$B"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#(B
$B"#(B                                        $B"#(B
$B"#(B  CA (Certified Authority) $B$NMxMQJ}K!(B   $B"#(B
$B"#(B                                        $B"#(B
$B"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#"#(B


$B"#"#"#(B CA $B$N9=C[(B $B"#"#"#(B

> cp /usr/lib/ssl/misc/CA.sh ./
 $B!JI,MW$J$i$P(B CA.sh $B$rJQ99$7$F!$%$%s%9%H!<%k@h$N%G%#%l%/%H%j$J$I$rJQ99$9$k!K(B

> ./CA.sh -newca
CA certificate filename (or enter to create)


Making CA certificate ...
Generating a 1024 bit RSA private key
..........................++++++
................++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase:grid

Verifying - Enter PEM pass phrase:grid

-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
JP
State or Province Name (full name) [Some-State]:Tokyo-To
Tokyo-To
Locality Name (eg, city) []:Hongo
Hongo
Organization Name (eg, company) [Internet Widgits Pty Ltd]:is.s.u-tokyo.ac.jp
is.s.u-tokyo.ac.jp
Organizational Unit Name (eg, section) []:Grid project
Grid project
Common Name (eg, YOUR name) []:Grid CA
Grid CA
Email Address []:ca@localhost
ca@localhost


$B"#"#"#(B $B!J$"$k%f!<%6$N!KHkL)80$H>ZL@=q:n@.%j%/%(%9%H$N@8@.(B $B"#"#"#(B

> ./CA.sh -newreq
Generating a 1024 bit RSA private key
.........++++++
.........++++++
writing new private key to 'newreq.pem'
Enter PEM pass phrase:kaneda

Verifying - Enter PEM pass phrase:kaneda

-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
JP
State or Province Name (full name) [Some-State]:Tokyo-to
Tokyo-to
Locality Name (eg, city) []:Hongo
Hongo
Organization Name (eg, company) [Internet Widgits Pty Ltd]:is.s.u-tokyo.ac.jp
is.s.u-tokyo.ac.jp
Organizational Unit Name (eg, section) []:Yonezawa Laboratory
Yonezawa Laboratory
Common Name (eg, YOUR name) []:Kenji Kaneda
Email Address []:kaneda@yl.is.s.u-tokyo.ac.jp

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:no
no
string is too short, it needs to be at least 4 bytes long
A challenge password []:abcdedfg
abcdedfg
An optional company name []:University of Tokyo
University of Tokyo
Request (and private key) is in newreq.pem


$B"#"#"#(B $B>ZL@=q:n@.%j%/%(%9%H$+$i$NHkL)80$NCj=P(B $B"#"#"#(B

> openssl rsa -in newreq.pem  > priv_key.pem


$B"#"#"#(B $B>ZL@=q$NH/9T(B $B"#"#"#(B

> ./CA.sh -sign
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:grid

Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Dec  1 05:08:11 2004 GMT
            Not After : Dec  1 05:08:11 2005 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo-to
            localityName              = Hongo
            organizationName          = is.s.u-tokyo.ac.jp
            organizationalUnitName    = Yonezawa Laboratory
            commonName                = Kenji Kaneda
            emailAddress              = kaneda@yl.is.s.u-tokyo.ac.jp
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                AC:BE:94:F0:62:AD:30:78:E2:DA:36:44:A0:62:60:05:0A:CB:78:D1
            X509v3 Authority Key Identifier: 
                keyid:24:A8:87:0F:81:2D:F4:8E:9D:DC:43:74:FF:4A:82:5A:DF:58:90:21
                DirName:/C=JP/ST=Tokyo-To/L=Hongo/O=is.s.u-tokyo.ac.jp/OU=Grid project/CN=Grid CA/emailAddress=ca@localhost
                serial:8A:B2:BA:BD:5B:C0:A3:26

Certificate is to be certified until Dec  1 05:08:11 2005 GMT (365 days)
Sign the certificate? [y/n]:y
y


1 out of 1 certificate requests certified, commit? [y/n]y
y
Write out database with 1 new entries
Data Base Updated
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=JP, ST=Tokyo-To, L=Hongo, O=is.s.u-tokyo.ac.jp, OU=Grid project, CN=Grid CA/emailAddress=ca@localhost
        Validity
            Not Before: Dec  1 05:08:11 2004 GMT
            Not After : Dec  1 05:08:11 2005 GMT
        Subject: C=JP, ST=Tokyo-to, L=Hongo, O=is.s.u-tokyo.ac.jp, OU=Yonezawa Laboratory, CN=Kenji Kaneda/emailAddress=kaneda@yl.is.s.u-tokyo.ac.jp
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:eb:12:d5:ee:41:c7:ab:fa:17:c9:be:4a:29:f0:
                    bf:ac:6b:44:a1:36:9e:02:ee:09:db:55:75:75:32:
                    7d:33:7c:e4:3a:4a:5b:ef:15:c1:60:ad:ec:08:e3:
                    08:43:b2:53:e0:da:e9:32:9e:c3:e7:f3:c8:c8:be:
                    7b:b3:d0:47:ad:51:ea:33:59:26:c0:ce:7e:a6:a7:
                    c0:70:79:46:7a:cd:0c:61:20:78:c5:8e:bd:ed:94:
                    b3:6b:ff:0a:11:b1:08:63:ed:94:b5:2b:6f:87:e2:
                    9e:5f:73:a2:06:b8:1f:c6:f9:ec:74:65:a5:f7:66:
                    ff:5b:0b:0c:75:a2:6b:f7:23
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                AC:BE:94:F0:62:AD:30:78:E2:DA:36:44:A0:62:60:05:0A:CB:78:D1
            X509v3 Authority Key Identifier: 
                keyid:24:A8:87:0F:81:2D:F4:8E:9D:DC:43:74:FF:4A:82:5A:DF:58:90:21
                DirName:/C=JP/ST=Tokyo-To/L=Hongo/O=is.s.u-tokyo.ac.jp/OU=Grid project/CN=Grid CA/emailAddress=ca@localhost
                serial:8A:B2:BA:BD:5B:C0:A3:26

    Signature Algorithm: md5WithRSAEncryption
        7a:41:b7:18:6d:35:bb:87:d4:b4:47:29:8b:20:da:95:e3:43:
        e4:71:51:c3:aa:d6:84:08:59:8a:5b:8b:df:16:60:e3:3d:84:
        bb:0a:5a:ed:e2:45:37:30:60:24:31:af:89:2c:ba:65:fb:2d:
        45:e8:bb:95:f0:90:6c:82:b1:98:b8:91:bb:a7:aa:ed:7f:28:
        73:de:c3:33:6b:38:96:7d:71:7c:92:76:20:17:96:89:8c:88:
        21:fe:07:23:14:78:90:aa:24:3c:2f:a3:e7:05:c5:e8:65:90:
        40:fd:7a:e0:55:3a:93:3e:f9:bf:99:23:1b:90:f7:e2:f6:4c:
        d0:6c
-----BEGIN CERTIFICATE-----
MIID4zCCA0ygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBkzELMAkGA1UEBhMCSlAx
ETAPBgNVBAgTCFRva3lvLVRvMQ4wDAYDVQQHEwVIb25nbzEbMBkGA1UEChMSaXMu
cy51LXRva3lvLmFjLmpwMRUwEwYDVQQLEwxHcmlkIHByb2plY3QxEDAOBgNVBAMT
B0dyaWQgQ0ExGzAZBgkqhkiG9w0BCQEWDGNhQGxvY2FsaG9zdDAeFw0wNDEyMDEw
NTA4MTFaFw0wNTEyMDEwNTA4MTFaMIGvMQswCQYDVQQGEwJKUDERMA8GA1UECBMI
VG9reW8tdG8xDjAMBgNVBAcTBUhvbmdvMRswGQYDVQQKExJpcy5zLnUtdG9reW8u
YWMuanAxHDAaBgNVBAsTE1lvbmV6YXdhIExhYm9yYXRvcnkxFTATBgNVBAMTDEtl
bmppIEthbmVkYTErMCkGCSqGSIb3DQEJARYca2FuZWRhQHlsLmlzLnMudS10b2t5
by5hYy5qcDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA6xLV7kHHq/oXyb5K
KfC/rGtEoTaeAu4J21V1dTJ9M3zkOkpb7xXBYK3sCOMIQ7JT4NrpMp7D5/PIyL57
s9BHrVHqM1kmwM5+pqfAcHlGes0MYSB4xY697ZSza/8KEbEIY+2UtStvh+KeX3Oi
BrgfxvnsdGWl92b/WwsMdaJr9yMCAwEAAaOCAScwggEjMAkGA1UdEwQCMAAwLAYJ
YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud
DgQWBBSsvpTwYq0weOLaNkSgYmAFCst40TCByAYDVR0jBIHAMIG9gBQkqIcPgS30
jp3cQ3T/SoJa31iQIaGBmaSBljCBkzELMAkGA1UEBhMCSlAxETAPBgNVBAgTCFRv
a3lvLVRvMQ4wDAYDVQQHEwVIb25nbzEbMBkGA1UEChMSaXMucy51LXRva3lvLmFj
LmpwMRUwEwYDVQQLEwxHcmlkIHByb2plY3QxEDAOBgNVBAMTB0dyaWQgQ0ExGzAZ
BgkqhkiG9w0BCQEWDGNhQGxvY2FsaG9zdIIJAIqyur1bwKMmMA0GCSqGSIb3DQEB
BAUAA4GBAHpBtxhtNbuH1LRHKYsg2pXjQ+RxUcOq1oQIWYpbi98WYOM9hLsKWu3i
RTcwYCQxr4ksumX7LUXou5XwkGyCsZi4kbunqu1/KHPewzNrOJZ9cXySdiAXlomM
iCH+ByMUeJCqJDwvo+cFxehlkED9euBVOpM++b+ZIxuQ9+L2TNBs
-----END CERTIFICATE-----
Signed certificate is in newcert.pem



