**好的，很明显这个问题与在 Linux 服务器上设置 openssl 以及如何正确设置自定义 openssl.cnf 文件有关。我不是在寻找任何复杂的东西，但我需要一个能够创建自签名客户端证书以对我的 web 服务进行身份验证的前端。因此，我需要能够使用我的 CA 为客户公司创建中间 CA，然后允许他们使用安全接口为他们的员工颁发客户证书。登录取决于您是否属于特定的中间 CA，以及您的证书或中间 CA 是否未被吊销。
对于任何想知道的人，我们可以使用自签名证书，因为它们仅用于我们的服务器对用户进行身份验证，并且由于我们颁发了它们，因此我们信任它们。此外，对于初创公司来说，通过商业产品 AFAIK 将自己确立为中间 CA 的成本也太高了。微软可以做到，我们做不到。我们的网络服务器本身使用 CA 签名证书。
我知道用于设置这种事情的 php 代码是直截了当的，但不是如何正确设置 openssl。我在网上尝试了几个不同的例子，但它们似乎都不适用于我的设置，而且它们似乎都不同。一盒是全新安装的 Centos 6.2，但我仍然遇到错误。
谁能指出我设置 openssl、apache2 和 php 的正确方向，以便我可以使用这些 php 库而不会出错？我们的虚拟服务器正在使用 debian 挤压，我可以完全控制安装的软件。
谢谢。
open_pkey_new()返回错误，例如 error:0E06D06C:configuration file routines:NCONF_get_string:no value。但是我正在传递一个到 openssl.cnf 文件的路径，所以我不知道为什么我仍然遇到这个问题。这是我的相关代码
<?php
$cwd=getcwd();
$distname= array(
"countryName" => "CA",
"stateOrProvinceName" => "Ontario",
"localityName" => "Toronto",
"organizationName" => "G4 Apps",
"organizationalUnitName" => "Development",
"commonName" => "Mark Lane",
"emailAddress" => "nobody at gmail.com"
);
$password = 'seanix';
$cacert_location=$cwd."/certs/CA/g4CA.crt";
$cakey_location=$cwd."/certs/CA/g4CA.key";
$cnf=$cwd.'/certs/myopenssl.cnf';
$configArgs = array(
'config' =>$cnf
);
?>
这是我制作钥匙的功能。
<?php
function makekey($password,$configArgs) {
$key= openssl_pkey_new($configArgs);
//print_r($configArgs);
openssl_pkey_export($key, $pkeyout,$password);
if (($e=openssl_error_string()) ==false) return $pkeyout;
else {
do {
echo $e . "<BR>";
} while($e=openssl_error_string());
return -1;
}
}
?>
我也尝试过配置文件的相对路径，但它仍然无法正常工作。看起来可能是主机提供商 ssl 设置。我切换到本地虚拟机并获得了生成密钥，但现在在创建 csr 时遇到了同样的错误。
错误：0E06D06C：配置文件例程：NCONF_get_string：无值
<?php
function newcsr($distname,$key,$configArgs) {
$csr=openssl_csr_new($distname,$key,$configArgs);
openssl_csr_export($csr, $csrout);
if (($e=openssl_error_string()) ==false) return $csrout;
else {
do {
echo $e . "<BR>";
} while($e=openssl_error_string());
return -1;
}
}
?>
openssl.conf这看起来是 openssl.cnf 中的错误，所以我已包含该文件。
HOME = .
RANDFILE = $ENV::HOME/.rnd
oid_section = new_oids
[ new_oids ]
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7
####################################################################
[ ca ]
default_ca = g4CA
####################################################################
[ g4CA ]
dir = /home/g4apps/secure.g4apps.com/generator/certs
certs = $dir/
crl_dir = $dir/crl
database = $dir/index.txt
new_certs_dir = $dir/newcerts
certificate = $dir/CA/g4CA.crt
serial = $dir/serial
crlnumber = $dir/crlnumber
crl = $dir/CA/g4CA.crl
private_key = $dir/CA/g4CA.key
RANDFILE = $dir/private/.rand
x509_extensions = usr_cert
name_opt = ca_default
cert_opt = ca_default
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = default # use public key default MD
preserve = no # keep passed DN ordering
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
####################################################################
[ req ]
default_bits = 2048
default_md = md5
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert
string_mask = utf8only
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = CA
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = ON
localityName = Locality Name (eg, city)
localityName_default = Toronto
0.organizationName = Organization Name (eg, company)
0.organizationName_default = G4 Apps
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (eg, your name or your server\'s hostname)
commonName_max = 64
emailAddress = Email Address
emailAddress_default = lmlane@gmail.com
emailAddress_max = 64
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
unstructuredName = An optional company name
[ usr_cert ]
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
[ crl_ext ]
authorityKeyIdentifier=keyid:always
[ proxy_cert_ext ]
basicConstraints=CA:FALSE
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
####################################################################
[ tsa ]
default_tsa = tsa_config1
[ tsa_config1 ]
dir = ./demoCA
serial = $dir/tsaserial
crypto_device = builtin
signer_cert = $dir/tsacert.pem
certs = $dir/cacert.pem
signer_key = $dir/private/tsakey.pem
default_policy = tsa_policy1
other_policies = tsa_policy2, tsa_policy3
digests = md5, sha1
accuracy = secs:1, millisecs:500, microsecs:100
clock_precision_digits = 0
ordering = yes
tsa_name = yes
ess_cert_id_chain = no
堆栈跟踪strace php getkeystore.php &> stack.trace