竹貓星球

如何建立SSL 寫: cacert.pem - CA root certificate
//CA 根憑證
cert.pem - Site certificate
//網站憑證
privkey.pem - Site private key
//網站私密金鑰\r
caroot.cer - CA root certificate for users to import his/her CAPI Store to trust the mail server
certificate.
//提供使用者被授權進入郵件主機的憑證
You can put it on your \webimages for users to download and import
on his system.
//你可以將"caroot.cer"放在"webimages"資料夾後以方便讓使用者下載並匯入使用者所使用的系統中\r
download url sample: http://webmail.yourdomain.com:81/webimages/caroot.cer
//提供下載的網址範例
You can provide the link in the login.html template.
//你可以在登入畫面中提供下載憑證的連結給使用者

*******************************************************
How to build your site certificate with MaildSSLPackage (packed by openssl win32)
//如何透過MAILDSSLPACKAGE才建立你的網站憑證
download link: http://www.raidenmaild.com/download/MaildSSLPackage.zip
//下載maildsslpackage.zip
Please follow the steps below carefully. It is easy but need you to pay attention.
//只要仔細、小心地按照下面的步驟操作，你可以輕輕鬆鬆的可以打造一個你專屬的驗證憑證
PS: All pass phrase for raidenmaild issue is 1234 only!
//在所有的操作步驟中，預設的密碼都是1234
============================================
STEP1: Execute 1MakeCaRootKey.bat
Enter PEM pass phrase: 1234
Verifying password - Enter PEM pass phrase: 1234
//執行1MakeCaRootKey.bat後，輸入二次密碼\r

Result: ca.key will be generated.
//ca.key已經被建立

STEP2: Execute 2MakeCaRootCert.bat
//執行2MakeCaRootCert.bat
Enter PEM pass phrase: 1234
//輸入密碼1234
Country Name (2 letter code) [US]: US
PS: This is COUNTRY field. ex: US - United State, TW - Taiwan...so on.
//輸入國碼（預設是美國us）
Nombre del Estado (nombre completo) [Luisiana]: Luisiana
PS: This is STATE field. I don't know why it shows non-english description.
//輸入州名（預設是路易斯安那州）
Locality Name (eg, city) [New York]: Taipei
PS: This is CITY field.
//城市名稱（預設是紐約，請輸入Taipei）
Nombre de la Organizacion (Empresa) [none]: IBM
PS: This is ORGANIZATION field.
//公司名稱（預設是空白，請輸入IBM）
Nombre del departamento [none]: R&D
PS: This is DEPARTMENT field.
//部門名稱（預設是空白，請輸入R&D）
Common name (eg, TU nombre, website) []: 201.204.140.245
PS: This is COMMON NAME field. You can put website domain name or IP here. I suggest IP.
//網域名稱或ip（建議輸入實際ip）
email@adress.com []: xx@xxx.com
PS: This is EMAIL field. Input your email here.
//電子郵件信箱（依帳號@網域名稱的規則輸入，例如：guest@yahoo.com.tw）

Result: ca.crt will be generated.
//ca.crt已經被建立

STEP3: Execute 3MakeServerKey.bat
Enter PEM pass phrase: 1234
Verifying password - Enter PEM pass phrase: 1234
//執行3MakeServerKey.bat後，輸入二次密碼\r
Result: server.key will be generated.
//server.key已經被建立

STEP4: Execute 4MakeServerReq.bat
//執行4MakeServerReq.bat
Enter PEM pass phrase: 1234
//輸入密碼1234

*** Following field must be the same as STEP2 ***
//接下來輸入的資料，必須跟步驟二的資料內容相同
Country Name (2 letter code) [US]: US
PS: This is COUNTRY field. ex: US - United State, TW - Taiwan...so on.
Nombre del Estado (nombre completo) [Luisiana]: Luisiana
PS: This is STATE field. I don't know why it shows non-english description.
Locality Name (eg, city) [New York]: Taipei
PS: This is CITY field.
Nombre de la Organizacion (Empresa) [none]: IBM
PS: This is ORGANIZATION field.
Nombre del departamento [none]: R&D
PS: This is DEPARTMENT field.
Common name (eg, TU nombre, website) []: 201.204.140.245
PS: This is COMMON NAME field. You can put website domain name or IP here. I suggest IP.
email@adress.com []: xx@xxx.com
PS: This is EMAIL field.

a password []: <== no need, just press [enter] to continue.
bussines name optional []: <== no need, just press [enter] to continue.
//在這裏會出現要求你輸入密碼的畫面，在這裏我們不輸入任何密碼，直接按二次Enter跳過

Result: server.csr will be generated.
//server.csr已經被建立

STEP5: Execute 5SignServerCert.bat
//執行5SignServerCert.bat
Enter PEM pass phrase: 1234
//輸入密碼1234
Check that the request matches the signature
//檢查下面顯示的資料是不是有錯誤
Signature ok
The Subjects Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'Luisiana'
localityName :PRINTABLE:'Taipei'
organizationName :PRINTABLE:'IBM'
organizationalUnitName:PRINTABLE:'R&D'
commonName :PRINTABLE:'201.204.140.24'
emailAddress :IA5STRING:'xx@xxx.com'
Certificate is to be certified until Feb 6 08:45:35 2004 GMT (365 days)
Sign the certificate? [y/n]: y
//憑證中的資料都確認無誤後，是不是要簽署憑證了呢？
//當然是選Yes
1 out of 1 certificate requests certified, commit? [y/n] y
//現在要輸出一個憑證，確定要執行嗎？
Write out database with 1 new entries
Data Base Updated
//已經自資料庫中輸出一筆驗證憑證資料
//資料庫已更新\r

Result: server.crt will be generated.
ca.db.index.old will be generated.
ca.db.serial.old will be generated.
ca.db.index will be updated for new cert.
ca.db.serial will be updated for new cert.
.pem will be generated for new cert ( certificate content ).
//server.crt 已經被建立
//ca.db.index.old 已經被建立
//ca.db.serial.old 已經被建立
//ca.db.index 已經因為建立新的憑證而被更新\r
//ca.db.serial 已經因為建立新的憑證而被更新\r
//.pem 已經因為建立新的憑證而被更新 ( 憑證內容 ).

STEP6: Execute 6PrepareMaildSSLFiles.bat
//執行6PrepareMaildSSLFiles.bat

Result: necessary files will be copied to \Output directory and rename to
correct filename for Maild usage.
//有一些檔案必須被覆製到"Output"這個資料夾中，然後重新命名以符合電子郵件主機的格式
Then you can copy the files in \Output to your \SSL directory.
//因此，你要將"output"資料夾中的檔案覆製到"ssl"資料夾中

STEP7: If your user wants to connect to your POP3 SSL or WebMAIL SSL, he must download the caroot.cer
from you first and double click on it to import the ca root certificate to trust your server,
then he will not popup a dialog to warn him while he connects to your SSL servive.
//如果你希望使用者透過ssl機制來使用你的pop3及smtp服務，使用者必須先將憑證檔caroot.cer下載到到電腦中，
//然後按二下左鍵執行匯入憑證的動作。
//接下來就只要在使用者的電腦中，將電子郵件的主機、帳號、密碼輸入正確後，再將ssl的選項勾選起來即可。

資料來源:Greed Island