Openvpn服务器安装与配置

三、      证书申请

1、申请证书：      openssl req -config openssl.cnf -new -keyout jiang.key -out jiang.req

Generating a 1024 bit RSA private key

..................................................................++++++

..............++++++

writing new private key to 'jiang.key'

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:CN

State or Province Name (full name) []:GuangDong

Locality Name (eg, city) []:DongGuan

Organization Name (eg, company) [My Company Ltd]:DH

Organizational Unit Name (eg, section) []:IMC

Common Name (eg, your name or your server's hostname) []:jiangdaoyou

Email Address []:jdaoyou@xxx.xxx

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

2、使用CA签名证书：openssl ca -config openssl.cnf -out jiang.pem -notext -infiles jiang.req

Using configuration from ../openssl/ovpn.cnf

DEBUG[load_index]: unique_subject = "yes"

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName           :PRINTABLE:'CN'

stateOrProvinceName   :PRINTABLE:'GuangDong'

localityName          :PRINTABLE:'DongGuan'

organizationName      :PRINTABLE:'DH'

organizationalUnitName:PRINTABLE:'IMC'

commonName            :PRINTABLE:'jiangdaoyou'

Certificate is to be certified until Jul 22 03:41:46 2021 GMT (999999 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

3、导出p12证书文件

openssl pkcs12 -export  -in jiang.pem -inkey jiang.key -certfile ../ca/cacert.pem -out jiang.p12

Enter pass phrase for jiang.key:

Enter Export Password:

Verifying - Enter Export Password:

查看证书：openssl x509  -in jiang.pem -noout –subject

4、证书的导出

从p12格式中导出CA证书， 则输入下列命令：

openssl pkcs12 -nomacver -cacerts -nokeys -in pkcs12_file -out ca_certificate.pem

从p12格式中导出xxx.com.pem和xxx.com.key 则输入下列命令：

openssl pkcs12 -nomacver -clcerts -nokeys -in pkcs12_file -out xxx.certificate.pem

openssl pkcs12 -nomacver -nocerts -in pkcs12_file -out xxx.private_key.pem

如果不对密钥加密(也即不需要输入pem密码)：openssl pkcs12 -nomacver -nocerts -nodes -in pkcs12_file -out xxx.private_key.pem

注：暂时决定不对证书密钥进行加密

GUI程序中"change password"可以改变私钥的加密密码，等同在产生key时去掉-nodes参数

修改client.ovpn文件，输入：cryptoapicert "SUBJ: abc" 即可使用windows中存储的证书 abc指common name