CA署名証明書の作成

## 概要

CA署名証明書の作成のメモ
RHEL8には「/etc/pki/tls/misc/CA」スクリプトがなくなったので、
使わない方法でのメモ。
※インストールすれば、もちろん使える。

フローは以下の通り

1. CA作成
1. サーバ証明書作成
1. CAで署名

## 手順書
### CA作成(ファイル編集)

CAが署名可能な種類の明示化

```cmd
# cp -ip /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf_org
# vim /etc/pki/tls/openssl.cnf
264 # nsCertType = sslCA, emailCA
↓
264 nsCertType = sslCA, emailCA

# diff /etc/pki/tls/openssl.cnf_org /etc/pki/tls/openssl.cnf
< # nsCertType = sslCA, emailCA
---
> nsCertType = sslCA, emailCA
```

### CA作成(コマンド実行)

「Country Name」と「State or Province Name」と「Common Name」は指定しとかないと後で
エラーになるので、ある程度ちゃんと指定。

```
# mkdir -p /etc/pki/CA
# mkdir -p /etc/pki/CA/certs
# mkdir -p /etc/pki/CA/crl
# mkdir -p /etc/pki/CA/newcerts
# mkdir -p /etc/pki/CA/private
# touch /etc/pki/CA/index.txt

# openssl req -new -keyout /etc/pki/CA/private/./cakey.pem -out /etc/pki/CA/./careq.pem
Generating a RSA private key
................................+++++
.......................................................................................+++++
writing new private key to '/etc/pki/CA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:*
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
```

```
# openssl ca -create_serial -out /etc/pki/CA/./cacert.pem -days 10950 -batch -keyfile /etc/pki/CA/private/./cakey.pem -selfsign -extensions v3_ca -infiles /etc/pki/CA/./careq.pem
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/./cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            06:7c:44:c4:40:43:9e:fc:41:3f:c6:ac:8f:54:aa:09:f0:6f:b7:c6
        Validity
            Not Before: Jul 24 11:39:19 2021 GMT
            Not After : Jul 17 11:39:19 2051 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = Default Company Ltd
            commonName                = *
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F3:EE:13:57:90:1D:E4:7D:C0:CE:6D:F0:D2:13:BB:8E:CA:DE:4F:92
            X509v3 Authority Key Identifier:
                keyid:F3:EE:13:57:90:1D:E4:7D:C0:CE:6D:F0:D2:13:BB:8E:CA:DE:4F:92

            X509v3 Basic Constraints: critical
                CA:TRUE
            Netscape Cert Type:
                SSL CA, S/MIME CA
Certificate is to be certified until Jul 17 11:39:19 2051 GMT (10950 days)

Write out database with 1 new entries
Data Base Updated
```
### サーバ証明書作成(変数整理)

秘密鍵、CSR、サーバ証明書名前の整理

```cmd
KEY=aaa.key
CSR=aaa.csr
CRT=aaa.crt
```

### サーバ証明書作成(CSR)

CAの「Country Name」が一致していないと署名できなかった気がするので、
一致させること。

```cmd
# openssl req -new -keyout ${KEY} -out ${CSR} -days 10950 
Ignoring -days; not generating a certificate
Generating a RSA private key
.....................................................+++++
...........................+++++
writing new private key to 'aaa.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:*
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
```

### サーバ証明書作成(秘密鍵のパスワード削除)

お好みだが、基本的に削除した方がいい。

```
# openssl rsa -in ${KEY} -out ${KEY}
Enter pass phrase for aaa.key:
writing RSA key
```

### サーバ証明書作成(CA署名)

いよいよ署名。
有効期間は何故かコマンドで指定が出来なくなった気がする。

```
# openssl ca -policy policy_anything -out ${CSR} -infiles ${CSR}
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            06:7c:44:c4:40:43:9e:fc:41:3f:c6:ac:8f:54:aa:09:f0:6f:b7:c7
        Validity
            Not Before: Jul 24 11:51:18 2021 GMT
            Not After : Jul 24 11:51:18 2022 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            localityName              = Default City
            organizationName          = Default Company Ltd
            commonName                = *
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                FB:C9:8D:55:01:5D:95:5D:33:A9:F8:A7:62:5B:41:2F:53:74:74:8B
            X509v3 Authority Key Identifier:
                keyid:F3:EE:13:57:90:1D:E4:7D:C0:CE:6D:F0:D2:13:BB:8E:CA:DE:4F:92

Certificate is to be certified until Jul 24 11:51:18 2022 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
```
 
## おまけ
### サーバ証明書有効期限変更

openssl.cnfを変更するしかない。

```/etc/pki/tls/openssl.cnf
 91 default_days    = 365                  # how long to certify for
↓
 91 default_days    = 3650                 # how long to certify for
```

### CAアンインストール

```
# cd /etc/pki/CA/
# rm -fr cacert.pem ./newcerts/* ./private/* ./index.txt* serial ./serial/*
```