如何创建X509根证书并分发从属证书
我一直在研究如何创建 X509 证书，我有点困惑。我理解这个理论，并且创建单个证书是可以的，但我不具备创建整个系统的操作知识。
要求如下：
1) 有一台主服务器。此 SSL 证书不会由任何机构签名：它是根证书。该证书（或至少是验证它的方法）将随应用程序一起分发。
2) 可以有任意数量的辅助服务器。每个都会生成自己的证书并将其提交到主服务器。
3) 主服务器将与根服务器签署辅助证书。
用例是客户端连接到辅助服务器并且必须能够验证其证书是否已由根签名。
注意：主服务器由 DNS 主机名标识。辅助服务器可以仅通过IP地址来命名或识别。
四个问题：
有人可以向我展示 openssl 命令来完成这三个步骤吗？
这些步骤生成的哪些文件（如果有）不应该分发？
第3步之后，主站是否必须将修改后的证书返回给从站？
辅助证书是否必须由受信任的主证书分发，或者客户端是否足以验证辅助证书所公布的任何证书？
I've been looking at how to create X509 certificates and I'm a bit confused. I understand the theory, and creating a single certificate is OK, but I don't have the operational know-how to create the system as a whole.
Here are the requirements:
1) There will be one master server. The SSL certificate for this will not be signed by any authority: it is the root. This certificate (or at least the means to verify it) will be distributed with the application.
2) There may be any number of secondary servers. Each will generate its own certificate and submit it to the master server.
3) The master server will sign secondary certificates with the root.
The use-case is that a client connects to a secondary server and must be able to verify that its certificate has been signed by the root.
N.B. The master server is identified by a DNS hostname. The secondary servers may be named or may be identified by IP address alone.
Four questions:
Can someone please show me the openssl commands to accomplish each of those three steps?
Which, if any, of the files generated by those steps should not be distributed?
After step 3, does the master have to return a modified certificate to the secondary?
Do the secondary certificates have to be distributed by the trusted master, or is it sufficient for the client to validate any certificate advertised by the secondary?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
OpenSSL 附带了一个可用于创建基本 CA 的脚本：CA.pl 。 （当然，您可以通过更改 OpenSSL 配置文件来更详细地配置它。）
辅助服务器应生成证书请求 (CSR)，CA 可以处理该请求以颁发证书（在您选择的验证过程之后）。
关于文件分发：各方应保密其私钥。
OpenSSL comes with a script useful for creating a basic CA: CA.pl. (You can of course configure it in more details by altering the OpenSSL configuration file.)
What the secondary servers should generate are Certificate Requests (CSR), which the CA can process to issue certificates (after a validation process of your choice).
Regarding file distributions: all parties should keep their private keys private.