如何使用第三方 CA-非自签名 CA 生成客户端证书

发布于 2024-07-24 05:10:23 字数 829 浏览 9 评论 0原文

我正在尝试导出客户端证书以供网络浏览器使用。

目标是使用来限制访问。向管理区域发出指令。我看过许多有关使用自签名 CA 的教程。您将如何使用第三方来做到这一点？

1) 如果它是受信任的根 CA，我是否需要将 CA 包含在客户端 pfx 中？这两个例子我都见过。

没有 CA：

openssl pkcs12 -export -inkey KEYFILENAME -in CERTFILEFILENAME -out XXX.pfx

有 CA：

openssl pkcs12 -export  -in my.crt- inkey my.key -certfile my.bundle -out my.pfx

2) 我是否仍需要在 httpd.conf 设置中包含受信任 CA 的 SSLCACertificateFile？

SSLVerifyClient none
SSLCACertificateFile conf/ssl.crt/ca.crt
<Location /secure/area>
SSLVerifyClient require
SSLVerifyDepth 1
</Location>

http://www.modssl.org/docs/2.8/ssl_howto.html# ToC8

原文

I am trying to trying to export a client certificate for use with a web browser.

The goal is to restrict access using the <Location> directive to the admin area. I have seen numerous tutorials on using self signed CAs. How would you do this using a third party?

1) Do I need to include the CA in the client pfx if it is a trusted root CA? I have seen both examples.

Without CA:

openssl pkcs12 -export -inkey KEYFILENAME -in CERTFILEFILENAME -out XXX.pfx

With CA:

openssl pkcs12 -export  -in my.crt- inkey my.key -certfile my.bundle -out my.pfx

2) Do I need to still include SSLCACertificateFile for trusted CA in the httpd.conf setup?

SSLVerifyClient none
SSLCACertificateFile conf/ssl.crt/ca.crt
<Location /secure/area>
SSLVerifyClient require
SSLVerifyDepth 1
</Location>

http://www.modssl.org/docs/2.8/ssl_howto.html#ToC8

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

别低头，皇冠会掉 2024-07-31 05:10:23

您不能使用第三方 CA 签名证书颁发客户端证书。您必须拥有自签名 CA 来颁发客户端证书，并将该 CA 指定为 SSLCACertificateFile

示例：

    SSLCertificateFile /etc/apache2/ssl/apache.cer # site certificate signed by verisign
    SSLCertificateKeyFile /etc/apache2/ssl/apache.key # site key for certificate signed by verisign
    SSLCACertificateFile /etc/apache2/ssl/apachelca2.pem # your self signed CA

请注意，apachelca2.pem 中同时包含密钥和证书...命令颁发客户端证书的行：

openssl req -config /usr/share/apache2/ssleay.cnf -new -key client.key -out client.csr

openssl x509 -req -days 365 -CA /etc/apache2/ssl/apachelca2.pem -CAkey /etc/apache2/ssl/apachelca2.pem -CAcreateserial -in client.csr -extfile /usr/share/apache2/ssleay.cnf -extensions v3_req -out client.crt

You can not issue client certificates with third party CA signed certificate. You have to have self signed CA for issuing of client certificates and specify this CA as SSLCACertificateFile

Sample:

    SSLCertificateFile /etc/apache2/ssl/apache.cer # site certificate signed by verisign
    SSLCertificateKeyFile /etc/apache2/ssl/apache.key # site key for certificate signed by verisign
    SSLCACertificateFile /etc/apache2/ssl/apachelca2.pem # your self signed CA

note that apachelca2.pem has both key and certificate in it... command lines to issue client certificates:

openssl req -config /usr/share/apache2/ssleay.cnf -new -key client.key -out client.csr

openssl x509 -req -days 365 -CA /etc/apache2/ssl/apachelca2.pem -CAkey /etc/apache2/ssl/apachelca2.pem -CAcreateserial -in client.csr -extfile /usr/share/apache2/ssleay.cnf -extensions v3_req -out client.crt

回复收藏 0 原文

~没有更多了~