日志
SASL配置
|||
1、在其中一台主机执行，然后发送生成的 lyw_ca_key 和 lyw_ca_cert 到其他主机，这个地方特别注意，这个master是主机名
[lyw@master ~]$ openssl req -new -x509 -keyout lyw_ca_key -out lyw_ca_cert -days 9999 -subj '/C=CN/ST=ChongQing/L=Yubei/O=heraleign/OU=security/CN=master'
Generating a 2048 bit RSA private key
....+++
.............+++
writing new private key to 'lyw_ca_key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
发送lyw_ca_key 和 lyw_ca_cert 到其他主机后，在每台主机执行以下命令：
1.1 keytool -keystore keystore -alias localhost -validity 9999 -genkey -keyalg RSA -keysize 2048 -dname "C=CN,ST=ChongQing,L=Yubei,O=heraleign,OU=security,CN=master"
[lyw@master ~]$ keytool -keystore keystore -alias localhost -validity 9999 -genkey -keyalg RSA -keysize 2048 -dname "C=CN,ST=ChongQing,L=Yubei,O=heraleign,OU=security,CN=master"
输入密钥库口令: z123456789
再次输入新口令:
输入 <localhost> 的密钥口令
(如果和密钥库口令相同, 按回车):
Warning:
JKS 密钥库使用专用格式。建议使用 "keytool -importkeystore -srckeystore keystore -destkeystore keystore -deststoretype pkcs12" 迁移到行业标准格式 PKCS12。
1.2 keytool -keystore truststore -alias CARoot -import -file lyw_ca_cert
[lyw@master ~]$ keytool -keystore truststore -alias CARoot -import -file lyw_ca_cert
输入密钥库口令:
再次输入新口令:
所有者: CN=master, OU=security, O=heraleign, L=Yubei, ST=ChongQing, C=CN
发布者: CN=master, OU=security, O=heraleign, L=Yubei, ST=ChongQing, C=CN
序列号: d519e04341f9e12b
有效期为 Wed Jun 20 22:42:31 CST 2018 至 Sat Nov 04 22:42:31 CST 2045
证书指纹:
MD5: 32:AB:A6:D9:C5:6C:36:F6:D9:D7:D9:2A:88:12:AD:8D
SHA1: E6:FC:14:93:DD:08:EF:52:5A:24:52:26:AB:A9:97:02:D2:DC:1B:9A
SHA256: AF:69:37:A8:25:2D:46:8B:D4:D7:FD:B0:CD:FD:CA:86:52:E5:FA:73:D8:E4:D6:C9:43:C0:EB:65:E7:10:50:DE
签名算法名称: SHA256withRSA
主体公共密钥算法: 2048 位 RSA 密钥
版本: 3
扩展:
#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 7E 55 86 8C 7D 10 B2 F1 B4 A9 A2 00 E6 A7 93 32 .U.............2
0010: 5D 80 89 1D ]...
]
]
#2: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:true
PathLen:2147483647
]
#3: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 7E 55 86 8C 7D 10 B2 F1 B4 A9 A2 00 E6 A7 93 32 .U.............2
0010: 5D 80 89 1D ]...
]
]
是否信任此证书? [否]: 是
证书已添加到密钥库中
1.3 keytool -certreq -alias localhost -keystore keystore -file cert
[lyw@master ~]$ keytool -certreq -alias localhost -keystore keystore -file cert
输入密钥库口令:
Warning:
JKS 密钥库使用专用格式。建议使用 "keytool -importkeystore -srckeystore keystore -destkeystore keystore -deststoretype pkcs12" 迁移到行业标准格式 PKCS12。
1.4 openssl x509 -req -CA lyw_ca_cert -CAkey lyw_ca_key -in cert -out cert_signed -days 9999 -CAcreateserial -passin pass:z123456789
[lyw@master ~]$ openssl x509 -req -CA lyw_ca_cert -CAkey lyw_ca_key -in cert -out cert_signed -days 9999 -CAcreateserial -passin pass:z123456789
Signature ok
subject=/CN=master/OU=security/O=heraleign/L=Yubei/ST=ChongQing/C=CN
Getting CA Private Key
1.5 keytool -keystore keystore -alias CARoot -import -file lyw_ca_cert
[lyw@master ~]$ keytool -keystore keystore -alias CARoot -import -file lyw_ca_cert
输入密钥库口令:
所有者: CN=master, OU=security, O=heraleign, L=Yubei, ST=ChongQing, C=CN
发布者: CN=master, OU=security, O=heraleign, L=Yubei, ST=ChongQing, C=CN
序列号: d519e04341f9e12b
有效期为 Wed Jun 20 22:42:31 CST 2018 至 Sat Nov 04 22:42:31 CST 2045
证书指纹:
MD5: 32:AB:A6:D9:C5:6C:36:F6:D9:D7:D9:2A:88:12:AD:8D
SHA1: E6:FC:14:93:DD:08:EF:52:5A:24:52:26:AB:A9:97:02:D2:DC:1B:9A
SHA256: AF:69:37:A8:25:2D:46:8B:D4:D7:FD:B0:CD:FD:CA:86:52:E5:FA:73:D8:E4:D6:C9:43:C0:EB:65:E7:10:50:DE
签名算法名称: SHA256withRSA
主体公共密钥算法: 2048 位 RSA 密钥
版本: 3
扩展:
#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 7E 55 86 8C 7D 10 B2 F1 B4 A9 A2 00 E6 A7 93 32 .U.............2
0010: 5D 80 89 1D ]...
]
]
#2: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:true
PathLen:2147483647
]
#3: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 7E 55 86 8C 7D 10 B2 F1 B4 A9 A2 00 E6 A7 93 32 .U.............2
0010: 5D 80 89 1D ]...
]
]
是否信任此证书? [否]: 是
证书已添加到密钥库中
Warning:
JKS 密钥库使用专用格式。建议使用 "keytool -importkeystore -srckeystore keystore -destkeystore keystore -deststoretype pkcs12" 迁移到行业标准格式 PKCS12。
1.6 keytool -keystore keystore -alias localhost -import -file cert_signed
[lyw@master ~]$ keytool -keystore keystore -alias localhost -import -file cert_signed
输入密钥库口令:
证书回复已安装在密钥库中
Warning:
JKS 密钥库使用专用格式。建议使用 "keytool -importkeystore -srckeystore keystore -destkeystore keystore -deststoretype pkcs12" 迁移到行业标准格式 PKCS12。
全部作者的其他最新日志
- • NTP
- • Kerberos配置
/2 
