多段の中間CA証明書作成 -動作検証編-

$ openssl req -new -keyout server.key -out server.csr
Generating a 1024 bit RSA private key
.++++++
.......................++++++
writing new private key to 'server.key'
Enter PEM pass phrase:<サーバ証明書の秘密鍵のパスワード>
Verifying - Enter PEM pass phrase:<サーバ証明書の秘密鍵のパスワード(確認)>
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:Tokyo
Locality Name (eg, city) [Newbury]:Shibuya
Organization Name (eg, company) [My Company Ltd]:HDE, Inc.
Organizational Unit Name (eg, section) []:.
Common Name (eg, your name or your server's hostname) []:<サーバのホスト名>
Email Address []:.

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:[Enter]
An optional company name []:[Enter]
$ openssl x509 -CA ca5/ca.crt -CAkey ca5/ca.key -req -in server.csr -out server.crt -CAcreateserial

SSLCertificateFile /tmp/server.crt
SSLCertificateKeyFile /tmp/server.key
SSLCertificateChainFile /tmp/ca-chain.crt

#!/bin/sh

max=$1
i=1

while [ $i -le $max ]
do
  cat ca$max/ca.crt|grep -v '^ '|grep -v 'Cert' >> ca-chain.crt
  max=`expr $max - 1`
done