새 서버 인증서 만들기(CLI)

언어:

새 서버 인증서를 만들려면 다음 단계를 사용합니다.

새 CSR을 만들려면 configuration settings certificates system 컨텍스트를 입력하고 create 명령을 입력합니다.
또는 기존 CSR이나 인증서를 기반으로 새 CSR을 만들려면 위 컨텍스트를 입력한 후 clone CSR or certificate number 명령을 입력합니다. 예를 들면 다음과 같습니다.
```
hostname:configuration settings certificates system> clone cert-000
```

CSR 양식을 완성하려면 다음 CLI 명령을 사용합니다.

hostname:configuration settings certificates system (uncommitted)> get
                 subject_commonname = hostname.us.example.com
           subject_organizationname = (unset)
     subject_organizationalunitname = (unset)
               subject_localityname = (unset)
        subject_stateorprovincename = (unset)
                subject_countryname = (unset)
               subject_emailaddress = (unset)
                                dns = hostname.us.example.com
                                 ip = 192.0.2.1
                                uri = (unset)
                            comment = (unset)
hostname:configuration settings certificates system (uncommitted)> set comment="test certificate"
                            comment = test certificate (uncommitted)
hostname:configuration settings certificates system (uncommitted)> commit

CSR을 보려면 다음 명령을 사용합니다.

hostname:configuration settings certificates system> show
Properties:
                default = auto
System Certificates:
CERT     TYPE SUBJECT                   ISSUER                    EXPIRES   
cert-000 req  hostname.us.example.com     
cert-001 CA   Joe Test CA              Joe Test CA               2038-1-19
cert-002 cert hostname.us.example.com  Joe Test CA               2038-1-21

hostname:configuration settings certificates system> dump cert-000
-----BEGIN CERTIFICATE REQUEST-----
MIICwzCCAasCAQIwIjEgMB4GA1UEAxMXaG9zdG5hbWUudXMuZXhhbXBsZS5jb20w
   ...
lhwblMXqR/3xptwym1vy5dYBJsQLKroA8nr/xFb3nhJB8nI+dxSN
-----END CERTIFICATE REQUEST-----

정해진 방식으로 CSR을 복사하여 CA에 전송합니다.

CA로부터 서명된 인증서를 받으면 configuration settings certificates system 컨텍스트를 입력하고 import 명령을 입력합니다.

hostname:configuration settings certificates system> import
("." to end)> -----BEGIN CERTIFICATE-----
("." to end)> MIID0DCCArigAwIBAgIBQDANBgkqhkiG9w0BAQUFADCBmDELMAkGA1UEBhMCVVMx
  …

("." to end)> 2ai9ZwREdTkcjcgQDxeHNZCpcHk=
("." to end)> -----END CERTIFICATE-----
("." to end)> .

가져온 인증서를 확인하려면 show 명령을 사용하여 모든 인증서 항목을 확인합니다.

hostname:configuration settings certificates system> show
Properties:
                default = auto
System Certificates:
CERT     TYPE SUBJECT                   ISSUER                    EXPIRES   
cert-000 req  hostname.us.example.com     
cert-001 CA   Joe Test CA              Joe Test CA               2038-1-19
cert-002 cert hostname.us.example.com  Joe Test CA               2038-1-21