Private Key erzeugen
Private key mit RSA 2048 Bit Verschlüsselung erzeugen:
openssl genrsa -des3 -out www.example.com.key 2048
Generating RSA private key, 2048 bit long modulus
...............+++
...................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for www.example.com.key:
Verifying - Enter pass phrase for www.example.com.key:
Signing Request erzeugen
Aus dem private key einen certificate signing request erzeugen:
openssl req -new -key www.example.com.key -out www.example.com.csr
Enter pass phrase for www.example.com.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:NRW
Locality Name (eg, city) []:Leichlingen
Organization Name (eg, company) [Internet Widgits Pty Ltd]:example.com ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:www.example.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Private Key ohne Passphrase erzeugen
Aus dem private key (ohne Passphrases) einen ungeschützten key erzeugen damit z.B. beim Apache Start nicht jedesmal die Passphrase eingegeben werden muss:
openssl rsa -in www.example.com.key -out www.example.com.key.unsecure
Enter pass phrase for www.example.com.key:
writing RSA key
Selfsigned Certificate erzeugen
Aus den obigen Zutaten das Zertifikat backen:
openssl x509 -req -days 3650 -in www.example.com.csr -signkey www.example.com.key.unsecure -out www.example.com.crt
Signature ok
subject: /C: DE/ST: NRW/L: Leichlingen/O: example.com ltd./CN: www.example.com
Getting Private key
Dateien
Das Ergebnis sind die folgenden Dateien:
- www.example.com.key.unsecure – Dies ist der private Schlüssel
- www.example.com.crt – Der öffentliche Schlüssel
Diese können nun z.B. nach /etc/apache2/ssl/ kopiert und in der httpd.conf genutzt werden.