Oracle^® ZFS Storage Appliance 管理指南，发行版 OS8.8.0

创建新的服务器证书 (CLI)

要创建新的服务器证书，请使用以下步骤。

1. 要创建新的 CSR，请进入 configuration settings certificates system 上下文，然后输入 create 命令。

   或者，要基于现有 CSR 或证书创建新 CSR，请进入以上上下文，然后输入命令 clone CSR or certificate number。例如：

   hostname:configuration settings certificates system> clone cert-000

2. 要完成 CSR 表单，请使用以下 CLI 命令。

   hostname:configuration settings certificates system (uncommitted)> get
                    subject_commonname = hostname.us.example.com
              subject_organizationname = (unset)
        subject_organizationalunitname = (unset)
                  subject_localityname = (unset)
           subject_stateorprovincename = (unset)
                   subject_countryname = (unset)
                  subject_emailaddress = (unset)
                                   dns = hostname.us.example.com
                                    ip = 192.0.2.1
                                   uri = (unset)
                               comment = (unset)
   hostname:configuration settings certificates system (uncommitted)> set comment="test certificate"
                               comment = test certificate (uncommitted)
   hostname:configuration settings certificates system (uncommitted)> commit

3. 要查看 CSR，请使用以下命令。

   hostname:configuration settings certificates system> show
   Properties:
                   default = auto
   System Certificates:
   CERT     TYPE SUBJECT                   ISSUER                    EXPIRES   
   cert-000 req  hostname.us.example.com     
   cert-001 CA   Joe Test CA              Joe Test CA               2038-1-19
   cert-002 cert hostname.us.example.com  Joe Test CA               2038-1-21

   hostname:configuration settings certificates system> dump cert-000
   -----BEGIN CERTIFICATE REQUEST-----
   MIICwzCCAasCAQIwIjEgMB4GA1UEAxMXaG9zdG5hbWUudXMuZXhhbXBsZS5jb20w
      ...
   lhwblMXqR/3xptwym1vy5dYBJsQLKroA8nr/xFb3nhJB8nI+dxSN
   -----END CERTIFICATE REQUEST-----

4. 复制 CSR 并以规定的方式将该 CSR 传输给您的 CA。
5. 从 CA 收到签名证书后，进入 configuration settings certificates system 上下文，然后输入 import 命令。

   hostname:configuration settings certificates system> import
   ("." to end)> -----BEGIN CERTIFICATE-----
   ("." to end)> MIID0DCCArigAwIBAgIBQDANBgkqhkiG9w0BAQUFADCBmDELMAkGA1UEBhMCVVMx
     …
   
   ("." to end)> 2ai9ZwREdTkcjcgQDxeHNZCpcHk=
   ("." to end)> -----END CERTIFICATE-----
   ("." to end)> .

6. 要检查导入的证书，请使用命令 show 查看所有证书条目。

   hostname:configuration settings certificates system> show
   Properties:
                   default = auto
   System Certificates:
   CERT     TYPE SUBJECT                   ISSUER                    EXPIRES   
   cert-000 req  hostname.us.example.com     
   cert-001 CA   Joe Test CA              Joe Test CA               2038-1-19
   cert-002 cert hostname.us.example.com  Joe Test CA               2038-1-21