PKI

私有根 CA

1. 创建目录

mkdir -p ~/hsieh-pki/{private,certs,requests,issued}

chmod 700 ~/hsieh-pki/private

tree -pug ~/hsieh-pki/

2. 生成根 CA 私钥

cd ~/hsieh-pki

openssl genrsa -out private/hsieh-root-ca.key 3072

chmod 600 private/hsieh-root-ca.key

验证一下

openssl rsa -in private/hsieh-root-ca.key -check -noout

3. 生成根 CA 证书

openssl req -new -x509 \
  -key private/hsieh-root-ca.key \
  -sha256 \
  -days 3650 \
  -subj '/O=Hsieh Org/CN=Hsieh Org Root CA' \
  -addext 'basicConstraints=critical,CA:true' \
  -addext 'keyUsage=critical,keyCertSign,cRLSign' \
  -out certs/hsieh-root-ca.crt

参数	作用
req -new	生成CSR
-x509	自签名
basicConstraints=critical,CA:true	声明当前是CA
keyCertSign,cRLSign	允许签发证书和签署证书吊销列表

检查一下根 CA 证书

openssl x509 -in certs/hsieh-root-ca.crt \
  -noout -subject -issuer -dates -ext basicConstraints

服务器私钥及 CSR

1. 服务器目录

sudo mkdir -p /etc/ruoyi/tls/{private,certs,requests}

sudo chmod 700 /etc/ruoyi/tls/private

cd /etc/ruoyi/tls

sudo openssl genrsa -out private/ruoyi.hsieh.com.key 2048

sudo chmod 600 private/ruoyi.hsieh.com.key

2. 生成 CSR

sudo openssl req -new \
  -key private/ruoyi.hsieh.com.key \
  -subj '/O=Hsieh Org/CN=*.hsieh.com'
  -addext 'subjectAltName=DNS:*.hsieh.com'
  -out requests/wildcard.hsieh.com.csr

scp requests/wildcard.hsieh.com.csr hsieh@web01.hsieh.com.csr

SAN (subjectAltName) 是域名列表

注意

创建CSR时报错 Segmentation fault，原因是 openssl 版本 bug，解决步骤如下：

1. 查看可更新的候选版本

apt-cache policy openssl

2. 安装更新

apt install --only-upgrade openssl

3. 查看更新后版本

# OpenSSL 3.5.5
openss version

签发服务器证书

在根 CA 机器上

cd ~/hsieh-PKI

tee wildcard.ext << 'EOF'
basicConstraints = critical, CA:false
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:*.hsieh.com
EOF

openssl x509 -req \
  -in requests/wildcard.hsieh.com.csr \
  - CA certs/hsieh-root-ca.crt \
  -CAkey private/hsieh-root-ca.key \
  -CAcreateserial -days 3650 \
  -extfile wildcard.ext \
  -out issued/wildcard.hsieh.com.crt 

验证通配符匹配范围

openssl verify -CAfile certs/hsieh-root-ca.crt \
-verify_hostname www.hsieh.com issued/wildcard.hsieh.com.crt

将签名后的服务器证书拷贝到 web01 服务器

scp ~/hsieh-pki/issued/wildcard.hsieh.com.crt hsieh@web01.hsieh.com:/tmp/

在服务器上将签发后的证书移动到相应目录

mv /tmp/wildcard.hsieh.com.crt /etc/ruoyi/tls/certs/

Nginx 部署证书

在 web01 服务器上安装 Nginx, 确保 ruoyi.hsieh.com 能正常解析，要求 DNS Zone 文件添加相应 A 记录

ruoyi  IN  CNAME  web01.hsieh.com.

创建 nginx 配置文件

/etc/nginx/sites-available/ruoyi-https.conf

server {
  listen 443 ssl;
  server_name ruoyi.hsieh.com;

  ssl_certificate  /etc/ruoyi/tls/certs/ruoyi.hsieh.com.crt;
  ssl_certificate_key /etc/ruoyi/tls/private/ruoyi.hsieh.com.key;

  location / {
    default_type text/html;
    return 200 "ok, ruoyi https test completed.\n"
  }
}

检查配置语法，加载配置

ln -snf /etc/nginx/sites-available/ruoyi-https.conf  /etc/nginx/sites-enabled/default 

nginx -t

nginx -s reload

# 监听 443 端口
ss -ntlp

访问 ruoyi.hsieh.com, 正常输出 'ok, ruoyi https test completed.'