SSL 签证的部份已经搞定了，剩下 DNS解析的部份。需要 Linux环境（cygwin或 原生 Linux）跟OpenSSL 套件。 在cygwin里面建议安装apt-cyg 工具，就可以利用类似Debian/Ubuntu/Cydia 里 面的apt 指令直接安装套件，不用再跳出来执行setup.exe 。以下指令中 $是提 示字元。 指令： $ wget http://apt-cyg.googlecode.com/svn/trunk/apt-cyg $ chmod +x apt-cyg $ mv apt-cyg /usr/bin 然後安装OpenSSL 指令： $ apt-cyg install openssl 静待执行结束 Step 1-1. 生出最高层认证中心 Root CA 指令：（以cygwin为例， Linux的路径是/etc/ssl） $ cd /usr/ssl //进入 ssl程式工作目录 $ openssl rand -out /usr/ssl/private/.rand 1024 //制作乱数档 $ vi /usr/ssl/openssl.cnf //进入编辑器 //找到 dir = ./demoCA //改成 dir = /usr/ssl 不会用vi的人可以用其他编辑器，但请存成Unix换行格式 Step 1-2. 生出最高层认证中心的私钥(rootca.key) 指令： $ openssl genrsa -des3 -out rootca.key 2048 //产生最高层的私钥 Generating RSA private key, 2048 bit long modulus ............................................................................. ..............+++ ............................................................................. ...+++ e is 65537 (0x10001) Enter pass phrase for rootca.key: //设定密码 Verifying - Enter pass phrase for rootca.key: //重新确认密码 Step 1-3. 填写凭证申请书(rootca.req) $ openssl req -new -key rootca.key -out rootca.req Enter pass phrase for rootca.key: //输入刚刚设定的密码 You are about to be asked to enter information that will be incorporated \\ into your certificate request. What you are about to enter is what is called a Distinguished Name or \\ a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:TW //输入基本资料 State or Province Name (full name) [Some-State]:Taiwan R.O.C Locality Name (eg, city) []:Taipei Organization Name (eg, company) [Internet Widgits Pty Ltd]:NTU Organizational Unit Name (eg, section) []:ptt Common Name (eg, YOUR name) []:Modchip Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: //直接按Enter 跳过 An optional company name []: //直接按Enter 跳过 Step 1-4. 把凭证(rootca.crt)签出来 指令： $ openssl x509 -req -days 7305 -sha1 -extfile /usr/ssl/openssl.cnf \\ -extensions v3_ca -signkey rootca.key -in rootca.req -out rootca.crt Signature ok subject=/C=TW/ST=Taiwan R.O.C/L=Taipei/O=NTU/OU=ptt/CN=Modichip/ [email protected] Getting Private key Enter pass phrase for rootca.key: //输入最高层密码 Step 2-1.制作 PSN伺服器的私钥(auth.np.ac.playstation.net.key) 指令： $ openssl genrsa -out auth.np.ac.playstation.net.key 2048 Generating RSA private key, 2048 bit long modulus ............................................................................. .......................+++ ........................................................................+++ e is 65537 (0x10001) Step 2-2. 填写 PSN伺服器的凭证申请书(auth.np.ac.playstation.net.req) 指令： $ openssl req -new -key auth.np.ac.playstation.net.key -out \\ auth.np.ac.playstation.net.req You are about to be asked to enter information that will be \\ incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or \\ a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:TW State or Province Name (full name) [Some-State]:Taiwan R.O.C Locality Name (eg, city) []:Taipei Organization Name (eg, company) [Internet Widgits Pty Ltd]:NTU Organizational Unit Name (eg, section) []:ptt Common Name (eg, YOUR name) []:Modchip Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: //直接按Enter跳过 An optional company name []: //一样按Enter跳过 Step 2-3. 用最高层认证中心签凭证给(auth.np.ac.playstation.net) $ openssl x509 -req -days 3650 -sha1 -extfile /usr/ssl/openssl.cnf \\ -extensions v3_req -CA rootca.crt -CAkey rootca.key -CAserial \\ rootca.srl -CAcreateserial -in auth.np.ac.playstation.net.req -out \\ auth.np.ac.playstation.net.crt Signature ok subject=/C=TW/ST=Taiwan R.O.C/L=Taipei/O=NTU/OU=ptt/CN=Modchip/\\ [email protected] Getting CA Private Key Enter pass phrase for rootca.key: //输入最高层密码 这样就可以得到rootca.crt跟auth.np.ac.playstation.net.crt，应该就是原文 所提到，自己制作的CA SSL凭证。 ****** 参考资讯：http://www.tc.umn.edu/~brams006/selfsign.html -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 140.120.31.133 ※ 编辑: cassine 来自: 140.120.31.133 (02/12 13:59)