cd /etc/ssl mkdir CA cd CA mkdir certs crl newcerts private echo 01 > serial touch index.txt chmod -R 600 . chmod -R u+X .
cd /etc/ssl/CA openssl req -new -x509 -out cacert.pem -keyout private/cakey.pem -days 1461 chmod 400 private/cakey.pem
openssl ca -ss_cert cacert.pem -out cert.pem -days 1461
Najprv potrebujeme ziadost o certifikat.
cd /etc/ssl openssl req -new -nodes -out request.pem -keyout key.pem
Ziadost o certifikat podhodime certifikacnej autorite, ktora nam ju potvrdi (vystavi certifikat)
cd /etc/ssl openssl ca -in request.pem -out cert.pem -days 365
openssl genrsa -out mykey.pem 1024
Ak chceme kľúč zašifrovať heslom,pridáme parameter -des3
openssl rsa -in mykey.pem -pubout
openssl req -new -key mykey.pem -out myreq.pem
Vypísanie informácií o certifikáte:
openssl x509 -text -in cert.pem
Vypísanie vybranej informácie (issuer):
openssl x509 -noout -in cert.pem -issuer
Rovnako je možnépoužiť aj -subject -dates -hash -fingerprint
Konverzia do pkcs12 (vrátane súkromného kľúča a chainu):
cat cacert1.pem cacert2.pem cert.pem | openssl pkcs12 -inkey key.pem -export -name "myname" > output.p12
Ak to chceme bez hesla, tak pripojímeparameter -nodes.
openssl pkcs12 -in cert.p12 -nodes | openssl pkcs12 -export -out cert.p12
Certifikát:
openssl x509 -inform PEM -outform DER -in cert.pem -out cert.der
Kľúč:
openssl rsa -inform PEM -outform DER -in key.pem -out key.der
https: HTTP over SSL
openssl s_client -connect remote.host:443
The s_server option allows you to set up an SSL-enabled server from the command line, but it’s I wouldn’t recommend using it for anything other than testing or debugging. If you need a production-quality wrapper around an otherwise insecure server, check out Stunnel instead.
The s_server option works best when you have a certificate; it’s fairly limited without one. the -www option will sent back an HTML-formatted status page to any HTTP clients that request a page
openssl s_server -cert mycert.pem -www
the -WWW option “emulates a simple web server. Pages will be resolved relative to the current directory.” This example is listening on the https port, rather than the default port 4433
openssl s_server -accept 443 -cert mycert.pem -WWW
MD5 hash:
openssl dgst -md5 filename
SHA1 hash:
openssl dgst -sha1 filename
openssl enc -aes-256-cbc < file.txt > file.txt.enc
Dešifrovanie:
openssl enc -aes-256-cbc -d < file.txt.enc > file.txt
netscape certificate type
PKIX key usage