khlizard · November 8, 2016 01:49
diff --git a/Superfish test b/Superfish test
 # SuperfishのCA証明書と秘密鍵
 % ls -al superfish_ca
 -rw-rw-r-- 1 user user 1086  2月 20 16:56 cacert.pem
 -rw-rw-r-- 1 user user 2127  2月 20 16:46 secret.key

 # 適当に秘密鍵生成
 % openssl genrsa -out foo.key 2048
 Generating RSA private key, 2048 bit long modulus
 .........................................+++
 ....................................................+++
 e is 65537 (0x10001)

 # superfish.vanu.jp証明用のCSR作成
 % openssl req -new -key foo.key -out foo.csr
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [AU]:JP
 State or Province Name (full name) [Some-State]:Osaka
 Locality Name (eg, city) []:
 Organization Name (eg, company) [Internet Widgits Pty Ltd]:khlizard
 Organizational Unit Name (eg, section) []:
 Common Name (e.g. server FQDN or YOUR name) []:superfish.vanu.jp
 Email Address []:

 Please enter the following 'extra' attributes
 to be sent with your certificate request
 A challenge password []:
 An optional company name []:

 # 証明書作成
 % openssl x509 -days 3650 -req -in foo.csr -CA superfish_ca/cacert.pem -CAkey superfish_ca/secret.key -out foo.pem -set_serial 01 -sha256
 Signature ok
 subject=/C=JP/ST=Osaka/O=khlizard/CN=superfish.vanu.jp
 Getting CA Private Key
 Enter pass phrase for superfish_ca/secret.key:

 # 中身
 % % openssl x509 -in foo.pem -text
 Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 1 (0x1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: O=Superfish, Inc., L=SF, ST=CA, C=US, CN=Superfish, Inc.
        Validity
            Not Before: Feb 20 05:33:41 2015 GMT
            Not After : Feb 17 05:33:41 2025 GMT
        Subject: C=JP, ST=Osaka, O=khlizard, CN=superfish.vanu.jp
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:9c:8f:a6:17:63:fc:bc:e4:cb:66:f9:49:46:7d:
                    cb:97:36:7d:5a:a8:22:93:96:52:77:6f:76:7b:11:
                    81:ca:09:e3:da:8f:ef:c0:c4:39:7c:6e:e5:af:7b:
                    50:ff:ad:ae:1c:60:58:69:4b:1c:20:7b:0e:2b:df:
                    8f:95:e6:54:15:14:88:3d:1f:92:da:29:ac:00:72:
                    cb:ea:58:50:45:99:f2:2b:ca:6e:e8:c2:b7:c4:b2:
                    c3:38:5c:e2:01:03:13:57:01:4c:95:26:b0:bc:f0:
                    c8:84:7c:12:b3:44:b7:03:bb:d6:46:45:5b:19:cb:
                    eb:8b:79:95:4c:ef:27:00:45:84:30:d8:22:ad:e7:
                    d3:3b:38:3d:ce:30:a5:bb:6e:7a:0a:84:ba:c9:24:
                    d3:7c:0b:89:ab:dd:6c:56:c4:5c:23:a2:be:e2:1e:
                    c3:5a:1a:cb:5b:5c:d3:67:1d:74:1a:12:1f:a0:45:
                    62:97:4a:a1:d2:95:2d:41:d1:71:32:27:99:3e:24:
                    30:6e:53:a5:10:8b:d2:59:72:3e:83:13:0b:fc:2d:
                    cf:a5:70:74:c4:ca:2f:4d:11:7b:71:1f:19:1c:d0:
                    63:6a:7f:f6:80:fe:f9:0a:5d:fa:c5:6a:3a:99:2a:
                    83:44:d5:da:3a:ac:c2:34:7a:f3:86:8f:5b:24:97:
                    d6:dd
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         60:b3:9f:d9:df:23:0e:3d:66:7d:bc:44:39:79:86:8d:82:96:
         49:70:6b:81:8a:34:08:08:60:a2:67:f6:47:83:fa:67:5e:06:
         f4:79:63:91:ed:5e:cb:86:1a:1c:e3:97:b5:cf:57:b4:e8:fc:
         6d:a2:16:57:e4:44:71:7a:9a:41:8e:b0:30:5d:38:d4:d1:44:
         e5:58:c9:70:17:7c:e2:4f:f9:77:70:7a:40:75:51:02:3a:4a:
         a5:24:8c:d7:b9:a0:d7:b3:3f:3e:3d:52:49:0a:00:b2:d6:51:
         d6:5a:93:2a:8d:d1:e9:f6:44:8e:e3:de:ae:32:2b:d4:38:f9:
         4f:7b
 -----BEGIN CERTIFICATE-----
 MIICmjCCAgMCAQEwDQYJKoZIhvcNAQELBQAwWzEYMBYGA1UEChMPU3VwZXJmaXNo
 LCBJbmMuMQswCQYDVQQHEwJTRjELMAkGA1UECBMCQ0ExCzAJBgNVBAYTAlVTMRgw
 FgYDVQQDEw9TdXBlcmZpc2gsIEluYy4wHhcNMTUwMjIwMDUzMzQxWhcNMjUwMjE3
 MDUzMzQxWjBMMQswCQYDVQQGEwJKUDEOMAwGA1UECAwFT3Nha2ExETAPBgNVBAoM
 CGtobGl6YXJkMRowGAYDVQQDDBFzdXBlcmZpc2gudmFudS5qcDCCASIwDQYJKoZI
 hvcNAQEBBQADggEPADCCAQoCggEBAJyPphdj/Lzky2b5SUZ9y5c2fVqoIpOWUndv
 dnsRgcoJ49qP78DEOXxu5a97UP+trhxgWGlLHCB7Divfj5XmVBUUiD0fktoprABy
 y+pYUEWZ8ivKbujCt8Sywzhc4gEDE1cBTJUmsLzwyIR8ErNEtwO71kZFWxnL64t5
 lUzvJwBFhDDYIq3n0zs4Pc4wpbtuegqEuskk03wLiavdbFbEXCOivuIew1oay1tc
 02cddBoSH6BFYpdKodKVLUHRcTInmT4kMG5TpRCL0llyPoMTC/wtz6VwdMTKL00R
 e3EfGRzQY2p/9oD++Qpd+sVqOpkqg0TV2jqswjR684aPWySX1t0CAwEAATANBgkq
 hkiG9w0BAQsFAAOBgQBgs5/Z3yMOPWZ9vEQ5eYaNgpZJcGuBijQICGCiZ/ZHg/pn
 Xgb0eWOR7V7Lhhoc45e1z1e06PxtohZX5ERxeppBjrAwXTjU0UTlWMlwF3ziT/l3
 cHpAdVECOkqlJIzXuaDXsz8+PVJJCgCy1lHWWpMqjdHp9kSO496uMivUOPlPew==
 -----END CERTIFICATE-----

 # おっけー
 % openssl verify -CAfile superfish_ca/cacert.pem foo.pem
 foo.pem: OK
	# SuperfishのCA証明書と秘密鍵
	% ls -al superfish_ca
	-rw-rw-r-- 1 user user 1086 2月 20 16:56 cacert.pem
	-rw-rw-r-- 1 user user 2127 2月 20 16:46 secret.key

	# 適当に秘密鍵生成
	% openssl genrsa -out foo.key 2048
	Generating RSA private key, 2048 bit long modulus
	.........................................+++
	....................................................+++
	e is 65537 (0x10001)

	# superfish.vanu.jp証明用のCSR作成
	% openssl req -new -key foo.key -out foo.csr
	You are about to be asked to enter information that will be incorporated
	into your certificate request.
	What you are about to enter is what is called a Distinguished Name or a DN.
	There are quite a few fields but you can leave some blank
	For some fields there will be a default value,
	If you enter '.', the field will be left blank.
	-----
	Country Name (2 letter code) [AU]:JP
	State or Province Name (full name) [Some-State]:Osaka
	Locality Name (eg, city) []:
	Organization Name (eg, company) [Internet Widgits Pty Ltd]:khlizard
	Organizational Unit Name (eg, section) []:
	Common Name (e.g. server FQDN or YOUR name) []:superfish.vanu.jp
	Email Address []:

	Please enter the following 'extra' attributes
	to be sent with your certificate request
	A challenge password []:
	An optional company name []:

	# 証明書作成
	% openssl x509 -days 3650 -req -in foo.csr -CA superfish_ca/cacert.pem -CAkey superfish_ca/secret.key -out foo.pem -set_serial 01 -sha256
	Signature ok
	subject=/C=JP/ST=Osaka/O=khlizard/CN=superfish.vanu.jp
	Getting CA Private Key
	Enter pass phrase for superfish_ca/secret.key:

	# 中身
	% % openssl x509 -in foo.pem -text
	Certificate:
	Data:
	Version: 1 (0x0)
	Serial Number: 1 (0x1)
	Signature Algorithm: sha256WithRSAEncryption
	Issuer: O=Superfish, Inc., L=SF, ST=CA, C=US, CN=Superfish, Inc.
	Validity
	Not Before: Feb 20 05:33:41 2015 GMT
	Not After : Feb 17 05:33:41 2025 GMT
	Subject: C=JP, ST=Osaka, O=khlizard, CN=superfish.vanu.jp
	Subject Public Key Info:
	Public Key Algorithm: rsaEncryption
	Public-Key: (2048 bit)
	Modulus:
	00:9c:8f:a6:17:63:fc:bc:e4:cb:66:f9:49:46:7d:
	cb:97:36:7d:5a:a8:22:93:96:52:77:6f:76:7b:11:
	81:ca:09:e3:da:8f:ef:c0:c4:39:7c:6e:e5:af:7b:
	50:ff:ad:ae:1c:60:58:69:4b:1c:20:7b:0e:2b:df:
	8f:95:e6:54:15:14:88:3d:1f:92:da:29:ac:00:72:
	cb:ea:58:50:45:99:f2:2b:ca:6e:e8:c2:b7:c4:b2:
	c3:38:5c:e2:01:03:13:57:01:4c:95:26:b0:bc:f0:
	c8:84:7c:12:b3:44:b7:03:bb:d6:46:45:5b:19:cb:
	eb:8b:79:95:4c:ef:27:00:45:84:30:d8:22:ad:e7:
	d3:3b:38:3d:ce:30:a5:bb:6e:7a:0a:84:ba:c9:24:
	d3:7c:0b:89:ab:dd:6c:56:c4:5c:23:a2:be:e2:1e:
	c3:5a:1a:cb:5b:5c:d3:67:1d:74:1a:12:1f:a0:45:
	62:97:4a:a1:d2:95:2d:41:d1:71:32:27:99:3e:24:
	30:6e:53:a5:10:8b:d2:59:72:3e:83:13:0b:fc:2d:
	cf:a5:70:74:c4:ca:2f:4d:11:7b:71:1f:19:1c:d0:
	63:6a:7f:f6:80:fe:f9:0a:5d:fa:c5:6a:3a:99:2a:
	83:44:d5:da:3a:ac:c2:34:7a:f3:86:8f:5b:24:97:
	d6:dd
	Exponent: 65537 (0x10001)
	Signature Algorithm: sha256WithRSAEncryption
	60:b3:9f:d9:df:23:0e:3d:66:7d:bc:44:39:79:86:8d:82:96:
	49:70:6b:81:8a:34:08:08:60:a2:67:f6:47:83:fa:67:5e:06:
	f4:79:63:91:ed:5e:cb:86:1a:1c:e3:97:b5:cf:57:b4:e8:fc:
	6d:a2:16:57:e4:44:71:7a:9a:41:8e:b0:30:5d:38:d4:d1:44:
	e5:58:c9:70:17:7c:e2:4f:f9:77:70:7a:40:75:51:02:3a:4a:
	a5:24:8c:d7:b9:a0:d7:b3:3f:3e:3d:52:49:0a:00:b2:d6:51:
	d6:5a:93:2a:8d:d1:e9:f6:44:8e:e3:de:ae:32:2b:d4:38:f9:
	4f:7b
	-----BEGIN CERTIFICATE-----
	MIICmjCCAgMCAQEwDQYJKoZIhvcNAQELBQAwWzEYMBYGA1UEChMPU3VwZXJmaXNo
	LCBJbmMuMQswCQYDVQQHEwJTRjELMAkGA1UECBMCQ0ExCzAJBgNVBAYTAlVTMRgw
	FgYDVQQDEw9TdXBlcmZpc2gsIEluYy4wHhcNMTUwMjIwMDUzMzQxWhcNMjUwMjE3
	MDUzMzQxWjBMMQswCQYDVQQGEwJKUDEOMAwGA1UECAwFT3Nha2ExETAPBgNVBAoM
	CGtobGl6YXJkMRowGAYDVQQDDBFzdXBlcmZpc2gudmFudS5qcDCCASIwDQYJKoZI
	hvcNAQEBBQADggEPADCCAQoCggEBAJyPphdj/Lzky2b5SUZ9y5c2fVqoIpOWUndv
	dnsRgcoJ49qP78DEOXxu5a97UP+trhxgWGlLHCB7Divfj5XmVBUUiD0fktoprABy
	y+pYUEWZ8ivKbujCt8Sywzhc4gEDE1cBTJUmsLzwyIR8ErNEtwO71kZFWxnL64t5
	lUzvJwBFhDDYIq3n0zs4Pc4wpbtuegqEuskk03wLiavdbFbEXCOivuIew1oay1tc
	02cddBoSH6BFYpdKodKVLUHRcTInmT4kMG5TpRCL0llyPoMTC/wtz6VwdMTKL00R
	e3EfGRzQY2p/9oD++Qpd+sVqOpkqg0TV2jqswjR684aPWySX1t0CAwEAATANBgkq
	hkiG9w0BAQsFAAOBgQBgs5/Z3yMOPWZ9vEQ5eYaNgpZJcGuBijQICGCiZ/ZHg/pn
	Xgb0eWOR7V7Lhhoc45e1z1e06PxtohZX5ERxeppBjrAwXTjU0UTlWMlwF3ziT/l3
	cHpAdVECOkqlJIzXuaDXsz8+PVJJCgCy1lHWWpMqjdHp9kSO496uMivUOPlPew==
	-----END CERTIFICATE-----

	# おっけー
	% openssl verify -CAfile superfish_ca/cacert.pem foo.pem
	foo.pem: OK