. It's quite old now (last updated 2002) but its content is still relevant: it explains how to use the CA Perl / Bash script provided with OpenSSL software.
I know you said you prefer the command line, but for others who are interested in this, TinyCA is a very easy to use GUI CA software. I have used this both in Linux, and also in OSX.
发布评论
评论（7）
我为 OpenSSL 创建了一个包装脚本，用 Bash 编写，可能对您有用。 对我来说，使用 OpenSSL 时最容易出现的用户错误来源是：
该策略是将所有配置推送到它们自己的文件中，仅保存 CLI 的特定操作的执行。 该脚本还强烈强制在此处对文件夹/文件使用特定的命名方案，这在查看任何单个文件时很有帮助。
使用/分叉/PR 走开！ 希望能帮助到你。
I created a wrapper script, written in Bash, for OpenSSL that might be useful to you here. To me, the easiest sources of user error when using OpenSSL were:
The strategy is to push all configuration into their own files, saving only execution of a particular action for the CLI. The script also strongly enforces the use of a particular naming scheme for folders/files here which is helpful when looking at any single file.
Use/Fork/PR away! Hope it helps.
有一个简单的网页解决方案： https://www.ibm.com/ developerworks/mydeveloperworks/blogs/soma/entry/a_pki_in_a_web_page10
There's a simple webpage solution: https://www.ibm.com/developerworks/mydeveloperworks/blogs/soma/entry/a_pki_in_a_web_page10
我喜欢使用 OpenVPN 提供的 easy-rsa 脚本。 这是一个命令行工具的集合，用于创建 OpenVPN 所需的 PKI 环境。
但是，通过对（也提供的）openssl.cnf 文件进行轻微更改，您可以用它创建几乎任何您想要的东西。
我将其用于自签名 ssl 服务器证书以及 Bacula 备份以及为“真实”证书创建私钥/csr。
只需下载 OpenVPN 社区版源代码 tarball 并将 easy-rsa 文件夹复制到您的 Linux 计算机上。 您可以在 openvpn 社区页面上找到大量文档。
我以前用过CAcert，也不错，但是你必须自己创建CSR，所以你必须再次使用openssl，并且证书的有效期只有半年。 这很烦人
I like to use the easy-rsa scripts provided with OpenVPN. This is a collection of command line tools used to create the PKI environment required for OpenVPN.
But with a slight change of the (also provided) openssl.cnf file you can create pretty much anything you want with it.
I use that for self signing ssl server certificates as well as with Bacula backup and for creating private keys/csr's for "real" certificates.
just download the OpenVPN community edition source tarball and copy the easy-rsa folder to your linux machine. you'll find lots of documentation on the openvpn community pages.
I used to use CAcert, it's also nice, but you have to create the CSR yourself, so you have to use openssl again and the certs aer only valid for half a year. this is annoying
XCA 软件看起来维护得相当好（版权 2012，使用 Qt4），具有文档齐全且足够简单的用户界面，并且在 debian、ubuntu 和 fedora 上都有软件包。
不要第一眼就判断该网站：
http://xca.sourceforge.net/
相反，请检查这个很好的演练以添加新的 CA：
http://xca.sourceforge.net/xca-14.html#ss14.1
您可以在那里看到应用程序的屏幕截图：http://sourceforge.net/projects/xca/
但它是基于 GUI 的，而不是命令行。
The XCA software appears reasonably well maintained (copyright 2012, uses Qt4), with a well-documented and simple enough user interface and has packages on debian, ubuntu and fedora.
Don't judge the website at first sight:
http://xca.sourceforge.net/
Rather, check this nice walkthrough to add a new CA:
http://xca.sourceforge.net/xca-14.html#ss14.1
You can see a screenshot of the application there: http://sourceforge.net/projects/xca/
It is GUI-based though, not command-line.
自签名很可能会满足您的需要； 这是一个页面（由 web.archive.org 恢复的链接），如果您想了解自签名的详细信息以及如何创建自己的脚本，该页面提供了一个不错的自签名指南。
不幸的是，此响应中的原始脚本链接已失效，我无法找到它的存档，但有许多预滚动 shell 脚本的替代方案。
如果您正在寻找支持功能相当齐全的自签名的东西，那么 来自 tldp.org 的 802.1x 身份验证指南 建议使用 FreeRADIUS。 或者，如果您只需要快速而肮脏的内容，那么 Ron Bieber 会提供他的 "脑死亡脚本" 在他的博客 bieberlabs.com 上进行自签名。
当然，有很多替代脚本，但这似乎提供了很多选择，并且通过指南中的一些附加信息，您应该能够定制这些脚本来完成您需要的任何操作。
还值得查看 SSL 证书 HOWTO。 它现在已经很老了（最后更新于 2002 年），但其内容仍然相关：它解释了如何使用 OpenSSL 软件提供的
CAPerl / Bash 脚本。It's likely that self-signing will give you what you need; here is a page (link resurrected by web.archive.org) that provides a decent guide to self-signing if you would like to know the ins and outs of how it's done and how to create your own script.
The original script link from this response is unfortunately dead and I was unable to find an archive of it, but there are many alternatives for pre-rolled shell scripts out there.
If you're looking for something to support fairly full-featured self-signing, then this guide for 802.1x authentication from tldp.org recommends using the helper scripts for self-signing from FreeRADIUS. Or, if you just need quick-and-dirty, then Ron Bieber offers up his "brain-dead script" for self-signing on his blog at bieberlabs.com.
Of course there are many alternative scripts out there but this seems to give a good range of choices, and with a little additional info from the guide you should be able to tailor these to do whatever you need.
It's also worth checking the SSL Certificates HOWTO. It's quite old now (last updated 2002) but its content is still relevant: it explains how to use the
CAPerl / Bash script provided with OpenSSL software.我知道您说过您更喜欢命令行，但对于对此感兴趣的其他人，TinyCA< /a> 是一个非常容易使用的GUI CA 软件。 我在 Linux 和 OSX 中都使用过这个。
I know you said you prefer the command line, but for others who are interested in this, TinyCA is a very easy to use GUI CA software. I have used this both in Linux, and also in OSX.
不需要您自己的 CA 的选项是从 CAcert 获取证书（它们是免费的）。
我发现将两个 CAcert 根证书添加到我的客户端计算机很方便，然后我可以通过 CAcert 管理所有 SSL 证书。
An option that doesn't require your own CA is to get certificates from CAcert (they're free).
I find it convenient to add the two CAcert root certificates to my client machines, then I can manage all the SSL certificates through CAcert.