软件

版本

用途

Tomcat

5.0.28

j2sdk

1.4.2_08

带有JSSE，用来产生Tocmcat使用的秘钥对(keystore)

Openssl

0.9.8

用来产生CA证书、签名并生成IE可导入的PKCS#12格式私钥

ActivePerl

5.8.7.813

编译openssl

MinGW

5.0.0

编译openssl

Ms/mw

openssl genrsa -out ca/cakey.pem 1024

openssl req -new -out ca/careq.csr -key ca/cakey.pem

openssl x509 -req -in ca/careq.csr -out ca/cacert.pem -signkey ca/cakey.pem
-days 365

keytool -genkey -alias tomcat_server -validity 365 -keyalg RSA -keysize
1024 -keypass changeit -storepass changeit -dname " CN=redbeans luo, OU=technology,
O=topfounder, L=shanghai, ST=shanghai, C=CN" -keystore server/server_keystore

keytool -certreq -alias tomcat_server -sigalg MD5withRSA -file server/server.csr
-keypass changeit -keystore server/server_keystore -storepass changeit

openssl x509 -req -in server/server.csr -out server/server-cert.pem -CA ca/cacert.pem
-CAkey ca/cakey.pem -CAserial ca/ca-cert.srl -CAcreateserial  -days
365

Loading 'screen' into random state - done

Signature ok

subject=/C=CN/ST=shanghai/L=shanghai/O=topfounder/OU=technology/CN=redbeans
luo

Getting CA Private Key

ca/ca-cert.srl: No such file or directory

3140:error:02001002:system library:fopen:No such file or
directory:./crypto/bio/

bss_file.c:349:fopen('D:/sslca/ca/ca-cert.srl','rb')

3140:error:20074002:BIO routines:FILE_CTRL:system
lib:./crypto/bio/bss_file.c:35

1:

usage: x509 args

 -inform arg     - input format - default PEM (one of
DER, NET or PEM)

 -outform arg    - output format - default PEM (one of
DER, NET or PEM)

 -keyform arg    - private key format - default PEM

 -CAform arg     - CA format - default PEM

 -CAkeyform arg  - CA key format - default PEM

 -in arg         - input file - default stdin

 -out arg        - output file - default stdout

 -passin arg     - private key password source

 -serial         - print serial number value

 -subject_hash   - print subject hash value

 -issuer_hash    - print issuer hash value

 -hash           - synonym for -subject_hash

 -subject        - print subject DN

 -issuer         - print issuer DN

 -email          - print email address(es)

 -startdate      - notBefore field

 -enddate        - notAfter field

 -purpose        - print out certificate purposes

 -dates          - both Before and After dates

 -modulus        - print the RSA key modulus

 -pubkey         - output the public key

 -fingerprint    - print the certificate fingerprint

 -alias          - output certificate alias

 -noout          - no certificate output

 -ocspid         - print OCSP hash values for the
subject name and public key

 -trustout       - output a "trusted"
certificate

 -clrtrust       - clear all trusted purposes

 -clrreject      - clear all rejected purposes

 -addtrust arg   - trust certificate for a given purpose

 -addreject arg  - reject certificate for a given purpose

 -setalias arg   - set certificate alias

 -days arg       - How long till expiry of a signed
certificate - def 30 days

 -checkend arg   - check whether the cert expires in the
next arg seconds

                   exit 1 if so, 0
if not

 -signkey arg    - self sign cert with arg

 -x509toreq      - output a certification request object

 -req            - input is a certificate request,
sign and output.

 -CA arg         - set the CA certificate, must be
PEM format.

 -CAkey arg      - set the CA key, must be PEM format

                   missing, it is
assumed to be in the CA file.

 -CAcreateserial - create serial
number file if it does not exist

 -CAserial arg   - serial file

 -set_serial     - serial number to use

 -text           - print the certificate in text
form

 -C              - print out C code forms

 -md2/-md5/-sha1/-mdc2 - digest to
use

 -extfile        - configuration file with X509V3
extensions to add

 -extensions     - section from config file with X509V3
extensions to add

 -clrext         - delete extensions before signing
and input certificate

 -nameopt arg    - various certificate name options

 -engine e       - use engine e, possibly a hardware
device.

 -certopt arg    - various certificate text options

keytool -import -v -trustcacerts -storepass changeit -alias my_ca_root
-file ca/cacert.pem  -keystore C:/j2sdk1.4.2_08/jre/lib/security/cacerts

keytool -import -v -trustcacerts -storepass changeit -alias
tomcat_server -file server/server-cert.pem -keystore server/server_keystore

keytool -list -keystore C:/j2sdk1.4.2_08/jre/lib/security/cacerts

keytool -list -keystore server/server_keystore