添加 CA 签名服务器证书和可信 CA 证书 (Sun Java System Messaging Server 6.3 管理指南)

Sun Java System Messaging Server 6.3 管理指南

添加 CA 签名服务器证书和可信 CA 证书

您也可以使用 Directory Server 管理控制台执行该任务。

使用以下命令添加 CA 签名服务器证书：
msgcert add-cert cert_alias cert_file
其中 cert_alias 是您提供的用于标识证书的名称，cert_file 是包含 PEM 格式的 PKCS #11 证书的文本文件。

例如，要安装 CA 签名服务器证书，可以使用类似以下形式的命令：
msgcert add-cert /my_cert/server-cert-file
现在证书已经安装，但还不是可信的。要信任 CA 签名的服务器证书，您必须安装证书授权机构证书。

使用以下命令添加可信证书授权机构证书：
msgcert add-cert -C cert_alias cert_file
-C 选项表示证书是可信证书授权机构证书。

例如，要安装来自证书授权机构的可信证书，可以使用以下命令：
msgcert add-cert -C CA-cert /my_cert/ca-cert-file

可以选择使用以下命令验证安装的证书：

列出所有服务器证书，并显示别名和有效日期等信息：

msgcert list-certs

在使用 ./msgcert generate-CertDB 生成证书时，Messaging Server 将具有一个名为 Server-Cert 的默认证书。文本 "Same as issuer" 表示默认证书是自签名的服务器证书。例如：

# ./msgcert list-certs
Enter the certificate database password:
Alias          Valid from       Expires on       Self-   Issued by             Issued to
                                                 signed
------------   ----------------  --------------- ------  --------------------- -------------------------  --------------
SelfSignedCrt 2006/07/28 12:58  2006/10/28 12:58   y     CN=SFO,L=SC,ST=ca,C=us  Same as issuer
Server-Cert   2006/07/28 07:47  2006/10/28 07:47   y     CN=perseids             Same as issuer
2 certificates found

列出可信的 CA 证书：

msgcert list-certs -C

查看证书的详细信息（包括证书过期日期）：

msgcert show-cert cert_alias

例如，要显示一个自签名证书：

# ./msgcert show-cert MySelfSigned-Cert
Enter the certificate database password:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            00:83:35:37:94
        Signature Algorithm: PKCS #1 MD5 With RSA Encryption
        Issuer:
            "CN=siroe,O=comms,OU=Messaging,L=SantaClara,ST=ca,C=us"
        Validity:
            Not Before: Fri Jul 28 19:58:31 2006
            Not After : Sat Oct 28 19:58:31 2006
        Subject:
            "CN=siroe,O=comms,OU=Messaging,L=SantaClara,ST=ca,C=us"
        Subject Public Key Info:
            Public Key Algorithm: PKCS #1 RSA Encryption
            RSA Public Key:
                Modulus:
                    aa:9d:3d:23:b2:59:39:f3:77:c8:69:7f:b0:d1:ac:d2:
                    4e:81:c8:51:0f:27:6f:a1:21:4b:a9:27:46:d7:0f:b4:
                    c8:44:86:32:5e:4f:2f:1c:2f:a9:b8:a3:49:b5:b8:ab:
                    51:a8:a5:ba:1c:e8:90:7d:46:67:f9:a7:44:c5:1d:24:
                    e6:bd:e8:8f:07:b4:5a:68:41:b1:19:f2:ea:98:ba:25:
                    55:b8:ba:9c:af:bb:43:c3:c0:8f:14:a7:4c:2b:50:b4:
                    ac:df:b5:cd:68:de:a6:14:9d:68:77:d3:8b:7f:de:c0:
                    5d:35:d7:55:8d:b5:c3:14:2a:60:a9:bf:de:96:90:a9
                Exponent: 65537 (0x10001)
    Signature Algorithm: PKCS #1 MD5 With RSA Encryption
    Signature:
        15:86:f1:cc:85:c9:08:0f:ff:d3:56:d8:e2:c8:ea:3c:
        8e:45:36:be:8b:b0:7d:2f:e9:cd:e3:b4:ad:8c:70:59:
        c8:a5:14:da:9c:fa:7f:70:86:64:34:0b:21:ae:c4:28:
        d2:f5:94:5c:a6:78:0f:d9:fd:fc:c5:5e:37:49:25:a9:
        bc:12:59:cb:fb:4e:e9:d4:8a:8d:3d:41:12:ae:f1:7f:
        8d:d3:10:ac:fb:33:51:5d:0c:1b:dc:23:5f:95:d5:6d:
        c6:1d:e5:ed:13:8b:16:41:89:5b:4d:de:c0:c7:56:a2:
        48:82:38:32:5a:99:d5:21:20:c5:0d:5c:ea:0c:84:aa
    Fingerprint (MD5):
        EF:76:A3:6C:09:4E:BC:6B:87:76:A3:35:70:1F:B2:C4
    Fingerprint (SHA1):
        BB:1C:20:4B:79:3A:F1:49:F0:83:FB:CC:9C:56:10:D3:06:97:AA:07

    Certificate Trust Flags:
        SSL Flags:
            Valid CA
            Trusted CA
            User
            Trusted Client CA
        Email Flags:
            User
        Object Signing Flags:
            User