EasyRSA 3.0 Удостоверяющий центр

Можно всегда заказать за денюшку сертификат для собственного веб- или openvpn-сервера, даже можно заказать бесплатный сертификат от StartSSL. Но ведь можно сделать всё и самостоятельно, особенно если этих самых сертификатов придется генерить очень много. Расскажу про создание своего удостоверяющего центра и создадим сертификат для веб-сервера. Поехали.

Клонируем репо с гитхаба.

# git clone https://github.com/OpenVPN/easy-rsa

Делаем копию нужной нам директории, чтобы потом можно было сделать git pull и обновиться.

# cp -a easy-rsa/easyrsa3/ test-ca/

Настраиваем под себя.

# cd test-ca/
# cp vars.example vars
# $EDITOR vars

Файл vars должен выглядеть примерно так

if [ -z "$EASYRSA_CALLER" ]; then
 echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
 echo "This is no longer necessary and is disallowed. See the section called" >&2
 echo "'How to use this file' near the top comments for more details." >&2
 return 1
fi
set_var EASYRSA "$PWD"
set_var EASYRSA_PKI  "$EASYRSA/pki"
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "RU"
set_var EASYRSA_REQ_PROVINCE "Moscow"
set_var EASYRSA_REQ_CITY "Moscow"
set_var EASYRSA_REQ_ORG  "OOO Roga and Kopyta"
set_var EASYRSA_REQ_EMAIL "noc@rogaandkopyta.ru"
set_var EASYRSA_REQ_OU  "Devops department"
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_ALGO  rsa
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 3650
set_var EASYRSA_CRL_DAYS 180

Инициализируем pki

# ./easyrsa init-pki

Создаем CA

# ./easyrsa ./easyrsa build-ca


Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
......................+++
...................................+++
writing new private key to '/root/test-ca/pki/private/ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:ca.rogaandkopyta.ru

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/root/test-ca/pki/ca.crt

Создадим запрос на подписывание сертификата(csr) (БЕЗ пароля)

./easyrsa gen-req wildcard.rogaandkopyta.ru nopass

Note: using Easy-RSA configuration from: ./vars

Generating a 2048 bit RSA private key
...........................................+++
................................+++
writing new private key to '/root/test-ca/pki/private/wildcard.rogaandkopyta.ru.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [wildcard.rogaandkopyta.ru]:*.rogaandkopyta.ru

Keypair and certificate request completed. Your files are:
req: /root/test-ca/pki/reqs/wildcard.rogaandkopyta.ru.req
key: /root/test-ca/pki/private/wildcard.rogaandkopyta.ru.key

Подписываем сертификат для веб-сервера

# ./easyrsa sign-req server wildcard.rogaandkopyta.ru

Note: using Easy-RSA configuration from: ./vars

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 3650 days:

subject=
    commonName                = *.rogaandkopyta.ru

Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /root/test-ca/openssl-1.0.cnf
Enter pass phrase for /root/test-ca/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :T61STRING:'*.rogaandkopyta.ru'
Certificate is to be certified until Apr 25 13:40:38 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /root/test-ca/pki/issued/wildcard.rogaandkopyta.ru.crt

Готово, сертификат для web-сервера лежит в pki/issued/wildcard.rogaandkopyta.ru.crt. Ключ к нему - pki/private/wildcard.rogaandkopyta.ru.key
Нужно закинуть эти два файла к веб-серверу. Если нужен еще и доступ по клиентским сертификатам, то понадобится еще и файлик ca.crt.
Примерный кусок конфига для nginx(проверка клиентских сертоф закомменчена)

 ssl on;
        server_name test.rogaandkopyta.ru;
        ssl_certificate          /etc/nginx/ssl/wildcard.rogaandkopyta.ru.crt;
        ssl_certificate_key      /etc/nginx/ssl/wildcard.rogaandkopyta.ru.key;
        #ssl_client_certificate /etc/nginx/ssl/ca.crt;
        #ssl_verify_client on;