demoCA/newcerts/xxxxxx.pem -days 3650 -md sha256 -extensions v3_req Use the CA certificate to sign the key.ĬTU1000047802:/new9 # openssl ca -batch -in.demoCA/newcerts/RootCA.crt -subj '/C=CN/ST=SiChuan/O=Huawei/L=ChengDu/CN=Storage/OU=IT Product Line' -days 5475
You may alter the -days value as needed per your organizations security requirements. CTU1000047802:/new9 # openssl req -new -x509 -sha256 -extensions v3_ca -key. Run the following command to generate a self-signed certificate: openssl req -newkey rsa:2048 -keyout domain.key -x509 -days 3650 -out domain.crt -nodes Note : This command will generate a self-signed certificate that is valid for 3650 days (10 years). Generating RSA private key, 2048 bit long modulus Create directories and files related to certificate files.Use the OpenSSL tool to generate a CA private key and CA certificate files.One way to cater for such cases would be an additional sed: openssl x509 -noout -subject -in server.pem sed s/.CN// sed sed s//.//. A frequent problem when attempting to get client certificates working is that a web client complains it has no certificates or gives an empty list to choose. The IP address is the management IP address of the storage system, XX.XX. The sed commands suggested above wont work if the cert has Relative Distinguished Names (RDNs) specified after the Common Name (CN), for example OU (OrganizationalUnit) or C (Country). Add the subjectAltName option to in the openssl.cnf file.Open the openssl.cnf file and check the default CA directory.To see everything in the certificate, you can do: openssl x509 -in CERT.pem -noout -text To get the SHA256 fingerprint, youd do: openssl x509 -in CERT. CTU1000047802:/ # cd /etc/sslĬa.key ca.pem cacert.pem cert.csr certs demoCA openssl.cnf private private.key The OpenSSL command-line utility can be used to inspect certificates (and private keys, and many other things). You can run the find / -name openssl.cnf command to query the file). Check the location of the openssl.cnf file (Generally, the file is in /etc/ssl/openssl.cnf.(Generally, the OpenSSL tool has been pre-installed in a CentOS or Ubuntu system.) Run the openssl version command to verify that the OpenSSL tool version is 0.9.8j or later. Prepare a Linux-based device where the OpenSSL tool is installed.
0 kommentar(er)
