GENERATE AN OPENSSL CERTIFICATE REQUEST WITH SHA256 SIGNATURE
2015-01-29 16:30
295 查看
http://itigloo.com/security/generate-an-openssl-certificate-request-with-sha-256-signature/
1. Generate a SSL Key File
Firstly you will need to generate a key file. The example below will generate a 2048 bit key file with a SHA-256 signature.
If you want extra security you could increase the bit lengths.
** Please note that both these examples will not add a password to the key file. To do that you will need to add -des3 to the command.
2. Create a Certificate Signing Request (CSR)
This step will create the actually request file that you will submit to the Certificate Authority (CA) of your choice.
You can check that your Certificate Signing Request (CSR) has the correct signature by running the following.
It should display the following if the signature is correct.
3. Install the Certificate (CRT)
This step is very dependant of the software you use and I won’t really cover. All I will say is that these certificates are supported by a multitude of software, including Apache HTTPD and NGINX.
4. Test your installed Certificate
This step is extremely important and will show you any security problems with your SSL configuration.
Qualys have a free hosted service that tests the SSL configuration of Internet facing web servers for SSL issues. The sites tested are rated from A to F, and a report is generated. This report is really useful for tuning your SSL configuration.
https://www.ssllabs.com/
The SSL Labs tests are regularly updated when new issues are discovered. This means that if your server is rated as A today, next week it maybe rated as C.
1. Generate a SSL Key File
Firstly you will need to generate a key file. The example below will generate a 2048 bit key file with a SHA-256 signature.
[code]openssl genrsa -out key_name.key 2048
If you want extra security you could increase the bit lengths.
[code]openssl genrsa -out key_name.key 4096
** Please note that both these examples will not add a password to the key file. To do that you will need to add -des3 to the command.
2. Create a Certificate Signing Request (CSR)
This step will create the actually request file that you will submit to the Certificate Authority (CA) of your choice.
[code]openssl req -out CSR.csr -key key_name.key -new -sha256
You can check that your Certificate Signing Request (CSR) has the correct signature by running the following.
[code]openssl req -in CSR.csr -noout -text
It should display the following if the signature is correct.
[code]Signature Algorithm: sha256WithRSAEncryption
3. Install the Certificate (CRT)
This step is very dependant of the software you use and I won’t really cover. All I will say is that these certificates are supported by a multitude of software, including Apache HTTPD and NGINX.
4. Test your installed Certificate
This step is extremely important and will show you any security problems with your SSL configuration.
Qualys have a free hosted service that tests the SSL configuration of Internet facing web servers for SSL issues. The sites tested are rated from A to F, and a report is generated. This report is really useful for tuning your SSL configuration.
https://www.ssllabs.com/
The SSL Labs tests are regularly updated when new issues are discovered. This means that if your server is rated as A today, next week it maybe rated as C.
相关文章推荐
- 转:How to generate Certificate Signing Request (CSR) file with Apache OpenSSL
- How to sign an IIS SSL certificate request using OpenSSL
- ORACLE -- ArcSDE Lock request conflicts with an established lock
- get an image file with XMLHttpRequest and encode with base64
- ORACLE -- ArcSDE Lock request conflicts with an established lock【转】
- ASN.1 Encode an Object Identifier (OID) with OpenSSL
- Generate an Image with a Random Number
- Verify certificate with OPENSSL and CryptoAPI
- Verify certificate with OPENSSL and CryptoAPI
- Android App Not Install. An existing package by the same name with a conflicting signature is alread
- Verify certificate with OPENSSL and CryptoAPI
- OpenSSL::SSL::SSLError: hostname was not match with the server certificate
- [Recompose] Stream a React Component from an Ajax Request with RxJS
- Has anybody found a way to load HTTPS pages with an invalid server certificate using UIWebView?
- How to Send an HTTP Header With Every Request With Spring RestTemplate
- 解决报错"Your security system have blocked an application with expired or not yet valid certificate from running"
- ArcGIS -- ArcSDE Lock request conflicts with an established lock
- arcgis10.3 报 Lock request conflicts with an established lock。
- Lock request conflicts with an established lock
- Selenium – A exception with a null response was thrown sending an HTTP request