「OpenSSLでプライベート認証局（CA）を構築してサーバ証明書を作成（CAコマンドで作成）」では/etc/pki/tls/misc/CAを使用して、プライベート認証局（CA）を構築して、サーバ証明書を作成しました。
CentOS8では、/etc/pki/tls/misc/CAが存在しなので、ここでは/etc/pki/tls/misc/CAを使用せずにプライベート認証局（CA）を構築して、サーバ証明書を作成してみます。

環境

OS : CentOS Linux release 8.5.2111
OpenSSL：OpenSSL 1.1.1k FIPS 25 Mar 2021

実行結果

[root@centos85 ~]# cat /etc/redhat-release
CentOS Linux release 8.5.2111
[root@centos85 ~]# openssl version
OpenSSL 1.1.1k  FIPS 25 Mar 2021
[root@centos85 ~]#

1. プライベート認証局（CA）の構築

1.1. 認証局（CA）構築準備

以下のコマンドを実行します。

mkdir /etc/pki/yasushi-jp-CA2
mkdir /etc/pki/yasushi-jp-CA2/certs
mkdir /etc/pki/yasushi-jp-CA2/crl
mkdir /etc/pki/yasushi-jp-CA2/newcerts
mkdir /etc/pki/yasushi-jp-CA2/private
touch /etc/pki/yasushi-jp-CA2/index.txt
echo 00 > /etc/pki/yasushi-jp-CA2/crlnumber
cp /etc/pki/tls/openssl.cnf /etc/pki/yasushi-jp-CA2

実行結果

[root@centos85 ~]# mkdir /etc/pki/yasushi-jp-CA2
[root@centos85 ~]# mkdir /etc/pki/yasushi-jp-CA2/certs
[root@centos85 ~]# mkdir /etc/pki/yasushi-jp-CA2/crl
[root@centos85 ~]# mkdir /etc/pki/yasushi-jp-CA2/newcerts
[root@centos85 ~]# mkdir /etc/pki/yasushi-jp-CA2/private
[root@centos85 ~]# touch /etc/pki/yasushi-jp-CA2/index.txt
[root@centos85 ~]# echo 00 > /etc/pki/yasushi-jp-CA2/crlnumber
[root@centos85 ~]# cp /etc/pki/tls/openssl.cnf /etc/pki/yasushi-jp-CA2
[root@centos85 ~]#

1.2. OpenSSLの設定ファイル編集

/etc/pki/yasushi-jp-CA2/openssl.cnfを編集します。

/etc/pki/yasushi-jp-CA2/openssl.cnf（編集前）

/etc/pki/yasushi-jp-CA2/openssl.cnf（編集前）

[root@centos85 ~]# cat -n /etc/pki/yasushi-jp-CA2/openssl.cnf
     1  #
     2  # OpenSSL example configuration file.
     3  # This is mostly being used for generation of certificate requests.
     4  #
     5
     6  # Note that you can include other files from the main configuration
     7  # file using the .include directive.
     8  #.include filename
     9
    10  # This definition stops the following lines choking if HOME isn't
    11  # defined.
    12  HOME                    = .
    13
    14  # Extra OBJECT IDENTIFIER info:
    15  #oid_file               = $ENV::HOME/.oid
    16  oid_section             = new_oids
    17
    18  # To use this configuration file with the "-extfile" option of the
    19  # "openssl x509" utility, name here the section containing the
    20  # X.509v3 extensions to use:
    21  # extensions            =
    22  # (Alternatively, use a configuration file that has only
    23  # X.509v3 extensions in its main [= default] section.)
    24
    25  # Load default TLS policy configuration
    26
    27  openssl_conf = default_modules
    28
    29  [ default_modules ]
    30
    31  ssl_conf = ssl_module
    32
    33  [ ssl_module ]
    34
    35  system_default = crypto_policy
    36
    37  [ crypto_policy ]
    38
    39  .include /etc/crypto-policies/back-ends/opensslcnf.config
    40
    41  [ new_oids ]
    42
    43  # We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
    44  # Add a simple OID like this:
    45  # testoid1=1.2.3.4
    46  # Or use config file substitution like this:
    47  # testoid2=${testoid1}.5.6
    48
    49  # Policies used by the TSA examples.
    50  tsa_policy1 = 1.2.3.4.1
    51  tsa_policy2 = 1.2.3.4.5.6
    52  tsa_policy3 = 1.2.3.4.5.7
    53
    54  ####################################################################
    55  [ ca ]
    56  default_ca      = CA_default            # The default ca section
    57
    58  ####################################################################
    59  [ CA_default ]
    60
    61  dir             = /etc/pki/CA           # Where everything is kept
    62  certs           = $dir/certs            # Where the issued certs are kept
    63  crl_dir         = $dir/crl              # Where the issued crl are kept
    64  database        = $dir/index.txt        # database index file.
    65  #unique_subject = no                    # Set to 'no' to allow creation of
    66                                          # several certs with same subject.
    67  new_certs_dir   = $dir/newcerts         # default place for new certs.
    68
    69  certificate     = $dir/cacert.pem       # The CA certificate
    70  serial          = $dir/serial           # The current serial number
    71  crlnumber       = $dir/crlnumber        # the current crl number
    72                                          # must be commented out to leave a V1 CRL
    73  crl             = $dir/crl.pem          # The current CRL
    74  private_key     = $dir/private/cakey.pem# The private key
    75
    76  x509_extensions = usr_cert              # The extensions to add to the cert
    77
    78  # Comment out the following two lines for the "traditional"
    79  # (and highly broken) format.
    80  name_opt        = ca_default            # Subject Name options
    81  cert_opt        = ca_default            # Certificate field options
    82
    83  # Extension copying option: use with caution.
    84  # copy_extensions = copy
    85
    86  # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
    87  # so this is commented out by default to leave a V1 CRL.
    88  # crlnumber must also be commented out to leave a V1 CRL.
    89  # crl_extensions        = crl_ext
    90
    91  default_days    = 365                   # how long to certify for
    92  default_crl_days= 30                    # how long before next CRL
    93  default_md      = sha256                # use SHA-256 by default
    94  preserve        = no                    # keep passed DN ordering
    95
    96  # A few difference way of specifying how similar the request should look
    97  # For type CA, the listed attributes must be the same, and the optional
    98  # and supplied fields are just that :-)
    99  policy          = policy_match
   100
   101  # For the CA policy
   102  [ policy_match ]
   103  countryName             = match
   104  stateOrProvinceName     = match
   105  organizationName        = match
   106  organizationalUnitName  = optional
   107  commonName              = supplied
   108  emailAddress            = optional
   109
   110  # For the 'anything' policy
   111  # At this point in time, you must list all acceptable 'object'
   112  # types.
   113  [ policy_anything ]
   114  countryName             = optional
   115  stateOrProvinceName     = optional
   116  localityName            = optional
   117  organizationName        = optional
   118  organizationalUnitName  = optional
   119  commonName              = supplied
   120  emailAddress            = optional
   121
   122  ####################################################################
   123  [ req ]
   124  default_bits            = 2048
   125  default_md              = sha256
   126  default_keyfile         = privkey.pem
   127  distinguished_name      = req_distinguished_name
   128  attributes              = req_attributes
   129  x509_extensions = v3_ca # The extensions to add to the self signed cert
   130
   131  # Passwords for private keys if not present they will be prompted for
   132  # input_password = secret
   133  # output_password = secret
   134
   135  # This sets a mask for permitted string types. There are several options.
   136  # default: PrintableString, T61String, BMPString.
   137  # pkix   : PrintableString, BMPString (PKIX recommendation before 2004)
   138  # utf8only: only UTF8Strings (PKIX recommendation after 2004).
   139  # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
   140  # MASK:XXXX a literal mask value.
   141  # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
   142  string_mask = utf8only
   143
   144  # req_extensions = v3_req # The extensions to add to a certificate request
   145
   146  [ req_distinguished_name ]
   147  countryName                     = Country Name (2 letter code)
   148  countryName_default             = XX
   149  countryName_min                 = 2
   150  countryName_max                 = 2
   151
   152  stateOrProvinceName             = State or Province Name (full name)
   153  #stateOrProvinceName_default    = Default Province
   154
   155  localityName                    = Locality Name (eg, city)
   156  localityName_default            = Default City
   157
   158  0.organizationName              = Organization Name (eg, company)
   159  0.organizationName_default      = Default Company Ltd
   160
   161  # we can do this but it is not needed normally :-)
   162  #1.organizationName             = Second Organization Name (eg, company)
   163  #1.organizationName_default     = World Wide Web Pty Ltd
   164
   165  organizationalUnitName          = Organizational Unit Name (eg, section)
   166  #organizationalUnitName_default =
   167
   168  commonName                      = Common Name (eg, your name or your server\'s hostname)
   169  commonName_max                  = 64
   170
   171  emailAddress                    = Email Address
   172  emailAddress_max                = 64
   173
   174  # SET-ex3                       = SET extension number 3
   175
   176  [ req_attributes ]
   177  challengePassword               = A challenge password
   178  challengePassword_min           = 4
   179  challengePassword_max           = 20
   180
   181  unstructuredName                = An optional company name
   182
   183  [ usr_cert ]
   184
   185  # These extensions are added when 'ca' signs a request.
   186
   187  # This goes against PKIX guidelines but some CAs do it and some software
   188  # requires this to avoid interpreting an end user certificate as a CA.
   189
   190  basicConstraints=CA:FALSE
   191
   192  # Here are some examples of the usage of nsCertType. If it is omitted
   193  # the certificate can be used for anything *except* object signing.
   194
   195  # This is OK for an SSL server.
   196  # nsCertType                    = server
   197
   198  # For an object signing certificate this would be used.
   199  # nsCertType = objsign
   200
   201  # For normal client use this is typical
   202  # nsCertType = client, email
   203
   204  # and for everything including object signing:
   205  # nsCertType = client, email, objsign
   206
   207  # This is typical in keyUsage for a client certificate.
   208  # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   209
   210  # This will be displayed in Netscape's comment listbox.
   211  nsComment                       = "OpenSSL Generated Certificate"
   212
   213  # PKIX recommendations harmless if included in all certificates.
   214  subjectKeyIdentifier=hash
   215  authorityKeyIdentifier=keyid,issuer
   216
   217  # This stuff is for subjectAltName and issuerAltname.
   218  # Import the email address.
   219  # subjectAltName=email:copy
   220  # An alternative to produce certificates that aren't
   221  # deprecated according to PKIX.
   222  # subjectAltName=email:move
   223
   224  # Copy subject details
   225  # issuerAltName=issuer:copy
   226
   227  #nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
   228  #nsBaseUrl
   229  #nsRevocationUrl
   230  #nsRenewalUrl
   231  #nsCaPolicyUrl
   232  #nsSslServerName
   233
   234  # This is required for TSA certificates.
   235  # extendedKeyUsage = critical,timeStamping
   236
   237  [ v3_req ]
   238
   239  # Extensions to add to a certificate request
   240
   241  basicConstraints = CA:FALSE
   242  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   243
   244  [ v3_ca ]
   245
   246
   247  # Extensions for a typical CA
   248
   249
   250  # PKIX recommendation.
   251
   252  subjectKeyIdentifier=hash
   253
   254  authorityKeyIdentifier=keyid:always,issuer
   255
   256  basicConstraints = critical,CA:true
   257
   258  # Key usage: this is typical for a CA certificate. However since it will
   259  # prevent it being used as an test self-signed certificate it is best
   260  # left out by default.
   261  # keyUsage = cRLSign, keyCertSign
   262
   263  # Some might want this also
   264  # nsCertType = sslCA, emailCA
   265
   266  # Include email address in subject alt name: another PKIX recommendation
   267  # subjectAltName=email:copy
   268  # Copy issuer details
   269  # issuerAltName=issuer:copy
   270
   271  # DER hex encoding of an extension: beware experts only!
   272  # obj=DER:02:03
   273  # Where 'obj' is a standard or added object
   274  # You can even override a supported extension:
   275  # basicConstraints= critical, DER:30:03:01:01:FF
   276
   277  [ crl_ext ]
   278
   279  # CRL extensions.
   280  # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
   281
   282  # issuerAltName=issuer:copy
   283  authorityKeyIdentifier=keyid:always
   284
   285  [ proxy_cert_ext ]
   286  # These extensions should be added when creating a proxy certificate
   287
   288  # This goes against PKIX guidelines but some CAs do it and some software
   289  # requires this to avoid interpreting an end user certificate as a CA.
   290
   291  basicConstraints=CA:FALSE
   292
   293  # Here are some examples of the usage of nsCertType. If it is omitted
   294  # the certificate can be used for anything *except* object signing.
   295
   296  # This is OK for an SSL server.
   297  # nsCertType                    = server
   298
   299  # For an object signing certificate this would be used.
   300  # nsCertType = objsign
   301
   302  # For normal client use this is typical
   303  # nsCertType = client, email
   304
   305  # and for everything including object signing:
   306  # nsCertType = client, email, objsign
   307
   308  # This is typical in keyUsage for a client certificate.
   309  # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   310
   311  # This will be displayed in Netscape's comment listbox.
   312  nsComment                       = "OpenSSL Generated Certificate"
   313
   314  # PKIX recommendations harmless if included in all certificates.
   315  subjectKeyIdentifier=hash
   316  authorityKeyIdentifier=keyid,issuer
   317
   318  # This stuff is for subjectAltName and issuerAltname.
   319  # Import the email address.
   320  # subjectAltName=email:copy
   321  # An alternative to produce certificates that aren't
   322  # deprecated according to PKIX.
   323  # subjectAltName=email:move
   324
   325  # Copy subject details
   326  # issuerAltName=issuer:copy
   327
   328  #nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
   329  #nsBaseUrl
   330  #nsRevocationUrl
   331  #nsRenewalUrl
   332  #nsCaPolicyUrl
   333  #nsSslServerName
   334
   335  # This really needs to be in place for it to be a proxy certificate.
   336  proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
   337
   338  ####################################################################
   339  [ tsa ]
   340
   341  default_tsa = tsa_config1       # the default TSA section
   342
   343  [ tsa_config1 ]
   344
   345  # These are used by the TSA reply generation only.
   346  dir             = /etc/pki/CA           # TSA root directory
   347  serial          = $dir/tsaserial        # The current serial number (mandatory)
   348  crypto_device   = builtin               # OpenSSL engine to use for signing
   349  signer_cert     = $dir/tsacert.pem      # The TSA signing certificate
   350                                          # (optional)
   351  certs           = $dir/cacert.pem       # Certificate chain to include in reply
   352                                          # (optional)
   353  signer_key      = $dir/private/tsakey.pem # The TSA private key (optional)
   354  signer_digest  = sha256                 # Signing digest to use. (Optional)
   355  default_policy  = tsa_policy1           # Policy if request did not specify it
   356                                          # (optional)
   357  other_policies  = tsa_policy2, tsa_policy3      # acceptable policies (optional)
   358  digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
   359  accuracy        = secs:1, millisecs:500, microsecs:100  # (optional)
   360  clock_precision_digits  = 0     # number of digits after dot. (optional)
   361  ordering                = yes   # Is ordering defined for timestamps?
   362                                  # (optional, default: no)
   363  tsa_name                = yes   # Must the TSA name be included in the reply?
   364                                  # (optional, default: no)
   365  ess_cert_id_chain       = no    # Must the ESS cert id chain be included?
   366                                  # (optional, default: no)
   367  ess_cert_id_alg         = sha256        # algorithm to compute certificate
   368                                  # identifier (optional, default: sha1)
[root@centos85 ~]#

61行目のCA_default内のdirの値を/etc/pki/yasushi-jp-CA2に修正
65行目のCA_default内の#unique_subject = noのコメントを外す（テスト環境のため）
84行目のCA_default内の# copy_extensions = copyのコメントを外す
91行目のCA_default内のdefault_daysの値を3650に修正
261行目のv3_ca内のkeyUsageのコメントを外し、keyUsage = critical, digitalSignature, cRLSign, keyCertSignに修正

/etc/pki/yasushi-jp-CA/openssl.cnf（抜粋）

    61  dir             = /etc/pki/yasushi-jp-CA           # Where everything is kept
    65  unique_subject = no                    # Set to 'no' to allow creation of
    84   copy_extensions = copy
    91  default_days    = 3650                  # how long to certify for
   261  keyUsage = critical, digitalSignature, cRLSign, keyCertSign

/etc/pki/yasushi-jp-CA2/openssl.cnf（編集後）

/etc/pki/yasushi-jp-CA2/openssl.cnf（編集後）

[root@centos85 ~]# cat -n /etc/pki/yasushi-jp-CA2/openssl.cnf
     1  #
     2  # OpenSSL example configuration file.
     3  # This is mostly being used for generation of certificate requests.
     4  #
     5
     6  # Note that you can include other files from the main configuration
     7  # file using the .include directive.
     8  #.include filename
     9
    10  # This definition stops the following lines choking if HOME isn't
    11  # defined.
    12  HOME                    = .
    13
    14  # Extra OBJECT IDENTIFIER info:
    15  #oid_file               = $ENV::HOME/.oid
    16  oid_section             = new_oids
    17
    18  # To use this configuration file with the "-extfile" option of the
    19  # "openssl x509" utility, name here the section containing the
    20  # X.509v3 extensions to use:
    21  # extensions            =
    22  # (Alternatively, use a configuration file that has only
    23  # X.509v3 extensions in its main [= default] section.)
    24
    25  # Load default TLS policy configuration
    26
    27  openssl_conf = default_modules
    28
    29  [ default_modules ]
    30
    31  ssl_conf = ssl_module
    32
    33  [ ssl_module ]
    34
    35  system_default = crypto_policy
    36
    37  [ crypto_policy ]
    38
    39  .include /etc/crypto-policies/back-ends/opensslcnf.config
    40
    41  [ new_oids ]
    42
    43  # We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
    44  # Add a simple OID like this:
    45  # testoid1=1.2.3.4
    46  # Or use config file substitution like this:
    47  # testoid2=${testoid1}.5.6
    48
    49  # Policies used by the TSA examples.
    50  tsa_policy1 = 1.2.3.4.1
    51  tsa_policy2 = 1.2.3.4.5.6
    52  tsa_policy3 = 1.2.3.4.5.7
    53
    54  ####################################################################
    55  [ ca ]
    56  default_ca      = CA_default            # The default ca section
    57
    58  ####################################################################
    59  [ CA_default ]
    60
    61  dir             = /etc/pki/yasushi-jp-CA2       # Where everything is kept
    62  certs           = $dir/certs            # Where the issued certs are kept
    63  crl_dir         = $dir/crl              # Where the issued crl are kept
    64  database        = $dir/index.txt        # database index file.
    65  unique_subject  = no                    # Set to 'no' to allow creation of
    66                                          # several certs with same subject.
    67  new_certs_dir   = $dir/newcerts         # default place for new certs.
    68
    69  certificate     = $dir/cacert.pem       # The CA certificate
    70  serial          = $dir/serial           # The current serial number
    71  crlnumber       = $dir/crlnumber        # the current crl number
    72                                          # must be commented out to leave a V1 CRL
    73  crl             = $dir/crl.pem          # The current CRL
    74  private_key     = $dir/private/cakey.pem# The private key
    75
    76  x509_extensions = usr_cert              # The extensions to add to the cert
    77
    78  # Comment out the following two lines for the "traditional"
    79  # (and highly broken) format.
    80  name_opt        = ca_default            # Subject Name options
    81  cert_opt        = ca_default            # Certificate field options
    82
    83  # Extension copying option: use with caution.
    84  copy_extensions = copy
    85
    86  # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
    87  # so this is commented out by default to leave a V1 CRL.
    88  # crlnumber must also be commented out to leave a V1 CRL.
    89  # crl_extensions        = crl_ext
    90
    91  default_days    = 3650                  # how long to certify for
    92  default_crl_days= 30                    # how long before next CRL
    93  default_md      = sha256                # use SHA-256 by default
    94  preserve        = no                    # keep passed DN ordering
    95
    96  # A few difference way of specifying how similar the request should look
    97  # For type CA, the listed attributes must be the same, and the optional
    98  # and supplied fields are just that :-)
    99  policy          = policy_match
   100
   101  # For the CA policy
   102  [ policy_match ]
   103  countryName             = match
   104  stateOrProvinceName     = match
   105  organizationName        = match
   106  organizationalUnitName  = optional
   107  commonName              = supplied
   108  emailAddress            = optional
   109
   110  # For the 'anything' policy
   111  # At this point in time, you must list all acceptable 'object'
   112  # types.
   113  [ policy_anything ]
   114  countryName             = optional
   115  stateOrProvinceName     = optional
   116  localityName            = optional
   117  organizationName        = optional
   118  organizationalUnitName  = optional
   119  commonName              = supplied
   120  emailAddress            = optional
   121
   122  ####################################################################
   123  [ req ]
   124  default_bits            = 2048
   125  default_md              = sha256
   126  default_keyfile         = privkey.pem
   127  distinguished_name      = req_distinguished_name
   128  attributes              = req_attributes
   129  x509_extensions = v3_ca # The extensions to add to the self signed cert
   130
   131  # Passwords for private keys if not present they will be prompted for
   132  # input_password = secret
   133  # output_password = secret
   134
   135  # This sets a mask for permitted string types. There are several options.
   136  # default: PrintableString, T61String, BMPString.
   137  # pkix   : PrintableString, BMPString (PKIX recommendation before 2004)
   138  # utf8only: only UTF8Strings (PKIX recommendation after 2004).
   139  # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
   140  # MASK:XXXX a literal mask value.
   141  # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
   142  string_mask = utf8only
   143
   144  # req_extensions = v3_req # The extensions to add to a certificate request
   145
   146  [ req_distinguished_name ]
   147  countryName                     = Country Name (2 letter code)
   148  countryName_default             = XX
   149  countryName_min                 = 2
   150  countryName_max                 = 2
   151
   152  stateOrProvinceName             = State or Province Name (full name)
   153  #stateOrProvinceName_default    = Default Province
   154
   155  localityName                    = Locality Name (eg, city)
   156  localityName_default            = Default City
   157
   158  0.organizationName              = Organization Name (eg, company)
   159  0.organizationName_default      = Default Company Ltd
   160
   161  # we can do this but it is not needed normally :-)
   162  #1.organizationName             = Second Organization Name (eg, company)
   163  #1.organizationName_default     = World Wide Web Pty Ltd
   164
   165  organizationalUnitName          = Organizational Unit Name (eg, section)
   166  #organizationalUnitName_default =
   167
   168  commonName                      = Common Name (eg, your name or your server\'s hostname)
   169  commonName_max                  = 64
   170
   171  emailAddress                    = Email Address
   172  emailAddress_max                = 64
   173
   174  # SET-ex3                       = SET extension number 3
   175
   176  [ req_attributes ]
   177  challengePassword               = A challenge password
   178  challengePassword_min           = 4
   179  challengePassword_max           = 20
   180
   181  unstructuredName                = An optional company name
   182
   183  [ usr_cert ]
   184
   185  # These extensions are added when 'ca' signs a request.
   186
   187  # This goes against PKIX guidelines but some CAs do it and some software
   188  # requires this to avoid interpreting an end user certificate as a CA.
   189
   190  basicConstraints=CA:FALSE
   191
   192  # Here are some examples of the usage of nsCertType. If it is omitted
   193  # the certificate can be used for anything *except* object signing.
   194
   195  # This is OK for an SSL server.
   196  # nsCertType                    = server
   197
   198  # For an object signing certificate this would be used.
   199  # nsCertType = objsign
   200
   201  # For normal client use this is typical
   202  # nsCertType = client, email
   203
   204  # and for everything including object signing:
   205  # nsCertType = client, email, objsign
   206
   207  # This is typical in keyUsage for a client certificate.
   208  # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   209
   210  # This will be displayed in Netscape's comment listbox.
   211  nsComment                       = "OpenSSL Generated Certificate"
   212
   213  # PKIX recommendations harmless if included in all certificates.
   214  subjectKeyIdentifier=hash
   215  authorityKeyIdentifier=keyid,issuer
   216
   217  # This stuff is for subjectAltName and issuerAltname.
   218  # Import the email address.
   219  # subjectAltName=email:copy
   220  # An alternative to produce certificates that aren't
   221  # deprecated according to PKIX.
   222  # subjectAltName=email:move
   223
   224  # Copy subject details
   225  # issuerAltName=issuer:copy
   226
   227  #nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
   228  #nsBaseUrl
   229  #nsRevocationUrl
   230  #nsRenewalUrl
   231  #nsCaPolicyUrl
   232  #nsSslServerName
   233
   234  # This is required for TSA certificates.
   235  # extendedKeyUsage = critical,timeStamping
   236
   237  [ v3_req ]
   238
   239  # Extensions to add to a certificate request
   240
   241  basicConstraints = CA:FALSE
   242  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   243
   244  [ v3_ca ]
   245
   246
   247  # Extensions for a typical CA
   248
   249
   250  # PKIX recommendation.
   251
   252  subjectKeyIdentifier=hash
   253
   254  authorityKeyIdentifier=keyid:always,issuer
   255
   256  basicConstraints = critical,CA:true
   257
   258  # Key usage: this is typical for a CA certificate. However since it will
   259  # prevent it being used as an test self-signed certificate it is best
   260  # left out by default.
   261  keyUsage = critical, digitalSignature, cRLSign, keyCertSign
   262
   263  # Some might want this also
   264  # nsCertType = sslCA, emailCA
   265
   266  # Include email address in subject alt name: another PKIX recommendation
   267  # subjectAltName=email:copy
   268  # Copy issuer details
   269  # issuerAltName=issuer:copy
   270
   271  # DER hex encoding of an extension: beware experts only!
   272  # obj=DER:02:03
   273  # Where 'obj' is a standard or added object
   274  # You can even override a supported extension:
   275  # basicConstraints= critical, DER:30:03:01:01:FF
   276
   277  [ crl_ext ]
   278
   279  # CRL extensions.
   280  # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
   281
   282  # issuerAltName=issuer:copy
   283  authorityKeyIdentifier=keyid:always
   284
   285  [ proxy_cert_ext ]
   286  # These extensions should be added when creating a proxy certificate
   287
   288  # This goes against PKIX guidelines but some CAs do it and some software
   289  # requires this to avoid interpreting an end user certificate as a CA.
   290
   291  basicConstraints=CA:FALSE
   292
   293  # Here are some examples of the usage of nsCertType. If it is omitted
   294  # the certificate can be used for anything *except* object signing.
   295
   296  # This is OK for an SSL server.
   297  # nsCertType                    = server
   298
   299  # For an object signing certificate this would be used.
   300  # nsCertType = objsign
   301
   302  # For normal client use this is typical
   303  # nsCertType = client, email
   304
   305  # and for everything including object signing:
   306  # nsCertType = client, email, objsign
   307
   308  # This is typical in keyUsage for a client certificate.
   309  # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   310
   311  # This will be displayed in Netscape's comment listbox.
   312  nsComment                       = "OpenSSL Generated Certificate"
   313
   314  # PKIX recommendations harmless if included in all certificates.
   315  subjectKeyIdentifier=hash
   316  authorityKeyIdentifier=keyid,issuer
   317
   318  # This stuff is for subjectAltName and issuerAltname.
   319  # Import the email address.
   320  # subjectAltName=email:copy
   321  # An alternative to produce certificates that aren't
   322  # deprecated according to PKIX.
   323  # subjectAltName=email:move
   324
   325  # Copy subject details
   326  # issuerAltName=issuer:copy
   327
   328  #nsCaRevocationUrl              = http://www.domain.dom/ca-crl.pem
   329  #nsBaseUrl
   330  #nsRevocationUrl
   331  #nsRenewalUrl
   332  #nsCaPolicyUrl
   333  #nsSslServerName
   334
   335  # This really needs to be in place for it to be a proxy certificate.
   336  proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
   337
   338  ####################################################################
   339  [ tsa ]
   340
   341  default_tsa = tsa_config1       # the default TSA section
   342
   343  [ tsa_config1 ]
   344
   345  # These are used by the TSA reply generation only.
   346  dir             = /etc/pki/CA           # TSA root directory
   347  serial          = $dir/tsaserial        # The current serial number (mandatory)
   348  crypto_device   = builtin               # OpenSSL engine to use for signing
   349  signer_cert     = $dir/tsacert.pem      # The TSA signing certificate
   350                                          # (optional)
   351  certs           = $dir/cacert.pem       # Certificate chain to include in reply
   352                                          # (optional)
   353  signer_key      = $dir/private/tsakey.pem # The TSA private key (optional)
   354  signer_digest  = sha256                 # Signing digest to use. (Optional)
   355  default_policy  = tsa_policy1           # Policy if request did not specify it
   356                                          # (optional)
   357  other_policies  = tsa_policy2, tsa_policy3      # acceptable policies (optional)
   358  digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
   359  accuracy        = secs:1, millisecs:500, microsecs:100  # (optional)
   360  clock_precision_digits  = 0     # number of digits after dot. (optional)
   361  ordering                = yes   # Is ordering defined for timestamps?
   362                                  # (optional, default: no)
   363  tsa_name                = yes   # Must the TSA name be included in the reply?
   364                                  # (optional, default: no)
   365  ess_cert_id_chain       = no    # Must the ESS cert id chain be included?
   366                                  # (optional, default: no)
   367  ess_cert_id_alg         = sha256        # algorithm to compute certificate
   368                                  # identifier (optional, default: sha1)
[root@centos85 ~]#

1.3. プライベート認証局（CA）の作成

yasushi-jp-CA2のプライベート認証局（CA）を作成します。

以下のコマンドでyasushi-jp-CA2のプライベート認証局（CA）の秘密鍵と証明書署名要求（CSR）を作成します。

openssl req -config /etc/pki/yasushi-jp-CA2/openssl.cnf -new -keyout /etc/pki/yasushi-jp-CA2/private/cakey.pem -out /etc/pki/yasushi-jp-CA2/careq.pem

Enter PEM pass phrase:ときかれるので、パスワード（ここではP@ssw0rd）を入力し、Enterを押します。

[root@centos85 ~]# openssl req -config /etc/pki/yasushi-jp-CA2/openssl.cnf -new -keyout /etc/pki/yasushi-jp-CA2/private/cakey.pem -out /etc/pki/yasushi-jp-CA2/careq.pem
Generating a RSA private key
...........+++++
................................+++++
writing new private key to '/etc/pki/yasushi-jp-CA2/private/cakey.pem'
Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:ときかれるので、先程入力したパスワード（ここではP@ssw0rd）を入力し、Enterを押します。

writing new private key to '/etc/pki/yasushi-jp-CA2/private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
をきかれるので、入力します。

ここでは以下を入力しました。

Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Kanagawa
Locality Name (eg, city) [Default City]:Yokohama
Organization Name (eg, company) [Default Company Ltd]:Yasushi-jp2, Ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:Yasushi-jp2 Root CA 1
Email Address []:

A challenge password []:
An optional company name []:
をきかれるので、入力します。

ここでは空を入力しました。

A challenge password []:
An optional company name []:

実行結果

[root@centos85 ~]# openssl req -config /etc/pki/yasushi-jp-CA2/openssl.cnf -new -keyout /etc/pki/yasushi-jp-CA2/private/cakey.pem -out /etc/pki/yasushi-jp-CA2/careq.pem
Generating a RSA private key
...........+++++
................................+++++
writing new private key to '/etc/pki/yasushi-jp-CA2/private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Kanagawa
Locality Name (eg, city) [Default City]:Yokohama
Organization Name (eg, company) [Default Company Ltd]:Yasushi-jp2, Ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:Yasushi-jp2 Root CA 1
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@centos85 ~]#

以下のコマンドでyasushi-jp-CA2のプライベート認証局（CA）の証明書要求（CSR）に自己署名します。

openssl ca -config /etc/pki/yasushi-jp-CA2/openssl.cnf -create_serial -out /etc/pki/yasushi-jp-CA2/cacert.pem -days 3650 -batch -keyfile /etc/pki/yasushi-jp-CA2/private/cakey.pem -selfsign -extensions v3_ca -infiles /etc/pki/yasushi-jp-CA2/careq.pem

Enter pass phrase for /etc/pki/yasushi-jp-CA2/private/cakey.pem:とパスワードをきかれるので、先程入力したパスワード（ここではP@ssw0rd）を入力し、Enterを押します。

[root@centos85 ~]# openssl ca -config /etc/pki/yasushi-jp-CA2/openssl.cnf -create_serial -out /etc/pki/yasushi-jp-CA2/cacert.pem -days 3650 -batch -keyfile /etc/pki/yasushi-jp-CA2/private/cakey.pem -selfsign -extensions v3_ca -infiles /etc/pki/yasushi-jp-CA2/careq.pem
Using configuration from /etc/pki/yasushi-jp-CA2/openssl.cnf
Enter pass phrase for /etc/pki/yasushi-jp-CA2/private/cakey.pem:

実行結果

[root@centos85 ~]# openssl ca -config /etc/pki/yasushi-jp-CA2/openssl.cnf -create_serial -out /etc/pki/yasushi-jp-CA2/cacert.pem -days 3650 -batch -keyfile /etc/pki/yasushi-jp-CA2/private/cakey.pem -selfsign -extensions v3_ca -infiles /etc/pki/yasushi-jp-CA2/careq.pem
Using configuration from /etc/pki/yasushi-jp-CA2/openssl.cnf
Enter pass phrase for /etc/pki/yasushi-jp-CA2/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            61:9b:75:fc:6b:90:a5:e2:8b:f9:54:8e:fd:da:0f:d5:e6:db:d8:08
        Validity
            Not Before: Jan 15 14:24:54 2024 GMT
            Not After : Jan 12 14:24:54 2034 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Kanagawa
            organizationName          = Yasushi-jp2, Ltd.
            commonName                = Yasushi-jp2 Root CA 1
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                7B:CA:E1:62:0D:7C:C5:88:A6:D5:3C:F8:8D:F5:7C:F3:42:92:07:67
            X509v3 Authority Key Identifier:
                keyid:7B:CA:E1:62:0D:7C:C5:88:A6:D5:3C:F8:8D:F5:7C:F3:42:92:07:67

            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
Certificate is to be certified until Jan 12 14:24:54 2034 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
[root@centos85 ~]#

/etc/pki/yasushi-jp-CA配下を確認したところ、以下の通り作成されています。
/etc/pki/yasushi-jp-CA2/cacert.pemと/etc/pki/yasushi-jp-CA2/newcerts/3E1F8E1E912D9E0744E41FA6C8D695C4AAFDA019.pemは一致しています。

ファイル確認結果

[root@centos85 ~]# ls -Rl /etc/pki/yasushi-jp-CA2
/etc/pki/yasushi-jp-CA2:
合計 40
-rw-r--r--. 1 root root  4557  1月 15 23:24 cacert.pem
-rw-r--r--. 1 root root  1013  1月 15 23:19 careq.pem
drwxr-xr-x. 2 root root     6  1月 15 22:38 certs
drwxr-xr-x. 2 root root     6  1月 15 22:38 crl
-rw-r--r--. 1 root root     3  1月 15 22:38 crlnumber
-rw-r--r--. 1 root root   129  1月 15 23:24 index.txt
-rw-r--r--. 1 root root    20  1月 15 23:24 index.txt.attr
-rw-r--r--. 1 root root     0  1月 15 22:38 index.txt.old
drwxr-xr-x. 2 root root    58  1月 15 23:24 newcerts
-rw-r--r--. 1 root root 11262  1月 15 22:45 openssl.cnf
drwxr-xr-x. 2 root root    23  1月 15 23:12 private
-rw-r--r--. 1 root root    41  1月 15 23:24 serial

/etc/pki/yasushi-jp-CA2/certs:
合計 0

/etc/pki/yasushi-jp-CA2/crl:
合計 0

/etc/pki/yasushi-jp-CA2/newcerts:
合計 8
-rw-r--r--. 1 root root 4557  1月 15 23:24 619B75FC6B90A5E28BF9548EFDDA0FD5E6DBD808.pem

/etc/pki/yasushi-jp-CA2/private:
合計 4
-rw-------. 1 root root 1854  1月 15 23:16 cakey.pem
[root@centos85 ~]# diff /etc/pki/yasushi-jp-CA2/cacert.pem /etc/pki/yasushi-jp-CA2/newcerts/619B75FC6B90A5E28BF9548EFDDA0FD5E6DBD808.pem
[root@centos85 ~]#

以下のコマンドで作成したプライベート認証局（CA）の秘密鍵を確認してみます。

openssl rsa -text -noout -in /etc/pki/yasushi-jp-CA2/private/cakey.pem

/etc/pki/yasushi-jp-CA2/private/cakey.pem（CA秘密鍵）

[root@centos85 ~]# openssl rsa -text -noout -in /etc/pki/yasushi-jp-CA2/private/cakey.pem
Enter pass phrase for /etc/pki/yasushi-jp-CA2/private/cakey.pem:
RSA Private-Key: (2048 bit, 2 primes)
modulus:
    00:d9:0b:7a:71:da:53:59:e7:8f:b0:12:6f:01:4a:
    ac:f9:21:5e:82:fb:94:13:1c:ce:de:31:44:5f:e3:
    8f:a6:a1:52:ca:02:f2:0c:07:86:ef:1c:40:0d:35:
    79:73:e9:07:df:28:ec:da:d1:0d:78:38:79:f9:cc:
    1f:d2:43:00:05:f1:f6:2c:26:4f:f6:58:89:2d:0d:
    23:6e:bd:0f:97:99:42:99:cb:d9:59:c4:07:a7:81:
    3f:61:a3:21:62:be:fa:d1:18:8d:98:ab:a8:59:27:
    bf:6e:8e:eb:37:2c:ce:24:fe:40:6a:63:17:87:2e:
    c5:b0:8e:d3:bc:ff:5c:05:aa:16:0c:99:56:16:9d:
    eb:b7:9b:d5:7d:c1:7e:e0:cd:15:05:0d:52:24:6f:
    83:94:6a:c3:03:89:b0:07:bb:5e:74:09:6f:d1:c5:
    37:17:d4:91:13:cb:46:55:cf:3b:92:45:fe:6c:d7:
    be:d0:8e:ce:bc:3e:af:d4:5b:40:20:4f:6b:3d:3d:
    e7:ae:97:b2:60:ca:85:57:1f:22:cb:75:3a:2f:31:
    b2:10:12:4b:de:3e:da:00:62:fe:cf:57:fa:3f:ad:
    d1:17:58:14:19:34:fb:01:a2:2c:cf:fb:be:9d:4f:
    8a:e2:45:6d:10:96:3c:8c:bc:a6:86:21:89:2f:f9:
    c9:a5
publicExponent: 65537 (0x10001)
privateExponent:
    2f:1b:5e:a7:f7:4a:bf:e8:92:37:14:c9:22:ee:a2:
    3c:30:11:e3:3b:d7:17:8e:d9:17:40:7a:26:95:ad:
    47:ed:1b:9a:dc:a8:cc:13:96:25:af:6b:f7:71:f3:
    ba:44:89:80:d5:d1:12:6c:ed:0f:7a:b2:7e:94:df:
    13:33:97:7d:b2:d6:4b:1e:c5:9c:21:fb:23:dc:06:
    24:b2:c3:ff:93:33:f1:4d:5d:0f:2e:8c:ba:be:42:
    93:5e:64:90:9a:02:b5:ff:2e:3c:44:85:75:54:3b:
    28:33:bc:b9:6c:f0:10:f7:5d:e3:b9:3e:12:09:04:
    bf:1d:40:b7:74:74:f4:85:5f:5e:1c:ca:17:f6:b9:
    f1:78:a6:a3:d8:af:11:1b:07:1e:eb:fc:78:94:69:
    e6:11:88:3c:86:64:09:05:30:3b:bd:fd:29:c5:d6:
    ac:e0:04:42:6b:e1:24:2a:1a:58:7a:5d:3e:6e:7d:
    60:4b:96:fb:de:09:90:66:48:37:32:d8:9b:c2:d0:
    fe:5b:02:a6:9d:eb:80:f2:a2:88:de:ce:e4:f8:cf:
    3d:7e:e7:50:72:3b:7c:2b:97:7d:92:6b:fe:86:14:
    53:bf:aa:24:f6:3a:8c:fc:89:4b:97:73:87:2a:10:
    06:bf:69:b5:5d:bf:25:4e:de:2e:50:b3:24:63:18:
    c1
prime1:
    00:fa:f2:70:76:a0:6a:b8:f6:81:c4:a5:7e:d9:83:
    b7:b8:43:fd:b0:a8:2f:5f:b6:72:50:5e:4a:94:c6:
    89:44:54:2c:cd:85:a4:e0:48:17:39:8e:8b:9f:8c:
    20:f1:92:0a:72:69:81:e2:e0:c1:a9:2a:28:b1:eb:
    17:4f:8c:37:67:19:b5:47:aa:d2:66:79:98:ab:c0:
    66:a1:f6:35:31:de:1c:92:54:f4:8a:45:3d:c3:cc:
    58:d7:36:32:08:3b:20:7a:b7:f8:e6:41:46:63:52:
    5f:03:93:99:cb:2d:ab:40:3c:16:27:42:86:93:8e:
    2b:74:14:27:c4:ab:a3:45:d7
prime2:
    00:dd:6a:48:66:b8:21:05:af:33:8c:71:c1:df:a4:
    e4:8c:60:89:85:c2:35:ba:92:51:75:8f:62:cd:cd:
    8e:5f:38:15:33:de:11:ee:ce:c1:5a:5b:34:11:9f:
    25:d2:29:53:a2:07:27:dc:3f:1e:38:ba:e2:ec:a9:
    57:14:0b:1c:a0:87:40:67:8d:7d:49:91:f2:75:af:
    84:e5:20:18:ba:c9:50:14:ac:c0:5e:8c:bc:e9:98:
    fc:d7:aa:d2:d6:ee:a1:27:d5:5d:7d:3d:00:2a:c6:
    bf:72:ce:f1:5f:72:90:94:a4:2d:d3:1b:f7:1a:1b:
    f9:aa:49:f8:03:7d:50:84:e3
exponent1:
    06:f9:07:90:f4:42:22:e3:8e:95:85:37:b2:19:8b:
    d8:4d:e3:55:ae:46:aa:b5:2a:15:fb:98:bc:eb:8b:
    52:df:b7:e2:fa:0c:ab:c2:b5:0a:7f:60:77:cd:6f:
    f8:e6:62:ed:ec:ea:94:00:44:c1:4b:8f:97:e9:fd:
    5a:d3:7d:92:9a:cf:43:af:86:6b:1c:83:d6:79:e1:
    20:2c:f4:2b:6f:8d:81:af:64:a0:16:ee:71:6b:53:
    28:9f:b3:e2:30:aa:65:5e:89:46:f4:97:5d:19:23:
    d4:b8:9c:34:5e:0f:7d:18:6e:51:26:f3:10:54:89:
    f6:8e:bc:d0:25:28:c3:3f
exponent2:
    53:bf:c0:d5:01:ae:93:ec:da:2d:b4:55:a5:d7:44:
    0f:88:f0:5b:a4:c3:17:e8:02:61:da:33:80:2e:d1:
    3c:59:05:44:12:2a:6c:4e:ce:39:f4:27:74:c6:e2:
    d2:64:89:5a:cf:24:17:9d:d4:3b:97:0d:00:81:69:
    0b:8e:cc:6c:37:dc:77:8e:c0:26:14:cb:46:12:76:
    cd:07:df:f2:be:f4:c8:6d:33:72:4f:ff:a0:c8:1a:
    53:25:2d:0c:d9:44:21:c2:05:d3:ba:40:16:ee:08:
    3a:4f:e6:62:b8:fd:d1:0b:6c:bd:de:65:0f:fe:26:
    e8:6f:84:1d:25:c8:50:0b
coefficient:
    3a:68:fc:99:c6:65:53:59:79:9a:f1:a5:19:29:19:
    f9:c3:d7:28:ef:ec:4f:0b:54:1d:64:34:50:6c:1c:
    c4:77:66:fd:74:79:82:68:5e:34:9f:22:17:86:5c:
    60:df:b0:66:de:53:19:84:ee:ac:36:d1:06:30:40:
    af:92:01:c5:56:e3:b3:1b:22:48:9e:9f:f4:99:7e:
    7d:c8:28:f1:07:37:19:1a:45:81:ab:7c:da:26:84:
    a7:01:f7:82:f9:b9:b1:96:fe:0f:7a:6e:a5:ac:5f:
    a5:59:d9:ca:5a:73:65:3a:58:41:bc:66:c5:a4:21:
    00:9c:59:08:aa:da:f9:12
[root@centos85 ~]#

以下のコマンドで作成したプライベート認証局（CA）の証明書を確認してみます。

openssl x509 -text -noout -in /etc/pki/yasushi-jp-CA2/cacert.pem

/etc/pki/yasushi-jp-CA/cacert.pem（CA証明書）

[root@centos85 ~]# openssl x509 -text -noout -in /etc/pki/yasushi-jp-CA2/cacert.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:9b:75:fc:6b:90:a5:e2:8b:f9:54:8e:fd:da:0f:d5:e6:db:d8:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, ST = Kanagawa, O = "Yasushi-jp2, Ltd.", CN = Yasushi-jp2 Root CA 1
        Validity
            Not Before: Jan 15 14:24:54 2024 GMT
            Not After : Jan 12 14:24:54 2034 GMT
        Subject: C = JP, ST = Kanagawa, O = "Yasushi-jp2, Ltd.", CN = Yasushi-jp2 Root CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:d9:0b:7a:71:da:53:59:e7:8f:b0:12:6f:01:4a:
                    ac:f9:21:5e:82:fb:94:13:1c:ce:de:31:44:5f:e3:
                    8f:a6:a1:52:ca:02:f2:0c:07:86:ef:1c:40:0d:35:
                    79:73:e9:07:df:28:ec:da:d1:0d:78:38:79:f9:cc:
                    1f:d2:43:00:05:f1:f6:2c:26:4f:f6:58:89:2d:0d:
                    23:6e:bd:0f:97:99:42:99:cb:d9:59:c4:07:a7:81:
                    3f:61:a3:21:62:be:fa:d1:18:8d:98:ab:a8:59:27:
                    bf:6e:8e:eb:37:2c:ce:24:fe:40:6a:63:17:87:2e:
                    c5:b0:8e:d3:bc:ff:5c:05:aa:16:0c:99:56:16:9d:
                    eb:b7:9b:d5:7d:c1:7e:e0:cd:15:05:0d:52:24:6f:
                    83:94:6a:c3:03:89:b0:07:bb:5e:74:09:6f:d1:c5:
                    37:17:d4:91:13:cb:46:55:cf:3b:92:45:fe:6c:d7:
                    be:d0:8e:ce:bc:3e:af:d4:5b:40:20:4f:6b:3d:3d:
                    e7:ae:97:b2:60:ca:85:57:1f:22:cb:75:3a:2f:31:
                    b2:10:12:4b:de:3e:da:00:62:fe:cf:57:fa:3f:ad:
                    d1:17:58:14:19:34:fb:01:a2:2c:cf:fb:be:9d:4f:
                    8a:e2:45:6d:10:96:3c:8c:bc:a6:86:21:89:2f:f9:
                    c9:a5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                7B:CA:E1:62:0D:7C:C5:88:A6:D5:3C:F8:8D:F5:7C:F3:42:92:07:67
            X509v3 Authority Key Identifier:
                keyid:7B:CA:E1:62:0D:7C:C5:88:A6:D5:3C:F8:8D:F5:7C:F3:42:92:07:67

            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
         96:9f:81:a5:db:37:82:4c:f6:83:ce:02:72:f4:96:42:11:3c:
         db:e9:d0:fb:42:d7:54:06:ac:ae:68:20:62:5b:c5:d9:ac:ad:
         28:f5:85:38:7c:f4:7a:e6:49:ef:80:85:a3:56:5f:9c:17:ba:
         f2:5b:19:6e:3a:b3:11:34:5e:18:a7:1e:9d:c3:a8:62:07:b5:
         10:29:33:fd:12:14:c8:ef:57:83:e9:db:3d:e1:48:97:fc:36:
         6d:1d:72:71:f1:82:c1:63:b6:f4:4b:8a:9f:a3:8f:67:7e:36:
         93:1c:54:9a:00:60:b9:eb:1b:d7:23:cf:e6:90:49:ff:66:16:
         d7:0c:4e:7e:4e:fd:70:05:89:97:dc:b1:61:2b:bc:c9:77:e1:
         22:e2:d3:7a:5d:0c:d7:c7:a5:c2:1d:d9:32:5a:ab:05:0d:74:
         ed:26:6f:70:71:4d:b8:2e:3a:3e:82:19:0c:08:53:53:81:cb:
         c9:21:f3:40:34:53:ce:f4:07:51:5f:54:38:71:03:86:15:d6:
         94:2b:ab:75:f6:ab:d5:1d:eb:6d:a5:50:54:ec:81:8e:db:48:
         36:c5:1b:4a:04:95:06:96:b2:4e:00:00:72:f6:6b:49:93:3c:
         d5:02:83:b6:45:ac:61:c0:01:f8:b7:32:18:2e:f5:e6:86:d4:
         a7:c7:67:d4
[root@centos85 ~]#

2. サーバ証明書の作成

2.1. サーバの秘密鍵を作成

以下のコマンドでサーバの秘密鍵を作成します。
（ここではパスフレーズ無しの秘密鍵を作成しています。）

openssl genrsa -out /root/server2/server.key 2048

実行結果

[root@centos85 ~]# openssl genrsa -out /root/server2/server.key  2048
Generating RSA private key, 2048 bit long modulus (2 primes)
................+++++
......+++++
e is 65537 (0x010001)
[root@centos85 ~]#

2.2. サーバの証明書署名要求の作成

以下の/root/server2/san.cnfファイルを作成します。

/root/server2/san.cnf

[ req ]
default_bits            = 2048
encrypt_key             = no
default_md              = sha256
utf8                    = yes
string_mask             = utf8only
prompt                  = no
distinguished_name      = req_distinguished_name
req_extensions          = v3_req

[ req_distinguished_name ]
countryName             = JP
stateOrProvinceName     = Kanagawa
localityName            = Yokohama
organizationName        = example2 Inc.
commonName              = *.example2.com

[ v3_req ]
basicConstraints        = CA:FALSE
keyUsage                = critical,digitalSignature,keyEncipherment
extendedKeyUsage        = serverAuth
subjectKeyIdentifier    = hash
subjectAltName          = @alt_names

[alt_names]
DNS.1                   = example2.com
DNS.2                   = *.example2.com
DNS.3                   = example2.co.jp
DNS.4                   = *.example2.co.jp

以下のコマンドでサーバの証明書署名要求（CSR）を作成します。

openssl req -new -config /root/server2/san.cnf -key /root/server2/server.key -out /root/server2/server.csr

実行結果

[root@centos85 ~]# openssl req -new -config /root/server2/san.cnf -key /root/server2/server.key -out /root/server2/server.csr
[root@centos85 ~]#

以下のコマンドで作成したCSRファイルを確認してみます。

openssl req -text -noout -in /root/server2/server.csr

実行結果

[root@centos85 ~]# openssl req -text -noout -in /root/server2/server.csr
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C = JP, ST = Kanagawa, L = Yokohama, O = example2 Inc., CN = *.example2.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bd:4a:c4:37:2c:d7:4f:a9:59:15:93:b8:11:7d:
                    4c:96:7a:5f:64:9d:e9:9b:28:fa:ce:ec:a7:06:51:
                    4f:e6:05:7c:08:3c:fc:9b:de:c2:3a:96:75:84:dc:
                    cc:3e:f2:e7:0e:6f:7f:1a:5d:d2:20:8c:cf:73:e0:
                    cd:80:40:ea:aa:61:76:2f:8a:73:9f:16:b5:37:13:
                    86:8a:0b:ba:f2:68:01:02:25:8a:57:ea:98:2e:a8:
                    3f:e0:83:03:46:a6:e3:d3:db:13:b1:a6:24:9a:bd:
                    8e:f5:5f:b0:52:a6:f8:d5:b6:a6:97:76:fb:9a:72:
                    3d:c8:19:43:7b:3f:5a:37:c8:24:64:9a:1b:df:e7:
                    f1:00:c8:1f:ac:f4:61:92:6c:1f:cc:2c:2c:db:7b:
                    2b:db:57:7b:c9:7e:02:93:5b:6a:76:9c:53:c6:2d:
                    dd:a1:d6:49:e9:55:d4:bc:16:d5:4a:fe:77:1e:bd:
                    af:12:f2:23:f7:e2:2d:94:0d:58:8b:ec:5f:46:fb:
                    12:c4:f0:96:45:66:13:5d:9e:99:b7:b3:f9:90:ae:
                    23:af:fc:89:51:58:0b:4c:18:44:8d:92:9b:ef:a9:
                    03:a1:af:50:a2:0e:ca:9d:ee:4e:27:f0:5d:37:39:
                    6b:a6:5f:ab:6f:de:8b:f4:62:50:73:23:0c:e9:30:
                    f5:b1
                Exponent: 65537 (0x10001)
        Attributes:
        Requested Extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                46:D8:59:3F:03:F2:0A:6C:F7:48:31:87:6D:0B:C8:FF:0C:E8:37:2F
            X509v3 Subject Alternative Name:
                DNS:example2.com, DNS:*.example2.com, DNS:example2.co.jp, DNS:*.example2.co.jp
    Signature Algorithm: sha256WithRSAEncryption
         2d:9f:27:ce:c8:95:d2:69:28:7f:b8:49:ac:eb:6e:9c:4d:99:
         22:27:d3:e1:a9:08:f2:59:f1:d2:23:d0:a2:30:f4:56:9f:3f:
         73:50:5e:e6:b3:4a:47:ed:aa:b4:c8:74:81:88:da:23:2e:9c:
         fb:13:4e:29:07:31:1c:7d:b8:6e:fa:fc:b1:10:48:f4:70:2f:
         33:ba:6e:b9:83:28:88:49:cb:a8:06:f2:00:db:c2:4b:0a:d3:
         48:32:18:79:57:ee:2a:76:f0:b8:91:b5:e4:46:f0:94:2f:9a:
         01:99:e1:74:25:15:cf:55:23:34:30:51:f6:3d:96:14:e9:49:
         a9:cc:39:97:c6:22:6b:27:86:49:7b:e4:41:32:2e:6a:29:07:
         7b:f6:ce:a7:b7:5a:92:b6:5d:66:4f:98:f8:c5:3b:15:c2:0c:
         a3:14:ae:6a:e8:2f:01:8c:0a:41:7b:5c:09:e7:ec:fd:47:b5:
         88:64:f9:d1:c4:36:fd:fb:3d:99:1f:e3:18:b5:33:23:78:ed:
         be:cc:49:6f:53:66:17:d3:23:d5:e3:3f:93:71:04:aa:3f:5b:
         44:40:1c:27:c2:06:3c:1c:21:6e:47:ba:71:fe:43:5f:1c:72:
         ce:6e:25:c3:37:d9:3a:a5:83:10:36:92:5a:79:50:bd:f4:3f:
         fa:b2:a9:ba
[root@centos85 ~]#

2.3. プライベート認証局（CA）で署名してサーバ証明書を発行

以下のコマンドでサーバのCSRファイルに、プライベート認証局（CA）の秘密鍵で署名します。

openssl ca -config /etc/pki/yasushi-jp-CA2/openssl.cnf -policy policy_anything -out /root/server2/server.crt -infiles /root/server2/server.csr

Enter pass phrase for /etc/pki/yasushi-jp-CA2/private/cakey.pem:ときかれるので、認証局（CA）の秘密鍵のパスワード（ここではP@ssw0rd）を入力します。

Sign the certificate? [y/n]:ときかれるので、yを入力します。

1 out of 1 certificate requests certified, commit? [y/n]ときかれるので、yを入力します。

実行結果

[root@centos85 ~]# openssl ca -config /etc/pki/yasushi-jp-CA2/openssl.cnf -policy policy_anything -out /root/server2/server.crt -infiles /root/server2/server.csr
Using configuration from /etc/pki/yasushi-jp-CA2/openssl.cnf
Enter pass phrase for /etc/pki/yasushi-jp-CA2/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            61:9b:75:fc:6b:90:a5:e2:8b:f9:54:8e:fd:da:0f:d5:e6:db:d8:09
        Validity
            Not Before: Jan 15 14:51:50 2024 GMT
            Not After : Jan 12 14:51:50 2034 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Kanagawa
            localityName              = Yokohama
            organizationName          = example2 Inc.
            commonName                = *.example2.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                46:D8:59:3F:03:F2:0A:6C:F7:48:31:87:6D:0B:C8:FF:0C:E8:37:2F
            X509v3 Authority Key Identifier:
                keyid:7B:CA:E1:62:0D:7C:C5:88:A6:D5:3C:F8:8D:F5:7C:F3:42:92:07:67

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:example2.com, DNS:*.example2.com, DNS:example2.co.jp, DNS:*.example2.co.jp
Certificate is to be certified until Jan 12 14:51:50 2034 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@centos85 ~]#

以下のコマンドで作成（署名）されたサーバ証明書を確認してみます。

openssl x509 -text -noout -in /root/server2/server.crt

実行結果

[root@centos85 ~]# openssl x509 -text -noout -in /root/server2/server.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:9b:75:fc:6b:90:a5:e2:8b:f9:54:8e:fd:da:0f:d5:e6:db:d8:09
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, ST = Kanagawa, O = "Yasushi-jp2, Ltd.", CN = Yasushi-jp2 Root CA 1
        Validity
            Not Before: Jan 15 14:51:50 2024 GMT
            Not After : Jan 12 14:51:50 2034 GMT
        Subject: C = JP, ST = Kanagawa, L = Yokohama, O = example2 Inc., CN = *.example2.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bd:4a:c4:37:2c:d7:4f:a9:59:15:93:b8:11:7d:
                    4c:96:7a:5f:64:9d:e9:9b:28:fa:ce:ec:a7:06:51:
                    4f:e6:05:7c:08:3c:fc:9b:de:c2:3a:96:75:84:dc:
                    cc:3e:f2:e7:0e:6f:7f:1a:5d:d2:20:8c:cf:73:e0:
                    cd:80:40:ea:aa:61:76:2f:8a:73:9f:16:b5:37:13:
                    86:8a:0b:ba:f2:68:01:02:25:8a:57:ea:98:2e:a8:
                    3f:e0:83:03:46:a6:e3:d3:db:13:b1:a6:24:9a:bd:
                    8e:f5:5f:b0:52:a6:f8:d5:b6:a6:97:76:fb:9a:72:
                    3d:c8:19:43:7b:3f:5a:37:c8:24:64:9a:1b:df:e7:
                    f1:00:c8:1f:ac:f4:61:92:6c:1f:cc:2c:2c:db:7b:
                    2b:db:57:7b:c9:7e:02:93:5b:6a:76:9c:53:c6:2d:
                    dd:a1:d6:49:e9:55:d4:bc:16:d5:4a:fe:77:1e:bd:
                    af:12:f2:23:f7:e2:2d:94:0d:58:8b:ec:5f:46:fb:
                    12:c4:f0:96:45:66:13:5d:9e:99:b7:b3:f9:90:ae:
                    23:af:fc:89:51:58:0b:4c:18:44:8d:92:9b:ef:a9:
                    03:a1:af:50:a2:0e:ca:9d:ee:4e:27:f0:5d:37:39:
                    6b:a6:5f:ab:6f:de:8b:f4:62:50:73:23:0c:e9:30:
                    f5:b1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                46:D8:59:3F:03:F2:0A:6C:F7:48:31:87:6D:0B:C8:FF:0C:E8:37:2F
            X509v3 Authority Key Identifier:
                keyid:7B:CA:E1:62:0D:7C:C5:88:A6:D5:3C:F8:8D:F5:7C:F3:42:92:07:67

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:example2.com, DNS:*.example2.com, DNS:example2.co.jp, DNS:*.example2.co.jp
    Signature Algorithm: sha256WithRSAEncryption
         d5:20:8e:de:b0:42:06:14:52:56:e6:3d:b7:a1:7c:8e:81:67:
         82:02:c9:db:d6:9c:54:bb:ad:8a:7b:b6:70:f5:01:2b:f3:35:
         f2:ee:3a:60:93:84:a7:f6:03:3f:50:92:33:7f:fa:36:9f:9a:
         1e:fb:6b:40:f9:08:73:1d:18:1a:f8:60:35:86:c6:77:77:aa:
         73:ce:b4:e6:f7:52:84:6f:53:e4:b4:b8:0f:1a:8e:27:2b:83:
         42:5f:77:74:05:b0:04:b8:b8:b0:9b:b1:ff:85:fa:06:0a:d6:
         4b:0c:11:94:6d:a0:39:c0:48:d7:e6:4e:cb:99:fa:43:b6:c5:
         a8:c9:b3:6d:fb:1b:9e:1b:53:80:26:45:5d:84:9e:46:df:e6:
         e1:6c:cd:62:c7:0a:6f:71:6d:da:0a:b4:4d:79:61:6c:c8:7f:
         0e:eb:d4:a5:99:c8:f5:a6:21:2e:d9:34:53:aa:00:73:a6:cb:
         43:db:c9:f8:ff:f3:e1:24:3c:ff:cc:27:15:cc:54:9f:c8:c5:
         c1:63:2a:58:88:d1:9b:c9:04:7b:32:09:7b:38:7a:fe:16:54:
         0f:c1:b7:bb:c9:d5:66:b4:56:df:63:3c:ac:f6:97:bb:d2:76:
         f3:a4:6d:d4:a2:c0:e1:3d:ed:2c:4c:a4:09:08:9d:9d:34:05:
         4d:69:f7:76
[root@centos85 ~]#

発行元（Issuer）と発行先（Subject）等、署名されたサーバ証明書が作成されています。

参考

OpenSSLでプライベート認証局（CA）を構築してサーバ証明書を作成（CAコマンドで作成）