Cómo Instalar y Configurar Una Entidad de Certificación (CA) en Debian 10 - DigitalOcean

Cómo instalar y configurar una entidad de certificación (CA) en D... https://www.digitalocean.com/community/tutorials/how-to-set-up-a...
1 de 22 03/02/2021 09:31 a. m.
sudo
easy-rsa easy-rsa
2 de 22 03/02/2021 09:31 a. m.
$ sudo apt update

$ sudo apt install easy-rsa
easy-rsa
easy-rsa
$ mkdir ~/easy-rsa
easy-rsa
easy-rsa
/usr/share/easy-rsa
ln
$ ln -s /usr/share/easy-rsa/* ~/easy-rsa/
3 de 22 03/02/2021 09:31 a. m.
easy-rsa
easy-rsa
chmod
$ chmod 700 /home/sammy/easy-rsa
easy-rsa
$ cd ~/easy-rsa
$ ./easyrsa init-pki
init-pki complete; you may now create a CA or requests.

Your newly created PKI dir is: /home/sammy/easy-rsa/pki
vars cd
easy-rsa vars nano
$ cd ~/easy-rsa
$ nano vars
4 de 22 03/02/2021 09:31 a. m.
set_var EASYRSA_REQ_COUNTRY " US "

set_var EASYRSA_REQ_PROVINCE " NewYork "
set_var EASYRSA_REQ_CITY " New York City "
set_var EASYRSA_REQ_ORG " DigitalOcean "
set_var EASYRSA_REQ_EMAIL " admin@example.com "
set_var EASYRSA_REQ_OU " Community "
nano
CTRL+X Y INTRO
./easy-rsa
build-ca
$ ./easyrsa build-ca
. . .
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
. . .
5 de 22 03/02/2021 09:31 a. m.
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/home/sammy/easy-rsa/pki/ca.crt
build-ca nopass
$ ./easyrsa build-ca nopass
~/easy-rsa/pki/ca.crt
~/easy-rsa/pki/private/ca.key
ca.crt
ca.key
ca.key
ca.key
6 de 22 03/02/2021 09:31 a. m.
ca.crt
ca.crt
cat
scp rsync
nano
$ cat ~/easy-rsa/pki/ca.crt
-----BEGIN CERTIFICATE-----
MIIDSzCCAjOgAwIBAgIUcR9Crsv3FBEujrPZnZnU4nSb5TMwDQYJKoZIhvcNAQEL
BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjAwMzE4MDMxNjI2WhcNMzAw
. . .
. . .
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
nano
/tmp/ca.crt
7 de 22 03/02/2021 09:31 a. m.
$ nano /tmp/ca.crt
nano CTRL+X Y INTRO
ca.crt
$ cp /tmp/ca.crt /usr/local/share/ca-certificates/
$ update-ca-certificates
/tmp/ca.crt
/etc/pki/ca-trust/source/anchors/ update-ca-trust
$ sudo cp /tmp/ca.crt /etc/pki/ca-trust/source/anchors/

$ update-ca-trust
ca.crt
8 de 22 03/02/2021 09:31 a. m.
certutil.exe
ca.crt
9 de 22 03/02/2021 09:31 a. m.
easy-rsa
openssl
openssl
$ sudo apt update

$ sudo apt install openssl
openssl y
openssl
openssl practice-csr
sammy-server
$ mkdir ~/practice-csr
$ cd ~/practice-csr
$ openssl genrsa -out sammy-server.key
Generating RSA private key, 2048 bit long modulus (2 primes)

. . .
. . .
e is 65537 (0x010001)
openssl
.
$ openssl req -new -key sammy-server.key -out sammy-server.req
10 de 22 03/02/2021 09:31 a. m.
. . .
-----
Country Name (2 letter code) [XX]: US
State or Province Name (full name) []: New York
Locality Name (eg, city) [Default City]: New York City
Organization Name (eg, company) [Default Company Ltd]: DigitalOcean
Organizational Unit Name (eg, section) []: Community
Common Name (eg, your name or your server's hostname) []: sammy-server
Email Address []:
Please enter the following 'extra' attributes

to be sent with your certificate request
A challenge password []:
An optional company name []:
openssl
-subj
$ openssl req -new -key sammy-server.key -out server.req -subj \

$ /C= US /ST= New\ York /L= New\ York\ City /O= DigitalOcean /OU= Community /CN= sammy-server
openssl
$ openssl req -in sammy-server.req -noout -subject
subject=C = US, ST = New York, L = New York City, O = DigitalOcean, OU = Community, CN = sammy-ser
sammy-server.req scp
$ scp sammy-server.req sammy@ your_ca_server_ip :/tmp/sammy-server.req
sammy-server
11 de 22 03/02/2021 09:31 a. m.
/tmp
easy-rsa easy-rsa
openssl
easy-rsa
$ cd ~/easy-rsa
$ ./easyrsa import-req /tmp/sammy-server.req sammy-server
. . .
The request has been successfully imported with a short name of: sammy-server
You may now use this name to perform signing operations on this request.
easyrsa
sign-req
client server ca
server
12 de 22 03/02/2021 09:31 a. m.
$ ./easyrsa sign-req server sammy-server
yes ENTER
You are about to sign the following certificate.

Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 3650 days:
subject=
commonName = sammy-server
Type the word 'yes' to continue, or any other input to abort.

Confirm request details: yes
. . .
Certificate created at: /home/sammy/easy-rsa/pki/issued/sammy-server.crt
sammy-server.req
/home/sammy/easy-rsa/pki/private/ca.key
sammy-server.crt
sammy-server
sammy-server.crt ca.crt
$ scp pki/issued/sammy-server.crt sammy@ your_server_ip :/tmp

$ scp pki/ca.crt sammy@ your_server_ip :/tmp
13 de 22 03/02/2021 09:31 a. m.
./easyrsa revoke client-name
./easyrsa gen-crl
crl.pem
revoke
easy-rsa
$ cd ~/easy-rsa
easyrsa revoke
sammy-server
$ ./easyrsa revoke sammy-server
yes
14 de 22 03/02/2021 09:31 a. m.
Please confirm you wish to revoke the certificate with the following subject:
subject=
commonName = sammy-server
Type the word 'yes' to continue, or any other input to abort.

Continue with revocation: yes
. . .
Revoking Certificate 8348B3F146A765581946040D5C4D590A
. . .
Revoking Certificate
crl.pem
easy-rsa gen-crl
~/easy-rsa
$ ./easyrsa gen-crl
ca.key
gen-crl crl.pem
15 de 22 03/02/2021 09:31 a. m.
crl.pem
gen-crl
scp
your_server_ip
$ scp ~/easy-rsa/pki/crl.pem sammy @ your_server_ip :/tmp
crl.pem crl.pem
systemctl
crl.pem
openssl easy-rsa
16 de 22 03/02/2021 09:31 a. m.
$ cd ~/easy-rsa
$ openssl crl -in pki/crl.pem -noout -text
openssl crl.pem
crl.pem
sammy-server openssl
$ openssl crl -in /tmp/crl.pem -noout -text |grep -A 1 8348B3F146A765581946040D5C4D590A
Serial Number: 8348B3F146A765581946040D5C4D590A

Revocation Date: Apr 1 20:48:02 2020 GMT
grep
17 de 22 03/02/2021 09:31 a. m.
18 de 22 03/02/2021 09:31 a. m.
19 de 22 03/02/2021 09:31 a. m.
20 de 22 03/02/2021 09:31 a. m.
21 de 22 03/02/2021 09:31 a. m.
22 de 22 03/02/2021 09:31 a. m.

Cómo Instalar y Configurar Una Entidad de Certificación (CA) en Debian 10 - DigitalOcean

Cargado por

Información del documento

Descripción original:

Derechos de autor

Formatos disponibles

Compartir este documento

Compartir o incrustar documentos

Opciones para compartir

¿Le pareció útil este documento?

¿Este contenido es inapropiado?

Copyright:

Formatos disponibles

Cómo Instalar y Configurar Una Entidad de Certificación (CA) en Debian 10 - DigitalOcean

Cargado por

Copyright:

Formatos disponibles

Cómo instalar y configurar una entidad de certificación (CA) en D... https://www.digitalocean.com/community/tutorials/how-to-set-up-a...

$ sudo apt update

$ chmod 700 /home/sammy/easy-rsa

init-pki complete; you may now create a CA or requests.

set_var EASYRSA_REQ_COUNTRY " US "

$ ./easyrsa build-ca nopass

nano CTRL+X Y INTRO

$ sudo cp /tmp/ca.crt /etc/pki/ca-trust/source/anchors/

$ sudo apt update

Generating RSA private key, 2048 bit long modulus (2 primes)

$ openssl req -new -key sammy-server.key -out sammy-server.req

Please enter the following 'extra' attributes

$ openssl req -new -key sammy-server.key -out server.req -subj \

$ openssl req -in sammy-server.req -noout -subject

$ scp sammy-server.req sammy@ your_ca_server_ip :/tmp/sammy-server.req

$ ./easyrsa sign-req server sammy-server

You are about to sign the following certificate.

Request subject, to be signed as a server certificate for 3650 days:

Type the word 'yes' to continue, or any other input to abort.

$ scp pki/issued/sammy-server.crt sammy@ your_server_ip :/tmp

./easyrsa revoke client-name

$ ./easyrsa revoke sammy-server

Type the word 'yes' to continue, or any other input to abort.

$ scp ~/easy-rsa/pki/crl.pem sammy @ your_server_ip :/tmp

$ openssl crl -in /tmp/crl.pem -noout -text |grep -A 1 8348B3F146A765581946040D5C4D590A

Serial Number: 8348B3F146A765581946040D5C4D590A

También podría gustarte