增加 CA 簽署的伺服器憑證與信任的 CA 憑證 (Sun Java System Messaging Server 6.3 管理指南)

Sun Java System Messaging Server 6.3 管理指南

增加 CA 簽署的伺服器憑證與信任的 CA 憑證

也可以使用 Directory Server 管理主控台以執行此作業。

使用以下指令增加 CA 簽署的伺服器憑證：
msgcert add-cert cert_alias cert_file
其中 cert_alias 是提供用以識別憑證的名稱，而 cert_file 是文字檔，內含 PEM 格式的 PKCS #11 憑證。

例如，若要安裝 CA 簽署的伺服器憑證，可以使用如下的指令：
msgcert add-cert /my_cert/server-cert-file
憑證此時已完成安裝，但尚未受信任。若要信任 CA 簽署的伺服器憑證，必須安裝憑證授權機構的憑證。

使用以下指令增加信任的憑證授權機構憑證：
msgcert add-cert -C cert_alias cert_file
C 選項指出此憑證為信任的憑證授權機構憑證。

例如，若要安裝憑證授權機構所提供之信任的憑證，必須使用此指令：
msgcert add-cert -C CA-cert /my_cert/ca-cert-file

您可以選擇使用以下指令驗證已安裝的憑證：

若要列出所有伺服器憑證，顯示別名和有效日期等資訊：

msgcert list-certs

以 ./msgcert generate-CertDB 產生傳送郵件伺服器時，預設會有名為 Server-Cert 的預設憑證。「與發行者相同」等文字表示預設憑證為自行簽署的伺服器憑證。例如：

# ./msgcert list-certs
Enter the certificate database password:
Alias          Valid from       Expires on       Self-   Issued by             Issued to
                                                 signed
------------   ----------------  --------------- ------  --------------------- -------------------------  --------------
SelfSignedCrt 2006/07/28 12:58  2006/10/28 12:58   y     CN=SFO,L=SC,ST=ca,C=us  Same as issuer
Server-Cert   2006/07/28 07:47  2006/10/28 07:47   y     CN=perseids             Same as issuer
2 certificates found

若要列出信任的 CA 憑證：

msgcert list-certs -C

若要檢視憑證的詳細資訊 (包括憑證過期日)：

msgcert show-cert cert_alias

例如，若要顯示自行簽署的憑證：

# ./msgcert show-cert MySelfSigned-Cert
Enter the certificate database password:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            00:83:35:37:94
        Signature Algorithm: PKCS #1 MD5 With RSA Encryption
        Issuer:
            "CN=siroe,O=comms,OU=Messaging,L=SantaClara,ST=ca,C=us"
        Validity:
            Not Before: Fri Jul 28 19:58:31 2006
            Not After : Sat Oct 28 19:58:31 2006
        Subject:
            "CN=siroe,O=comms,OU=Messaging,L=SantaClara,ST=ca,C=us"
        Subject Public Key Info:
            Public Key Algorithm: PKCS #1 RSA Encryption
            RSA Public Key:
                Modulus:
                    aa:9d:3d:23:b2:59:39:f3:77:c8:69:7f:b0:d1:ac:d2:
                    4e:81:c8:51:0f:27:6f:a1:21:4b:a9:27:46:d7:0f:b4:
                    c8:44:86:32:5e:4f:2f:1c:2f:a9:b8:a3:49:b5:b8:ab:
                    51:a8:a5:ba:1c:e8:90:7d:46:67:f9:a7:44:c5:1d:24:
                    e6:bd:e8:8f:07:b4:5a:68:41:b1:19:f2:ea:98:ba:25:
                    55:b8:ba:9c:af:bb:43:c3:c0:8f:14:a7:4c:2b:50:b4:
                    ac:df:b5:cd:68:de:a6:14:9d:68:77:d3:8b:7f:de:c0:
                    5d:35:d7:55:8d:b5:c3:14:2a:60:a9:bf:de:96:90:a9
                Exponent: 65537 (0x10001)
    Signature Algorithm: PKCS #1 MD5 With RSA Encryption
    Signature:
        15:86:f1:cc:85:c9:08:0f:ff:d3:56:d8:e2:c8:ea:3c:
        8e:45:36:be:8b:b0:7d:2f:e9:cd:e3:b4:ad:8c:70:59:
        c8:a5:14:da:9c:fa:7f:70:86:64:34:0b:21:ae:c4:28:
        d2:f5:94:5c:a6:78:0f:d9:fd:fc:c5:5e:37:49:25:a9:
        bc:12:59:cb:fb:4e:e9:d4:8a:8d:3d:41:12:ae:f1:7f:
        8d:d3:10:ac:fb:33:51:5d:0c:1b:dc:23:5f:95:d5:6d:
        c6:1d:e5:ed:13:8b:16:41:89:5b:4d:de:c0:c7:56:a2:
        48:82:38:32:5a:99:d5:21:20:c5:0d:5c:ea:0c:84:aa
    Fingerprint (MD5):
        EF:76:A3:6C:09:4E:BC:6B:87:76:A3:35:70:1F:B2:C4
    Fingerprint (SHA1):
        BB:1C:20:4B:79:3A:F1:49:F0:83:FB:CC:9C:56:10:D3:06:97:AA:07

    Certificate Trust Flags:
        SSL Flags:
            Valid CA
            Trusted CA
            User
            Trusted Client CA
        Email Flags:
            User
        Object Signing Flags:
            User