SigniertesZertifikat: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 4: | Zeile 4: | ||
<pre>openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out server.crt -keyout server.key | <pre>openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out server.crt -keyout server.key | ||
#oder | #oder | ||
URL=xxx | |||
openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out /etc/ssl/certs/$ | openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out /etc/ssl/certs/$URL.pem -keyout /etc/ssl/private/$URL.key | ||
chgrp ssl-cert /etc/ssl/private/$URL.key ; chmod 640 /etc/ssl/private/$URL.key | |||
</pre> | </pre> | ||
Version vom 26. Mai 2017, 04:04 Uhr
Kurzform
openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out server.crt -keyout server.key #oder URL=xxx openssl req -new -days 999 -newkey rsa:4096bits -sha512 -x509 -nodes -out /etc/ssl/certs/$URL.pem -keyout /etc/ssl/private/$URL.key chgrp ssl-cert /etc/ssl/private/$URL.key ; chmod 640 /etc/ssl/private/$URL.key
Wildcard-Zertifikat
cd /home/CA VALID_DAYS=1000 CERT=hamatoma.de # Schlüssel generieren, kein Passwort: openssl genrsa -out $CERT.key 2048 # Zertifikatsanfrage generieren: CN (Common Name) evt. IP-Adresse # Bei CN (Common Name) eintragen: "*.f-r-e-i.de" openssl req -new -key $CERT.key -out $CERT.csr -sha512 -config ./openssl.cnf # Passwort entfernen: cp $CERT.key $CERT.key.org openssl rsa -in $CERT.key.org -out $CERT.key # Signieren: openssl x509 -req -days $VALID_DAYS -in $CERT.csr -signkey $CERT.key -out $CERT.crt