数字证书认证机构配置
本部分内容中CA（Certificate Authority）均代表数字证书认证机构。
如果已经有搭建的CA，请跳过此步骤。
CA服务器为TLS安全性保证的关键节点，请客户自行构建CA服务器，本流程仅供测试使用，安全性不保证。
- 选择一台服务器做为CA，创建如下目录及文件。
mkdir -p /opt/gcache/secure/CACerts mkdir -p /opt/gcache/secure/CACerts/certs mkdir -p /opt/gcache/secure/CACerts/crl mkdir -p /opt/gcache/secure/CACerts/csr mkdir -p /opt/gcache/secure/CACerts/newcerts mkdir -p /opt/gcache/secure/CACerts/private mkdir -p /opt/gcache/secure/CACerts/public touch /opt/gcache/secure/CACerts/index.txt echo 01 > /opt/gcache/secure/CACerts/serial
- 拷贝位于系统目录的openssl.conf并修改。
cp /etc/pki/tls/openssl.cnf /opt/gcache/secure/CACerts/openssl.cnf chmod 600 /opt/gcache/secure/CACerts/openssl.cnf vi /opt/gcache/secure/CACerts/openssl.cnf
修改如下内容（有则修改，无则添加）。[ CA_default ] dir = /opt/gcache/secure/CACerts certs = $dir/certs crl_dir = $dir/crl unique_subject = no certificate = $certs/ca.crt crl = $crl_dir/crl.pem private_key = $dir/private/ca.self default_md = default [ req ] default_md = sm3 [ v3_req ] keyUsage = nonRepudiation, digitalSignature [ v3enc_req ] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = keyAgreement, keyEncipherment, dataEncipherment [ v3_ca ] keyUsage = cRLSign, keyCertSign
- CA节点生成公私钥，生成公私钥时请输入CA密码，保证密码复杂度。因为后续执行证书签发需要此密码，请妥善保存。
cd /opt/gcache/secure/CACerts openssl genrsa -aes256 -out private/ca.self 4096
openssl rsa -in private/ca.self -pubout -out public/ca.common
- CA节点为自己签发证书。
openssl req -new -x509 -key private/ca.self -days 3650 -out certs/ca.crt -subj "/C=CN/ST=HZ/L=Binjiang/O=Huawei/CN=GCACHED"
父主题： TLS配置
