fi
# create an own SSLeay config
# 如果需要修改证书的有效期限，请修改下面的 default_days 参数.
# 当前设置为10年.
cat >ca.config <<EOT
[ ca ]
default_ca = CA_own
[ CA_own ]
dir = .
certs = ./certs
new_certs_dir = ./ca.db.certs
database = ./ca.db.index
serial = ./ca.db.serial
RANDFILE = ./ca.db.rand
certificate = ./ca.crt
private_key = ./ca.key
default_days = 3650
default_crl_days = 30
default_md = md5
preserve = no
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
EOT
# sign the certificate
echo "CA signing: $CSR -> $CERT:"
openssl ca -config ca.config -out $CERT -infiles $CSR
echo "CA verifying: $CERT <-> CA cert"
openssl verify -CAfile ./certs/ca.crt $CERT
# cleanup after SSLeay
rm -f ca.config
rm -f ca.db.serial.old
rm -f ca.db.index.old
# sign.sh END
echo "使用CA根证书签署服务器证书签署文件完毕。"
# 使用了 ssl 之后，每次启动 apache 都要求输入 server.key 的口令，
# 你可以通过下面的方法去掉口令输入(如果不希望去掉请注释以下几行代码)：
echo "去除 apache 启动时必须手工输入密钥密码的限制:"
cp -f server.key server.key.org
openssl rsa -in server.key.org -out server.key
echo "去除完毕。"
# 修改 server.key 的权限，保证密钥安全
chmod 400 server.key
echo "Now u can configure apache ssl with following:"
echo -e "tSSLCertificateFile ${sslOutputRoot}/server.crt"
echo -e "tSSLCertificateKeyFile ${sslOutputRoot}/server.key"
# die gracefully
exit 0
