# 签发RSA-PSS签名算法的证书

## 创建openssl配置文件

`vi openssl.conf` 并添加如下内容

```text

[ CA_default ]

req_extensions = v3_req

[ v3_req ]

basicConstraints = CA:FALSE

keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth

authorityKeyIdentifier=keyid,issuer

subjectAltName = @alt_names

[alt_names]

DNS.1 = *.example.com

DNS.2 = *.example.com

[ v3_server_client ]

basicConstraints        = critical, CA:FALSE

subjectKeyIdentifier    = hash

authorityKeyIdentifier  = keyid:always, issuer:always

keyUsage                = critical, digitalSignature, nonRepudiation, keyEncipherment, keyAgreement

extendedKeyUsage        = critical, serverAuth, clientAuth

crlDistributionPoints   = URI:http://example.com/crl.pem

[ v3_sign ]

basicConstraints        = critical, CA:FALSE

subjectKeyIdentifier    = hash

authorityKeyIdentifier  = keyid:always, issuer:always

keyUsage                = critical, digitalSignature

extendedKeyUsage        = critical, codeSigning

[ v3_ca ]

basicConstraints = critical, CA:true

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

keyUsage = critical, cRLSign, digitalSignature, keyCertSign

crlDistributionPoints=URI:http://example.com/cacrl.pem

```

## 生成CA证书

```shell

# 生成4096位RSA私钥，并用AES256算法加密，私钥密码是Abc123456

openssl genrsa -aes256 -passout pass:'Abc123456' -f4 -out rsaca.key 4096

#如果是openssl 3.0 使用如下命令

openssl genrsa -aes256 -passout pass:'Abc123456' -f4 -out rsaca.key -traditional  4096

# 通过刚才生成的私钥，生成证书请求文件，指定hash算法为SHA256，并指定证书主题

openssl req -new -out rsaca_req.csr -key rsaca.key -passin pass:'Abc123456' -SHA256 -subj "/C=CN/O=example/CN=Test RSA CA"

# 自签发CA证书，使用-days指定有效期

openssl x509 -req -in rsaca_req.csr -out rsaca.pem -sha256 -signkey rsaca.key -passin pass:'Abc123456' -CAcreateserial -days 10960 -extfile openssl.conf  -extensions v3_ca

```

## 签发二级CA

```shell

# 生成二级CA私钥

openssl genrsa -aes256 -passout pass:'Abc123456' -f4 -out rsa-pss-subca.key 4096

# 如果使用openssl 3.0

openssl genrsa -aes256 -passout pass:'Abc123456' -f4 -out rsa-pss-subca.key -traditional 4096

# 生成证书请求文件

openssl req -new -out rsa-pss-subca_req.csr -key rsa-pss-subca.key -passin pass:'Abc123456' -SHA512 -sigopt "rsa_padding_mode:pss" -subj "/C=CN/O=example/CN=Test RSA PSS Sub CA"

# 使用一级CA签发二级CA

openssl x509 -req  -in rsa-pss-subca_req.csr -out rsa-pss-subca.pem -SHA512 -CA rsaca.pem -CAkey rsaca.key -passin pass:'Abc123456' -CAcreateserial -sigopt rsa_padding_mode:pss  -days 30000 -extfile openssl.conf  -extensions v3_ca

```

## 签发客户证书

签发的客户证书使用PSS算法填充

```shell

# 生成客户证书的私钥

openssl genrsa -aes256 -passout pass:'Abc123456' -f4 -out client_rsa-pss.key 4096

# 如果使用openssl 3.0

openssl genrsa -aes256 -passout pass:'Abc123456' -f4 -out client_rsa-pss.key -traditional 4096

# 指定签名算法为PSS算法填充

openssl req -new -out client_rsa-pss_req.csr -key client_rsa-pss.key  -passin pass:'Abc123456' -sigopt "rsa_padding_mode:pss" -subj "/C=CN/O=example/CN=111.test.example.com"

# 使用二级CA证书签发客户证书，签名算法为PSS填充

openssl x509 -req -days 10000 -CA rsa-pss-subca.pem -CAkey rsa-pss-subca.key -passin pass:'Abc123456' -CAcreateserial -sigopt rsa_padding_mode:pss -SHA512 --in client_rsa-pss_req.csr -out client_rsa-pss.pem -extfile openssl.conf  -extensions v3_req

```

## 最终生成的证书文件

如下图为生成的证书列表，如果需要再签发一个客户证书，使用二级CA签发即可，注意修改subject字段，该字段可以认为是证书的标识

| 文件名| 作用 | 说明 |

| --- | --- | --- |

|rsaca.pem  | 一级CA证书 | 自签名 |

| rsaca.key |  一级CA私钥| 加密保存，密码是Abc123456 |

| rsa-pss-subca.pem | 二级CA证书|  由一级CA签发|

| rsa-pss-subca.key |  二级CA私钥| 加密保存，密码是Abc123456 |

| client_rsa-pss.pem |  用户证书| 由二级CA签发 |

| client_rsa-pss.key | 用户证书私钥| 加密保存，密码是Abc123456 |

使用hccn_tool证书导入证书时，把`rsaca.pem`, `rsa-pss-subca.pem`, `client_rsa-pss.pem`, `client_rsa-pss.key` 这四个文件导入即可


配置tls证书

```bash

hccn_tool -i 1 -tls -s path "$(pwd)" pri client_rsa-pss.key  pub client_rsa-pss.pem ca1 rsaca.pem ca2 rsa-pss-subca.pem

```