佈署環境(ubuntu 2404)
安裝必要套件
apt update && apt upgrade -y
apt install openssl ca-certificates
建立工作目錄
mkdir -p ~/certwork
chmod 700 ~/certwork
cd ~/certwork
將CSR放到工作資料夾中
certwork#vi prod.abc.com.csr
再將CSR金鑰內容貼入存檔
-----BEGIN CERTIFICATE REQUEST-----
MIIC9TCCAd0CAQAwczELMAkGA1UEBhMCREUxHDAaBgNVBAoTE1NBUCBUcnVzdCBD
b21tdW5pdHkxEzARBgNVBAsTClNBUCBXZWIgQVMxFDASBgNVBAsTC0kwMDIwMjQw
AQUAA4IBDwAwggEKAoIBAQCmnIOUc+3Ht9r736NZH6J/PCUiGCUBtqwo3ggoz+Dd
QdaqnoJrEwxAvzKhWMfgEQ5m2X1MxhrMj1fGoCK9TZejLbGZycOscR5qyxUOmfBS
XeeL7pWZKn+NG1W5XE9vDlS6IdcDMRZSd7PT+sM1UG+3VvV2dI7iLgqyp+ROt5YD
jtbumGbbwtoxlQ7LEmBaHoirfCKJnETH8kjxSUCOp14JkZo/PO2MqVn2rO8WEOm1
Yn+SZEfrvFjXPJiTPqfXymRhsyWA1EpqRjWQ/DtRP+bC5l3kV32V2pd0K6xWunAA
BVXpi5tr0iWNZiDVh93+YTIMeERr/H267C0WIipZmJixAgMBAAGgPTA7BgkqhkiG
9w0BCQ4xLjAsMCoGA1UdEQQjMCGCEnBzE2Rldi5wcm9tYXRlLmNvbYILcHJvbWF0
ZS5jb20wDQYJKoZIhvcNAQEFBQADggEBAAyDOGsH3zl/ld87iJyfHr9/yms5FjLf
HW8Fqvy2kel8liLkxCq07UMotkXSrt+vhUVLyJKa93yYjlnz3i9j/HJ5lIQUd+AE
7UNF7mNObFL154gxV2udiWc0y7DnILBvoErNosJYK0oh1w2MmVWlFbKcifV8uXAI
g6fenm0i47JLMj+YSJkJsqstXX3XyOcM/FXFekkJifrtcGf2dO6Z+YR8Fd0IaXVc
tKh+aCQ3co3dQrXCvENVS851G8GrcgyVOBo7L2pinWLQrVggivCQ7GdjbFbszSFZ
UPf7jkaAfsC4bVyJMtzbfiDm/2roV8FLDQR/G+fHmIblK3hCYzLiyWk=
-----END CERTIFICATE REQUEST-----certwork#ll
prod.abc.com.csr
檢視CSR
certwork#openssl req -in ~/ca/prod.abc.com.csr -noout -text
產 Root CA 私鑰
openssl genrsa -out rootCA.key 4096
openssl genrsa -out rootCA.key 2048openssl genrsa -out rootCA.key 1024 (此次成功)
三個擇一執行(看是要用什麼等級)
建 Root CA 憑證（自簽的 CA）
openssl req -x509 -new -nodes -key rootCA.key -sha-1 -days 7300 \
-subj "/C=TW/O=PSC/CN=PSC Root CA" \
-addext "basicConstraints=critical,CA:true,pathlen:1" \
-addext "keyUsage=critical,keyCertSign,cRLSign" \
-out rootCA.crt
export DOMAIN=”prod.abc.com”
export BASE=”abc.com”
export DAYS=3650 # 10年，可改短一點以符合內規
建立 ext.cnf：
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = prod.abc.com
DNS.2 = abc.com
由CSR產出crt 憑證 ( sha-1演算法, 十年)
openssl x509 -req -in pscdev.csr \
-CA rootCA.crt -CAkey rootCA.key -CAcreateserial \
-out prod.abc.com.crt -days 3650 -sha-1 \
-extfile ./ext.cnf -extensions v3_req
由CSR產出crt 憑證(2年 ,sha256演算法)
openssl x509 -req -in server1.csr \
-CA rootCA.crt -CAkey rootCA.key -CAcreateserial \
-out prod.abc.com.crt -days 730 -sha256 \
-extfile ./ext.cnf -extensions v3_req
將crt憑證轉為p7b憑證
#!/bin/bash建立鏈檔：leaf + root（若你有中繼 CA，順序應為 leaf → intermediate → root）
cat prod.abc.com.crt rootCA.crt > chain.pem
產 DER 格式的 .p7b
openssl crl2pkcs7 -nocrl -certfile chain.pem -out prod.abc.com.p7b -outform DER
檢視 p7b 內容
openssl pkcs7 -in prod.abc.com.p7b -inform DER -print_certs -text -noout | less