Generating Certificates
Tags: opengauss
Published: 2023-04-18 07:06:27

Scenarios
In the test environment, users can use either of the following methods to test digital certificates. In a customer's operating environment, only a digital certificate obtained from a CA can be used.

Prerequisites
The OpenSSL component has been installed in the Linux environment.

Generating an Automatic Authentication Certificate
Establish a CA environment.


```
-- Suppose that user omm exists, and the CA path is test.
-- Log in to the Linux environment as user root and switch to user omm:
mkdir test
cd /etc/pki/tls
-- Copy the configuration file openssl.cnf to test.
cp openssl.cnf ~/test
cd ~/test
--Establish the CA environment under the test folder.
--Create folder demoCA./demoCA/newcerts./demoCA/private.
mkdir ./demoCA ./demoCA/newcerts ./demoCA/private
chmod 700 ./demoCA/private
--Create the serial file and write it to 01.
echo '01'>./demoCA/serial
-- Create the index.txt file.
touch ./demoCA/index.txt
-- Modify parameters in the openssl.cnf configuration file.
dir  = ./demoCA
default_md      = sha256
--The CA environment has been established.
```
Generate a root private key.


```
--Generate a CA private key.
openssl genrsa -aes256 -out demoCA/private/cakey.pem 2048
Generating RSA private key, 2048 bit long modulus
.................+++
..................+++
e is 65537 (0x10001)
--Set the protection password of the root private key to at least four characters, for example, Test@123.
Enter pass phrase for demoCA/private/cakey.pem:
--Enter the private key password Test@123 again.
Verifying - Enter pass phrase for demoCA/private/cakey.pem:
```
Generate a root certificate request file.

```
--Generate a CA root certificate application file named careq.pem.
openssl req -config openssl.cnf -new -key demoCA/private/cakey.pem -out demoCA/careq.pem
Enter pass phrase for demoCA/private/cakey.pem:
--Enter the root private key password Test@123.
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----

--Note down the following names and use them when entering information in the generated server certificate and client certificate.
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:shanxi
Locality Name (eg, city) []:xian
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abc
Organizational Unit Name (eg, section) []:hello
--Common Name can be randomly set.
Common Name (eg, YOUR name) []:world
--The email address is optional.
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
```
Generate a self-signed root certificate.


```
--When generating the root certificate, modify the openssl.cnf file and set basicConstraints to CA:TRUE.
vi openssl.cnf
-- Generate a CA self-signed root certificate.
openssl ca -config openssl.cnf -out demoCA/cacert.pem -keyfile demoCA/private/cakey.pem -selfsign -infiles demoCA/careq.pem
Using configuration from openssl.cnf
Enter pass phrase for demoCA/private/cakey.pem:
--Enter the root private key password Test@123.
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Feb 28 02:17:11 2017 GMT
            Not After : Feb 28 02:17:11 2018 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = shanxi
            organizationName          = Abc
            organizationalUnitName    = hello
            commonName                = world
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                F9:91:50:B2:42:8C:A8:D3:41:B0:E4:42:CB:C2:BE:8D:B7:8C:17:1F
            X509v3 Authority Key Identifier: 
                keyid:F9:91:50:B2:42:8C:A8:D3:41:B0:E4:42:CB:C2:BE:8D:B7:8C:17:1F

Certificate is to be certified until Feb 28 02:17:11 2018 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
--A CA root certificate named demoCA/cacert.pem has been issued.
```
Generate a private key for the server certificate.


```
--Generate a private key file named server.key.
openssl genrsa -aes256 -out server.key 2048
Generating a 2048 bit RSA private key
.......++++++
..++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
--The password of the server private key must contain a minimum of four characters, for example, Test@123.
Verifying - Enter pass phrase for server.key:
--Confirm the protection password for the server private key Test@123 again.
```
Generate a server certificate request file.

```
--Generate a server certificate request file server.req.
openssl req -config openssl.cnf -new -key server.key -out server.req
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----

--Set the following information and make sure that it is same as that when CA is created.
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:shanxi
Locality Name (eg, city) []:xian
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abc
Organizational Unit Name (eg, section) []:hello
--Common Name can be randomly set.
Common Name (eg, YOUR name) []:world
Email Address []:
--The following information is optional.
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
```
Generate a server certificate.

```

--When generating the server certificate or client certificate, modify the openssl.cnf file and set basicConstraints to CA:FALSE.
vi openssl.cnf
--Change the demoCA/index.txt.attr attribute to no.
vi demoCA/index.txt.attr

--Issue the generated server certificate request file. After it is issued, an official server certificate server.crt is generated.
openssl ca  -config openssl.cnf -in server.req -out server.crt -days 3650 -md sha256
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Feb 27 10:11:12 2017 GMT
            Not After : Feb 25 10:11:12 2027 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = shanxi
            organizationName          = Abc
            organizationalUnitName    = hello
            commonName                = world
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                EB:D9:EE:C0:D2:14:48:AD:EB:BB:AD:B6:29:2C:6C:72:96:5C:38:35
            X509v3 Authority Key Identifier: 
                keyid:84:F6:A1:65:16:1F:28:8A:B7:0D:CB:7E:19:76:2A:8B:F5:2B:5C:6A

Certificate is to be certified until Feb 25 10:11:12 2027 GMT (3650 days)
--Enter y to sign and issue the certificate.
Sign the certificate? [y/n]:y

--Enter y. The certificate singing and issuing is complete.
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
```
Disable password protection for the private key.


```
--Disable the password protection for the server private key.
openssl rsa -in server.key -out server.key
--If the password protection for the server private key is not disabled, you need to use the gs_guc tool to encrypt the password.
gs_guc encrypt -M server -K Test@123 -D ./
--After the password is encrypted using gs_guc, two private key password protection files server.key.cipher and server.key.rand are generated.
```
Generate the client certificate and private key.

Methods and requirements for generating client certificates and private keys are the same as that for server certificates and private keys.


```
--Generate a client private key.
openssl genrsa -aes256 -out client.key 2048
--Generate a certificate request file for a client.
openssl req -config openssl.cnf -new -key client.key -out client.req 
--After the generated certificate request file for client is signed and issued, a formal client certificate client.crt is generated.
openssl ca -config openssl.cnf -in client.req -out client.crt -days 3650 -md sha256
```
Disable password protection for the private key:


```
--Disable the protection for a client private key password.
openssl rsa -in client.key -out client.key
--If password protection for a client private key is not removed, you need to use the gs_guc tool to encrypt the password.
gs_guc encrypt -M client -K Test@123 -D ./  
After the password is encrypted using gs_guc, two private key password protection files client.key.cipher and client.key.rand are generated.
```
Convert the client key to the DER format.


```
openssl pkcs8 -topk8 -outform DER -in client.key -out client.key.pk8 -nocrypt
```
Generate a CRL.

If the CRL is required, you can generate it by following the following procedure:

```
--Create a crlnumber file.
echo '00'>./demoCA/crlnumber
--Revoke a server certificate.
openssl ca -config openssl.cnf -revoke server.crt
--Generate the CRL sslcrl-file.crl
```

openssl ca -config openssl.cnf -gencrl -out sslcrl-file.crl