Openssl-cheat-sheet: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 1: | Zeile 1: | ||
| − | =CA erstellen= | + | =CA, Request, Signierung= |
| + | ==CA erstellen== | ||
*openssl req -new -x509 -newkey rsa:4096 -nodes -keyout ca.key -out ca.crt -days 3650 -subj "/CN=ca.crt" | *openssl req -new -x509 -newkey rsa:4096 -nodes -keyout ca.key -out ca.crt -days 3650 -subj "/CN=ca.crt" | ||
| − | =Request und Privaten Key erstellen= | + | ==Request und Privaten Key erstellen== |
*openssl req -new -newkey rsa:4096 -nodes -keyout www.it113.int.key -out www.it113.int.csr -subj "/CN=www.it113.int" | *openssl req -new -newkey rsa:4096 -nodes -keyout www.it113.int.key -out www.it113.int.csr -subj "/CN=www.it113.int" | ||
| − | =Signierung= | + | ==Signierung== |
*openssl x509 -req -days 730 -in www.it113.int.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out www.it113.int.crt -extfile <(echo "subjectAltName=DNS:www.it113.int") | *openssl x509 -req -days 730 -in www.it113.int.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out www.it113.int.crt -extfile <(echo "subjectAltName=DNS:www.it113.int") | ||
| − | + | =Einbauen der Zertifikate= | |
| − | =Einbauen einer CA in Rocky= | + | ==Einbauen einer CA in Rocky== |
*cp ca.crt /etc/pki/ca-trust/source/anchors/ | *cp ca.crt /etc/pki/ca-trust/source/anchors/ | ||
*update-ca-trust extract | *update-ca-trust extract | ||
| − | =Einbauen einer CA in Debian= | + | ==Einbauen einer CA in Debian== |
*cp ca.crt /usr/local/share/ca-certificates | *cp ca.crt /usr/local/share/ca-certificates | ||
*update-ca-certificates | *update-ca-certificates | ||
Version vom 27. März 2025, 13:59 Uhr
CA, Request, Signierung
CA erstellen
- openssl req -new -x509 -newkey rsa:4096 -nodes -keyout ca.key -out ca.crt -days 3650 -subj "/CN=ca.crt"
Request und Privaten Key erstellen
- openssl req -new -newkey rsa:4096 -nodes -keyout www.it113.int.key -out www.it113.int.csr -subj "/CN=www.it113.int"
Signierung
- openssl x509 -req -days 730 -in www.it113.int.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out www.it113.int.crt -extfile <(echo "subjectAltName=DNS:www.it113.int")
Einbauen der Zertifikate
Einbauen einer CA in Rocky
- cp ca.crt /etc/pki/ca-trust/source/anchors/
- update-ca-trust extract
Einbauen einer CA in Debian
- cp ca.crt /usr/local/share/ca-certificates
- update-ca-certificates