FIXME:

pikachu:~# /usr/lib/ssl/misc/CA.sh -newreq
Using configuration from /usr/lib/ssl/openssl.cnf
Generating a 1024 bit RSA private key
.++++++
..................................................++++++
writing new private key to 'newreq.pem'
Enter PEM pass phrase:jirka.heslo
⋮
Country Name (2 letter code) [CZ]:
State or Province Name (full name) [Some-State]:.
Locality Name (eg, city) [Breclav]:
Organization Name (eg, company) [FIRMA a.s.]:
Organizational Unit Name (eg, section) []:IT Departement
Common Name (eg, YOUR name) []:Jiri Jiricek
Email Address []:jiri.jiricek@firma.cz
⋮
A challenge password []:Enter
An optional company name []:Enter
Request (and private key) is in newreq.pem
pikachu:~#

Vytvořený certifikát, který bychom si normálně nechali podepsat důvěryhodnou certifikační autoritou, např. Thawte nebo Verisign, si podepíšeme vlastní certifikační autoritou kterou jsem si vytvořili:

pikachu:~# /usr/lib/ssl/misc/CA.sh -sign
Using configuration from /usr/lib/ssl/openssl.cnf
Enter PEM pass phrase:certifikuj (heslo k certifikační autoritě)
Check that the request matches the signature
Signature ok
The Subjects Distinguished Name is as follows
countryName           :PRINTABLE:'CZ'
localityName          :PRINTABLE:'Breclav'
organizationName      :PRINTABLE:'FIRMA a.s.'
organizationalUnitName:PRINTABLE:'IT Departement'
commonName            :PRINTABLE:'Jiri Jiricek'
emailAddress          :IA5STRING:'jiri.jiricek@firma.cz'
Certificate is to be certified until Jan  7 09:31:34 2005 GMT (30 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
⋮
Signed certificate is in newcert.pem
pikachu:~# 

Pro lepší orientaci si certifikáty přejmenujeme popisnými jmény.

pikachu:~# mv newcert.pem jiri.jiricek.pem
pikachu:~# mv newreq.pem jiri.jiricek.key

Pro potřeby počítače s OS MSWindows je třeba převést certifikáty do formátu p12

# openssl pkcs12 -export -in jiri.jiricek.pem -inkey jiri.jiricek.key  -certfile demoCA/cacert.pem -out jiri.jiricek.p12
Enter PEM pass phrase:jirka.heslo (heslo k certifikátu)
Enter Export Password:p12heslo (heslo k p12 souboru)
Verifying password - Enter Export Password:p12heslo
pikachu:~# 

Kvůli problémům s certifikáty jsem si je vytvořil znovu podle WAVElan Client setup for KAME/BSD (NetBSD, FreeBSD).

mpressca@yoda:~$ openssl genrsa -out pikachu2.pem 1024
warning, not much extra random data, consider using the -rand option
Generating RSA private key, 1024 bit long modulus
.....++++++
.++++++
e is 65537 (0x10001)
mpressca@yoda:~$ openssl req -new -key pikachu2.pem -out pikachu2.req
Using configuration from /usr/lib/ssl/openssl.cnf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CZ]:
State or Province Name (full name) []:
Locality Name (eg, city) []:Breclav
Organization Name (eg, company) [Moje Firma, s.r.o.]:FIRMA a.s.
Organizational Unit Name (eg, section) []:IT Departement
Common Name (eg, YOUR name) []:pikachu2.firma.cz
Email Address []:sprava.site@firma.cz

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
mpressca@yoda:~$ openssl x509 -days 365 -signkey demoCA/private/cakey.pem \
                              -in pikachu2.req -req -out pikachu2.crt
Signature ok
subject=/C=CZ/L=Breclav/O=FIRMA a.s./OU=IT Departement/CN=pikachu2.moravi\
apress.cz/Email=sprava.site@firma.cz
Getting Private key
Enter PEM pass phrase:********  heslo certifikační autority
mpressca@yoda:~$ ls -l pikachu2.*
-rw-r--r--    1 mpressca mpressca     1001 Dec 14 16:08 pikachu2.crt
-rw-r--r--    1 mpressca mpressca      887 Dec 14 16:04 pikachu2.pem
-rw-r--r--    1 mpressca mpressca      733 Dec 14 16:06 pikachu2.req
mpressca@yoda:~$

Význam jednotlivých souborů je následující: