original: http://apps.hi.baidu.com/share/detail/30995314


弄了差不多两天的证书，头都大了 走了很多弯路，把知识拿出来跟大家share下，其实并不复杂。

背景：我们有个WEB服务器，比如TOMCAT，在TOMCAT上我们部署了个应用http://localhost:8080/sslPro, 当我们从浏览器以安全模式，即https访问这个应用时，用到的知识数字证书,数字签名。这里我们只讲到单向认证，即服务器端认证。当我从浏览器访问服务器时，我们的目的是要确认我现在访问的就是localhost上的sslPro,反过来服务器向我证明我就是localhost.

目的：我们要做的事是：用keytool生成证书签名请求，用openssl生成自签名证书，然后模拟CA用自己生成的自签名证书对签名请求进行签名，并把根证书及签名后的证书倒入到KEYSTORE中

准备：J2SDK在目录%JAVA_HOME%/bin提供了密钥库管理工具Keytool，用于管理密钥、证书和证书链。Keytool工具的命令在JavaSE6中已经改变，不过以前的命令仍然支持。Keytool也可以用来管理对称加密算法中的密钥。有关Keytool的知识可以参考：http://java.sun.com/j2se/1.5.0/docs/tooldocs/windows/keytool.html。有关openssl的知识请参考：http://www.openssl.org。 下面的准备很重要，(1)把openssl目录下的文件openssl.cnf文件拷贝到openssl的bin目录下，在bin目录下新建目录demoCA、demoCA/certs、demoCA/private、 demoCA/newcerts (2) 在demoCA建立一个空文件 index.txt (3) 在demoCA建立一个文本文件 serial, 没有扩展名，内容是一个合法的16进制数字，例如 0011, 我曾经写过0000，但会导致根证书跟签名证书的序列号都是0，所以不行，建议不写0000。(4) 配置好JDK的环境变量

过程：
a. 生成密钥对
Keytool –genkey –alias test –keystore test.jks 根据提示输入信息，记住：输入的信息必须跟后面的自签名证书信息一致,名字与姓氏我们这里应该输入localhost。 可以用-list查看信息。(到这一步，其实我们可以用export命令导出证书到cer文件，然后把cer文件导入到浏览器，这就是我们自己生成的没有经过签名的证书)
b. 生成证书签名请求
Keytool –certreq –alias test –keystore test.jks –file test.csr。
c. 生成CA的自签名证书
openssl req -new -x509 -keyout root.key -out root.crt -config openssl.cnf 输入信息
d. 把test.csr拷贝到openssl的bin目录下，用CA私钥进行签名(当然也可以到权威机构申请CA签名，但要花很多钱)。
   openssl ca -in test.csr -out demo.crt -cert root.crt -keyfile root.key -notext -config openssl.cnf （其中-notext表示不要把证书文件的明文内容输出到文件中去，否则在后面用keytool导入到keystore时会出错。） 。可以用openssl x509 -noout -text -in root.crt 命令查看
e. 导入信任的CA根证书到keystore
   keytool -import -v -alias test2 -file root.crt -keystore test.jks
这一步你也可以把根证书倒入到keystore cacerts中，在目录%JAVA_HOME%\jre\lib\security 目录下，有关cacerts的官方资料如下：
The "cacerts" file represents a system-wide keystore with CA certificates. System administrators can configure and manage that file using keytool, specifying "jks" as the keystore type. The initial password of the "cacerts" keystore file is "changeit". 详细信息可参考：http://java.sun.com/j2se/1.5.0/docs/tooldocs/windows/keytool.html#cacerts
f. 把CA签名后的证书导入到keystore
keytool -import -v -trustcacerts -alias test –file demo.crt -keystore test.jks
好了，把test.jks拷贝到你应用的WEB-INF目录下。配置tomcat服务器，如下：
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               keystorePass="changeit" keystoreFile="webapps\sslPro\WEB-INF\test.jks          
               keyAlias="test" "/>
现在当你用HTTPS访问你的应用时，如https://localhost:8443/proTest会出来一个框框，说此证书不在你的信用列表里，问是否信用。这个时候你还有一件事情要做，就是把你信用的根证书导入到你的浏览器中，下次在访问时这个小框框就不会出来了，因为你已经信用它了。
这样自己签名的证书就做好了。写来简单 ， 但也花了不少时间。
两个比较好的参考文章：http://zhouzhk.javaeye.com/blog/136943，http://industry.ccidnet.com/art/1078/20030709/53943_2.html

有关SSL的工作原理读者可以参考下篇文章。

命令运行过程DOS窗口全记录

C:\TEMP\2>openssl genrsa -des3 -out server.key 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
...++++++
.............................................................++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
5816:error:28069065:lib(40):UI_set_result:result too small:.\crypto\ui\ui_lib.c:850:You must type in 4 to 511 characters

Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

C:\TEMP\2>openssl req -new -key server.key -out server.csr -config openssl.cfg
Enter pass phrase for server.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:bj
Locality Name (eg, city) []:bj
Organization Name (eg, company) [Internet Widgits Pty Ltd]:v
Organizational Unit Name (eg, section) []:v
Common Name (eg, YOUR name) []:z
Email Address []:p@1

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1234
An optional company name []:v

C:\TEMP\2>openssl genrsa -des3 -out client.key 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
..........................++++++
.++++++
e is 65537 (0x10001)
Enter pass phrase for client.key:
Verifying - Enter pass phrase for client.key:

C:\TEMP\2>openssl req -new -key client.key -out client.csr -config openssl.cfg
Enter pass phrase for client.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:bj
Locality Name (eg, city) []:bj
Organization Name (eg, company) [Internet Widgits Pty Ltd]:v
Organizational Unit Name (eg, section) []:v
Common Name (eg, YOUR name) []:z
Email Address []:p@1

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1234
An optional company name []:v

C:\TEMP\2>openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cfg
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.......................................++++++
................++++++
writing new private key to 'ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:bj
Locality Name (eg, city) []:bj
Organization Name (eg, company) [Internet Widgits Pty Ltd]:v
Organizational Unit Name (eg, section) []:v
Common Name (eg, YOUR name) []:z
Email Address []:p@1

C:\TEMP\2>Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cfg
Using configuration from openssl.cfg
Loading 'screen' into random state - done
Enter pass phrase for ca.key:
unable to load number from C:/TEMP/2/demoCA/serial
error while loading serial number
4176:error:0D066091:asn1 encoding routines:a2i_ASN1_INTEGER:odd number of chars:.\crypto\asn1\f_int.c:162:

C:\TEMP\2>Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cfg
Using configuration from openssl.cfg
Loading 'screen' into random state - done
Enter pass phrase for ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Apr 24 02:31:47 2012 GMT
            Not After : Apr 24 02:31:47 2013 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = bj
            organizationName          = v
            organizationalUnitName    = v
            commonName                = z
            emailAddress              = p@1
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                E5:BE:16:C6:48:0D:91:1D:52:7C:3A:2C:7C:EF:9C:2D:FA:9A:12:32
            X509v3 Authority Key Identifier:
                keyid:97:6F:59:B9:97:EB:37:BB:89:54:12:7E:A3:72:BE:92:AE:83:2E:5B

Certificate is to be certified until Apr 24 02:31:47 2013 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

C:\TEMP\2>Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
Using configuration from openssl.cnf
error loading the config file 'openssl.cnf'
1920:error:02001002:system library:fopen:No such file or directory:.\crypto\bio\bss_file.c:126:fopen('openssl.cnf','rb')

1920:error:2006D080:BIO routines:BIO_new_file:no such file:.\crypto\bio\bss_file.c:129:
1920:error:0E078072:configuration file routines:DEF_LOAD:no such file:.\crypto\conf\conf_def.c:197:

C:\TEMP\2>Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
Using configuration from openssl.cnf
error loading the config file 'openssl.cnf'
2608:error:02001002:system library:fopen:No such file or directory:.\crypto\bio\bss_file.c:126:fopen('openssl.cnf','rb')

2608:error:2006D080:BIO routines:BIO_new_file:no such file:.\crypto\bio\bss_file.c:129:
2608:error:0E078072:configuration file routines:DEF_LOAD:no such file:.\crypto\conf\conf_def.c:197:

C:\TEMP\2>Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cfg
Using configuration from openssl.cfg
Loading 'screen' into random state - done
Enter pass phrase for ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Apr 24 02:35:33 2012 GMT
            Not After : Apr 24 02:35:33 2013 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = bj
            organizationName          = v
            organizationalUnitName    = v
            commonName                = z
            emailAddress              = p@1
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                50:61:5E:EE:38:C3:7D:41:66:C7:68:5F:29:9C:96:1E:C2:67:7C:E3
            X509v3 Authority Key Identifier:
                keyid:97:6F:59:B9:97:EB:37:BB:89:54:12:7E:A3:72:BE:92:AE:83:2E:5B

Certificate is to be certified until Apr 24 02:35:33 2013 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

C:\TEMP\2>type client.crt client.key > client.pem

client.crt

client.key

C:\TEMP\2>type server.crt server.key > server.pem

server.crt

server.key

C:\TEMP\2>openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
Loading 'screen' into random state - done
Enter pass phrase for client.key:
Enter Export Password:
Verifying - Enter Export Password:

C:\TEMP\2>openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12
Loading 'screen' into random state - done
Enter pass phrase for server.key:
Enter Export Password:
Verifying - Enter Export Password:

C:\TEMP\2>C:\TEMP\2>openssl genrsa -des3 -out server.key 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
...++++++
.............................................................++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
5816:error:28069065:lib(40):UI_set_result:result too small:.\crypto\ui\ui_lib.c:850:You must type in 4 to 511 characters

Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

C:\TEMP\2>openssl req -new -key server.key -out server.csr -config openssl.cfg
Enter pass phrase for server.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:bj
Locality Name (eg, city) []:bj
Organization Name (eg, company) [Internet Widgits Pty Ltd]:v
Organizational Unit Name (eg, section) []:v
Common Name (eg, YOUR name) []:z
Email Address []:p@1

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1234
An optional company name []:v

C:\TEMP\2>openssl genrsa -des3 -out client.key 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
..........................++++++
.++++++
e is 65537 (0x10001)
Enter pass phrase for client.key:
Verifying - Enter pass phrase for client.key:

C:\TEMP\2>openssl req -new -key client.key -out client.csr -config openssl.cfg
Enter pass phrase for client.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:bj
Locality Name (eg, city) []:bj
Organization Name (eg, company) [Internet Widgits Pty Ltd]:v
Organizational Unit Name (eg, section) []:v
Common Name (eg, YOUR name) []:z
Email Address []:p@1

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1234
An optional company name []:v

C:\TEMP\2>openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cfg
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.......................................++++++
................++++++
writing new private key to 'ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:bj
Locality Name (eg, city) []:bj
Organization Name (eg, company) [Internet Widgits Pty Ltd]:v
Organizational Unit Name (eg, section) []:v
Common Name (eg, YOUR name) []:z
Email Address []:p@1

C:\TEMP\2>Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cfg
Using configuration from openssl.cfg
Loading 'screen' into random state - done
Enter pass phrase for ca.key:
unable to load number from C:/TEMP/2/demoCA/serial
error while loading serial number
4176:error:0D066091:asn1 encoding routines:a2i_ASN1_INTEGER:odd number of chars:.\crypto\asn1\f_int.c:162:

C:\TEMP\2>Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cfg
Using configuration from openssl.cfg
Loading 'screen' into random state - done
Enter pass phrase for ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Apr 24 02:31:47 2012 GMT
            Not After : Apr 24 02:31:47 2013 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = bj
            organizationName          = v
            organizationalUnitName    = v
            commonName                = z
            emailAddress              = p@1
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                E5:BE:16:C6:48:0D:91:1D:52:7C:3A:2C:7C:EF:9C:2D:FA:9A:12:32
            X509v3 Authority Key Identifier:
                keyid:97:6F:59:B9:97:EB:37:BB:89:54:12:7E:A3:72:BE:92:AE:83:2E:5B

Certificate is to be certified until Apr 24 02:31:47 2013 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

C:\TEMP\2>Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
Using configuration from openssl.cnf
error loading the config file 'openssl.cnf'
1920:error:02001002:system library:fopen:No such file or directory:.\crypto\bio\bss_file.c:126:fopen('openssl.cnf','rb')

1920:error:2006D080:BIO routines:BIO_new_file:no such file:.\crypto\bio\bss_file.c:129:
1920:error:0E078072:configuration file routines:DEF_LOAD:no such file:.\crypto\conf\conf_def.c:197:

C:\TEMP\2>Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
Using configuration from openssl.cnf
error loading the config file 'openssl.cnf'
2608:error:02001002:system library:fopen:No such file or directory:.\crypto\bio\bss_file.c:126:fopen('openssl.cnf','rb')

2608:error:2006D080:BIO routines:BIO_new_file:no such file:.\crypto\bio\bss_file.c:129:
2608:error:0E078072:configuration file routines:DEF_LOAD:no such file:.\crypto\conf\conf_def.c:197:

C:\TEMP\2>Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cfg
Using configuration from openssl.cfg
Loading 'screen' into random state - done
Enter pass phrase for ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Apr 24 02:35:33 2012 GMT
            Not After : Apr 24 02:35:33 2013 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = bj
            organizationName          = v
            organizationalUnitName    = v
            commonName                = z
            emailAddress              = p@1
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                50:61:5E:EE:38:C3:7D:41:66:C7:68:5F:29:9C:96:1E:C2:67:7C:E3
            X509v3 Authority Key Identifier:
                keyid:97:6F:59:B9:97:EB:37:BB:89:54:12:7E:A3:72:BE:92:AE:83:2E:5B

Certificate is to be certified until Apr 24 02:35:33 2013 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

C:\TEMP\2>type client.crt client.key > client.pem

client.crt

client.key

C:\TEMP\2>type server.crt server.key > server.pem

server.crt

server.key

C:\TEMP\2>openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
Loading 'screen' into random state - done
Enter pass phrase for client.key:
Enter Export Password:
Verifying - Enter Export Password:

C:\TEMP\2>openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12
Loading 'screen' into random state - done
Enter pass phrase for server.key:
Enter Export Password:
Verifying - Enter Export Password:

C:\TEMP\2>

一、OpenSSL自签证书链的生成（http://www.blogjava.net/zhb8015/articles/376402.html）

证书下载cert.rar
二、Tibco bw  SSL加密认证的 http方式的传输实例
    流程下载simple_https01.rar

三、SSL协议及原理（http://baike.baidu.com/view/16147.htm）  

Usage:  tibemsadmin [<arguments>]

   where <arguments> are:

   -help                    - print this help screen
   -server   <server-url>   - connect to specified server
   -user     <user-name>    - use this user name to connect to server
   -password <password>     - use this password to connect to server
   -pwdfile  <passwd file>  - use the password in the specified file
   -script   <script-file>  - execute specified script file and quit
   -ignore                  - ignore errors when executing script file

   -mangle   [password]     - mangle the password and quit. Mangled string
                              in the output can be set as a value of server
                              password or server SSL password in the server
                              configuration file. If the password is not
                              entered it is prompted for.

   SSL parameters (for SSL connection only):

   -ssl_trusted  <filename> - file containing trusted certificate(s).
                              This parameter may be entered more than
                              once if required.
   -ssl_identity <filename> - file containing client certificate and
                              optionally extra issuer certificate(s) and
                              private key.
   -ssl_issuer   <filename> - file containing extra issuer certificate(s)
                              for client-side identity.
   -ssl_password <password> - private key or PKCS12 password. If not
                              specified the password is prompted for
                              if it is required.
   -ssl_pwdfile <pwd file>  - use private key or PKCS12 password in this file
   -ssl_key <filename>      - file containing private key.
   -ssl_noverifyhostname    - do not verify host name against the name
                              in the certificate.
   -ssl_hostname <name>     - name expected in the certificate sent by host.
   -ssl_trace               - show loaded certificates and certificates
                              sent by the host.
   -ssl_debug_trace         - show additional tracing, useful for debugging.

 If no trusted certificates were specified in the parameters, then tibemsadmin
 will trust any server. If it is not desirable then at least one ssl_trusted
 parameter must be specified.

 Parameter -script may be combined with -server, -user, -password and -pwdfile.
 Parameter -ignore instructs to ignore errors while executing the
 script file. This only affects errors in command execution but not
 syntax errors in the script.

 Examples:
   tibemsadmin -script config.scr
   tibemsadmin -server "tcp://myhost:7222"
   tibemsadmin -server "tcp://myhost:7222" -user admin -password secret