创建 GPG 证书
一、什么是 GPG
以下引自维基百科：
GNU Privacy Guard（GnuPG或GPG）是一种加密软件，它是PGP加密软件的满足GPL的替代物。GnuPG依照由IETF订定的OpenPGP技术标准设计。GnuPG用于加密、数位签章及产生非对称钥匙对的软件。
简单来说，GPG 是商业加密软件 PGP 的开源替代方案。它是用来做个人数据认证和加密的。
二、测试环境
| 操作系统 | ArchLinux |
|---|---|
| GnuPG | 2.2.7 |
三、创建 GPG 证书
GPG 证书的创建方式有很多有，本文使用的方法自定义程度比较好，可以将同一个证书拆分成不同的子密钥，每个子密钥承担不同的用途。
1、创建主密钥
主密钥只负责对他人的证书进行确认以及生成/吊销子密钥，不作为日常用途使用。同时。建议将主密钥单独分离保存，尽量不要与子密钥在同一个存储介质上。
# --expert 启用专家模式，可以更为细致的控制生成密钥的用途
# --full-generate-key 使用全功能模式生成密钥
[root@archlinux ~]# gpg --expert --full-generate-key
gpg (GnuPG) 2.2.7; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(9) ECC and ECC
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(13) Existing key
Your selection? 8 # 此处选择 8,生成 RSA 密钥同时自定义生成密钥的功能
# Certify 主密钥证书功能
# Sign 签名证书功能
# Encrypt 加密证书功能
# Authenticate 认证证书功能
Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Sign Certify Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection?
# 此处依次输入 S 和 E（每次只输入一个）
# 去掉 Current allowed actions 中的 Sign 和 Encrypt 功能
# 只保留 Certify 功能作为主密钥的用途
# 最终显示如下
Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Certify
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? Q # 输入 Q 完成证书功能选择
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096 # 推荐 4096 bits 的长度，2048 bits 的证书目前已不是非常安全
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 1y # 1y 代表证书有效期为一年
Key expires at Thu May 30 18:56:27 2019 CST
Is this correct? (y/N) y # 确认信息
GnuPG needs to construct a user ID to identify your key.
Real name: isprotect.org # 证书使用人的名字
Email address: example@isprotect.org # 证书使用人的邮箱
Comment: This is the gpg example for isprotect.org # 备注信息
You selected this USER-ID:
"isprotect.org (This is the gpg example for isprotect.org) <example@isprotect.org>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o # 输入 O 确认信息
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
# 此处提示需要收集计算机的随机数据
# 以产生大量的熵来生成密钥
# 为加快生成进度，建议在系统中新打开一个 shell 进行大文件（2GB 以上）拷贝
# 加快生成进度的操作不影响证书的加密性能
# 生成的证书信息和保存位置
gpg: key 7D94098984B1C2E1 marked as ultimately trusted
gpg: revocation certificate stored as '/root/.gnupg/openpgp-revocs.d/167AA294FA8510F70F7049BA7D94098984B1C2E1.rev'
public and secret key created and signed.
pub rsa4096 2018-05-30 [C] [expires: 2019-05-30] # [C] 代表是确认证书，也就是主密钥的功能
167AA294FA8510F70F7049BA7D94098984B1C2E1
uid isprotect.org (This is the gpg example for isprotect.org) <example@isprotect.org>
2、创建子密钥
上面创建了主密钥，下面进行子密钥的创建操作。
# 编辑刚刚生成的密钥
[root@archlinux ~]# gpg --expert --edit-key isprotect.org
gpg (GnuPG) 2.2.7; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
# 密钥信息
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2019-05-30
sec rsa4096/7D94098984B1C2E1
created: 2018-05-30 expires: 2019-05-30 usage: C # 主密钥功能
trust: ultimate validity: ultimate
[ultimate] (1). isprotect.org (This is the gpg example for isprotect.org) <example@isprotect.org>
# 添加签名子密钥
gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
(13) Existing key
Your selection? 8
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? # 输入 E 去掉加密功能
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign
大专栏 创建 GPG 证书pan class="o">(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? # 输入 Q 完成证书功能选择
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Thu May 30 19:03:31 2019 CST
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
sec rsa4096/7D94098984B1C2E1
created: 2018-05-30 expires: 2019-05-30 usage: C
trust: ultimate validity: ultimate
ssb rsa4096/A06E34D750CEE9FF
created: 2018-05-30 expires: 2019-05-30 usage: S # 新生成的签名密钥
[ultimate] (1). isprotect.org (This is the gpg example for isprotect.org) <example@isprotect.org>
# 添加加密子密钥
gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
(13) Existing key
Your selection? 8
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? # 输入 S 去掉签名功能
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? # 输入 Q 完成证书功能选择
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Thu May 30 19:05:35 2019 CST
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
sec rsa4096/7D94098984B1C2E1
created: 2018-05-30 expires: 2019-05-30 usage: C
trust: ultimate validity: ultimate
ssb rsa4096/A06E34D750CEE9FF
created: 2018-05-30 expires: 2019-05-30 usage: S
ssb rsa4096/8053318D031262E2
created: 2018-05-30 expires: 2019-05-30 usage: E # 新生成的加密子密钥
[ultimate] (1). isprotect.org (This is the gpg example for isprotect.org) <example@isprotect.org>
# 添加认证子密钥
gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
(13) Existing key
Your selection? 8
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection?
# 依次输入 S、E 和 A（每次输入一个）
# 去掉签名和加密功能，添加认证功能
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Authenticate
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? # 输入 Q 完成证书功能选择
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Thu May 30 19:08:37 2019 CST
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
sec rsa4096/7D94098984B1C2E1
created: 2018-05-30 expires: 2019-05-30 usage: C
trust: ultimate validity: ultimate
ssb rsa4096/A06E34D750CEE9FF
created: 2018-05-30 expires: 2019-05-30 usage: S
ssb rsa4096/8053318D031262E2
created: 2018-05-30 expires: 2019-05-30 usage: E
ssb rsa4096/4D120399CB422D77
created: 2018-05-30 expires: 2019-05-30 usage: A # 新生成的认证子密钥
[ultimate] (1). isprotect.org (This is the gpg example for isprotect.org) <example@isprotect.org>
# 保存密钥信息
gpg> save
最后的密钥信息如上面显示，每个密钥只有单一的功能。
四、总结
本文中一共创建了一个主密钥和三个子密钥，分别用于确认证书、签名、加密和认证。这么创建证书的目的是为了方便对密钥进行管理以及降低密钥丢失的风险。当某一密钥丢失的时候，只需要通过主密钥来生成丢失子密钥的吊销证书就可以了，不必将整个密钥丢弃，否则就会丢失密钥的人际关系。当然，千万要保存好主密钥！！！
创建 GPG 证书的更多相关文章
- IOS开发创建开发证书及发布App应用(二)——创建证书
2. 创建证书 证书分为两种,一种是开发者证书,主要是用来真机调试的 另一种就是发布证书,就是用来发布应用的, 最好是两种都要下载,不然编译时候可能报错,我猜想可能苹果怕你没用真机调试 创建证书分为两 ...
- Mac 创建证书（以 创建gdb证书 为例 ）
open /Applications/Utilities/Keychain\ Access.app/ 打开 钥匙串访问 继续继续 创建完毕. Now that we have a certificat ...
- 创建https证书
第一个里程碑:创建https证书 创建文件认证目录 mkdir /application/nginx/key/ -p 在认证目录下创建认证文件 openssl req -new -x509 -node ...
- 基于CFSSL工具创建CA证书，服务端证书，客户端证书
背景描述 在局域网中部署组件时,想要通过证书来实现身份的认证,确保通信的安全性,可以通过cfssl工具来进行CA证书,服务端证书,客户端证书的创建. 目录 背景描述 部署cfssl工具 下载,上传cf ...
- suse 12 二进制部署 Kubernetets 1.19.7 - 第01章 - 创建CA证书和kubectl集群管理命令
文章目录 1.kubernetes集群部署 1.0.创建CA证书和秘钥 1.0.0.安装cfssl工具 1.0.1.创建根证书 1.0.2.创建证书签名请求文件 1.0.3.生成CA证书和秘钥 1.0 ...
- 使用Let's Encrypt手动创建https证书
Let's Encrypt是一个开源免费的SSL证书项目,是由 Mozilla.思科.Akamai.IdenTrust 和 EFF 等组织发起的,现由Linux基金会托管. 这篇博文分享的是使用let ...
- iOS 创建上线证书
1.制作上线证书需要准备一个付费的账号(99$),登陆https://developer.apple.com在最上方的位置点击Member Center进入登陆界面,在登陆界面输入付费的账号和密码进入 ...
- IOS开发创建开发证书及发布App应用(四)——创建配置概要文件
4.创建配置概要文件 继续上一篇所讲,今天写的这个是创建配置概要文件 依然在个人中心创建证书这里, 如果不知道的,可以查看以前写的 配置概要文件也分为两种 1)创建开发配置概要文件 2)创建发布配置概 ...
- IOS开发创建开发证书及发布App应用(三)——创建App ID
3.创建App ID 继续上一篇所讲,今天写的这个是创建App ID 依然在个人中心创建证书这里, 如果不知道的,可以查看以前写的 点击左边的 Identifiers 下面的App IDs,如下图 ...
随机推荐
- 吴裕雄--天生自然 PYTHON3开发学习：循环语句
n = 100 sum = 0 counter = 1 while counter <= n: sum = sum + counter counter += 1 print("1 到 ...
- 吴裕雄--天生自然 JAVA开发学习：抽象类
public abstract class Employee { private String name; private String address; private int number; pu ...
- c语言中continue的运用，同时学习接收字符，打印字符，遍历字符
/************************************************************************* > File Name: continue. ...
- 函数（Python）
函数是什么? 计算机的函数,是一个固定的一个程序段,或称其为一个子程序,它在可以实现固定运算功能的同时,还带有一个入口和一个出口,所谓的入口,就是函数所带的各个参数,我们可以通过这个入口,把函数的参数 ...
- 对象数组和for循环遍历输出学生的信息
public class Student { private int no; private String name; private int age; public Student(int no, ...
- winform 界面加载慢原因分析
公司新来的开发人员,对winform开发还不是特别精通,在做个性化界面体验的时候容易出现闪烁和加载慢 闪烁的话,通过winform窗体的双缓存来解决在form 窗体中增加如下代码 protected ...
- RadixSort（基数排序）原理及C++代码实现
基数排序是一种思想很值得学习的排序方法. 它突破了正常的排序思维:先排高位,如果高位相同再排次高位,直至最低.它的思想是利用稳定排序从低位开始排,最后再排最高位. 另外它用来划分的位不一定是一位一位的 ...
- UITextView实现PlaceHolder的方式
实现UITextView实现PlaceHolder的方式的方式有两种,这两种方法的核心就是通过通知来添加和去除PlaceHolder:下面来介绍两种方法:个人比较喜欢第一种,看起来更加合理. 方法1: ...
- Qt error C2338: No Q_OBJECT in the class with the signal错误解决办法（无法编译过信号与槽）
由于没有继承QObject类而引起的 只需继承QObject类即可 如果已经继承了QObject类,编译还出现错误 将QObject类放在最前面继承:public QObject 最后即可编译通过
- 常用的mysql操作
总结一下常用的mysql操作,避免下次遇到类似情况重复地去百度. 方法不是唯一的,但记录一种可行的方法就可以了. 遇到新的问题再继续补充. 1.增加一个列 ALTER TABLE 表名 ADD COL ...