生成CA公钥
sudo certtool --generate-privkey --outfile ca.key
编辑CA证书模板
cn = "Tuchine CA"
organization = "Tuchine.LTD"
serial = 1
expiration_days = 3650
ca
signing_key
cert_signing_key
crl_signing_key
根据模板和公钥生成证书
certtool --generate-self-signed --load-privkey ca.key --template ../template/ca.tmpl --outfile ca.crt
生成服务器证书公钥
sudo certtool --generate-privkey --outfile server.key
编辑服务器证书模板
cn = "Tuchine.com"
o = "Tuchine Ltd."
email = [email protected]
dns_name = "www.tuchine.com"
country = US
state = "YongZhou"
expiration_days = 3650
signing_key
encryption_key #only if the generated key is an RSA one
tls_www_server
ipsec_ike_key
time_stamping_key
根据用户模板、服务器证书公钥、CA证书、CA公钥生成服务器证书
certtool --generate-certificate --load-privkey server-key --load-ca-certificate ca.crt --load-ca-privkey ca.key --template ../template/server.tmpl --outfile server.crt
编辑用户证书模板
cn = user
o = "TuchineUsers"
email = "[email protected]"
dns_name = "www.Tuchine.com"
country = US
state = "YongZhou"
expiration_days = 365
signing_key
encryption_key #only if the generated key is an RSA one
tls_www_client
ipsec_ike_key
time_stamping_key
生成用户公钥
certtool --generate-privkey --outfile user.key
根据用户模板、用户公钥、CA证书、CA公钥生成服务器证书
certtool --generate-certificate --load-privkey user.key --load-ca-certificate ca.crt --load-ca-privkey ca.key --template ../template/user.tmpl --outfile user.crt
用户证书转P12格式证书
certtool --to-p12 --load-privkey user.key -pkcs-cipher 3des-pkcs12 --load-certificate user.crt --outfile user.p12 --outder
用户证书一键脚本
#!/bin/sh
serial=`date +%s`
l='others'
certtool --generate-privkey --outfile ./clients/$l.key
sed -i "1ccn = ${l}" ./template/client.tmpl
sed -i "3cemail = ${l}@tuchine.com" ./template/client.tmpl
sed -i "7cserial = ${serial}" ./template/client.tmpl
certtool --generate-certificate --load-privkey ./clients/$l.key --load-ca-certificate ./ca/ca.crt --load-ca-privkey ./ca/ca.key --template ./template/client.tmpl --outfile ./clients/$l.crt
openssl pkcs12 -export -inkey ./clients/$l.key -in ./clients/$l.crt -name "Tuchine VPN Client Cert" -certfile ./ca/ca.crt -out ./clients/$l.p12
exit 0
注意：请保持你的服务器主机域名与这里证书的DNS域名是同一个，且你的客户端导入了服务器证书，否则点击连接会每次都提示不信任的服务器。