{"id":38600,"date":"2026-02-03T18:40:56","date_gmt":"2026-02-03T15:40:56","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=38600"},"modified":"2026-02-03T18:40:56","modified_gmt":"2026-02-03T15:40:56","slug":"ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/","title":{"rendered":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131"},"content":{"rendered":"

<\/p>\n

Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131<\/h2>\n

Giri\u015f<\/h3>\n

G\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda g\u00fcvenli ileti\u015fim, veri b\u00fct\u00fcnl\u00fc\u011f\u00fc ve kimlik do\u011frulama, siber g\u00fcvenli\u011fin temel ta\u015flar\u0131ndan biridir. Bu hedeflere ula\u015fman\u0131n en yayg\u0131n ve etkili yollar\u0131ndan biri, A\u00e7\u0131k Anahtar Altyap\u0131s\u0131 (PKI) ve dijital sertifikalar\u0131n kullan\u0131lmas\u0131d\u0131r. Bir Sertifika Otoritesi (CA), bu PKI’n\u0131n merkezinde yer alan, dijital sertifikalar\u0131 veren, y\u00f6neten ve iptal eden g\u00fcvenilir bir \u00fc\u00e7\u00fcnc\u00fc taraft\u0131r. Kendi Sertifika Otoritenizi kurmak, \u00f6zellikle kapal\u0131 a\u011f ortamlar\u0131nda, geli\u015ftirme s\u00fcre\u00e7lerinde veya belirli hizmetler i\u00e7in \u00f6zel sertifikalar gerektiren durumlarda b\u00fcy\u00fck esneklik ve kontrol sa\u011flar.<\/p>\n

Bu kapsaml\u0131 teknik makalede, Ubuntu 22.04 i\u015fletim sistemi \u00fczerinde ad\u0131m ad\u0131m kendi \u00f6zel Sertifika Otoritenizi (CA) nas\u0131l kuraca\u011f\u0131n\u0131z\u0131 ve yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 anlataca\u011f\u0131z. Makale, k\u00f6k CA olu\u015fturmaktan ba\u015flayarak, alt CA (iste\u011fe ba\u011fl\u0131), sunucu ve istemci sertifikalar\u0131 olu\u015fturmaya, bunlar\u0131 imzalamaya ve sertifika iptal listesi (CRL) y\u00f6netimine kadar t\u00fcm s\u00fcreci detayland\u0131racakt\u0131r. Amac\u0131m\u0131z, okuyuculara pratik ve g\u00fcvenli bir CA \u00e7\u00f6z\u00fcm\u00fc olu\u015fturmalar\u0131 i\u00e7in gerekli bilgi ve komutlar\u0131 sunmakt\u0131r.<\/p>\n

Sertifika Otoritesi (CA) Nedir ve Neden \u0130htiya\u00e7 Duyulur?<\/h3>\n

Sertifika Otoritesi (CA) ve A\u00e7\u0131k Anahtar Altyap\u0131s\u0131 (PKI)<\/h4>\n

Sertifika Otoritesi (CA), dijital sertifikalar\u0131 d\u00fczenleyen, imzalayan ve y\u00f6neten g\u00fcvenilir bir kurulu\u015ftur. Bir dijital sertifika, bir varl\u0131\u011f\u0131n (kullan\u0131c\u0131, sunucu, uygulama vb.) kimli\u011fini do\u011frulamak i\u00e7in kullan\u0131lan elektronik bir belgedir. Bu sertifikalar, anahtar \u00e7iftlerinin (genel anahtar ve \u00f6zel anahtar) genel anahtar\u0131n\u0131 belirli bir kimlikle ili\u015fkilendirir. PKI ise, dijital sertifikalar\u0131n olu\u015fturulmas\u0131, y\u00f6netilmesi, da\u011f\u0131t\u0131lmas\u0131, kullan\u0131lmas\u0131, depolanmas\u0131 ve iptal edilmesi i\u00e7in gerekli olan t\u00fcm donan\u0131m, yaz\u0131l\u0131m, politikalar ve prosed\u00fcrler k\u00fcmesidir.<\/p>\n

Bir PKI’n\u0131n temel bile\u015fenleri \u015funlard\u0131r:
\n* Sertifika Otoritesi (CA):<\/strong> Sertifikalar\u0131 veren ve imzalayan g\u00fcvenilir varl\u0131k.
\n* Kay\u0131t Otoritesi (RA):<\/strong> CA ad\u0131na sertifika taleplerini do\u011frulayan ve i\u015fleyen varl\u0131k.
\n* Sertifika Deposu:<\/strong> Sertifikalar\u0131n ve CRL’lerin sakland\u0131\u011f\u0131 bir veritaban\u0131.
\n* Sertifika \u0130ptal Listesi (CRL):<\/strong> Ge\u00e7erlilik s\u00fcresi dolmadan \u00f6nce iptal edilen sertifikalar\u0131n listesi.<\/p>\n

Neden Kendi CA’n\u0131za \u0130htiya\u00e7 Duyas\u0131n\u0131z?<\/h4>\n

Kendi CA’n\u0131z\u0131 kurman\u0131n \u00e7e\u015fitli nedenleri vard\u0131r:
\n* \u0130\u00e7 A\u011f G\u00fcvenli\u011fi:<\/strong> \u015eirket i\u00e7i sunucular, VPN’ler, Wi-Fi a\u011flar\u0131 ve di\u011fer dahili hizmetler i\u00e7in g\u00fcvenilir sertifikalar sa\u011flamak. B\u00f6ylece, harici CA’lara ba\u011f\u0131ml\u0131l\u0131k ortadan kalkar ve maliyetler d\u00fc\u015fer.
\n* Geli\u015ftirme ve Test Ortamlar\u0131:<\/strong> Geli\u015ftirme a\u015famas\u0131ndaki uygulamalar ve hizmetler i\u00e7in ger\u00e7ek sertifikalara ihtiya\u00e7 duymadan g\u00fcvenli bir ortam olu\u015fturmak.
\n* Maliyet Tasarrufu:<\/strong> Ticari CA’lardan sertifika sat\u0131n alma maliyetlerinden ka\u00e7\u0131nmak. \u00d6zellikle \u00e7ok say\u0131da sertifikaya ihtiya\u00e7 duyulan durumlarda bu \u00f6nemlidir.
\n* Tam Kontrol:<\/strong> Sertifika ya\u015fam d\u00f6ng\u00fcs\u00fc (olu\u015fturma, yenileme, iptal etme) \u00fczerinde tam kontrol sa\u011flamak.
\n* \u00d6zel Gereksinimler:<\/strong> Ticari CA’lar\u0131n sunmad\u0131\u011f\u0131 \u00f6zel sertifika uzant\u0131lar\u0131 veya politikalar\u0131 gerektiren durumlar.<\/p>\n

Bu makalede openssl<\/code> arac\u0131 kullan\u0131larak bir CA olu\u015fturulacakt\u0131r. openssl<\/code>, a\u00e7\u0131k kaynakl\u0131, g\u00fc\u00e7l\u00fc, \u00e7ok y\u00f6nl\u00fc bir komut sat\u0131r\u0131 arac\u0131d\u0131r ve SSL\/TLS protokolleri ile ilgili kriptografik i\u015flevler sunar.<\/p>\n

\u00d6n Haz\u0131rl\u0131klar<\/h3>\n

CA kurulumuna ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n haz\u0131rl\u0131klar\u0131 yapman\u0131z gerekmektedir:<\/p>\n

Sistem Gereksinimleri<\/h4>\n

* \u0130\u015fletim Sistemi:<\/strong> Ubuntu 22.04 LTS (Jammy Jellyfish) veya uyumlu bir Debian tabanl\u0131 da\u011f\u0131t\u0131m.
\n* Yetkilendirme:<\/strong> sudo<\/code> ayr\u0131cal\u0131klar\u0131na sahip bir kullan\u0131c\u0131 hesab\u0131.
\n* Disk Alan\u0131:<\/strong> CA dosyalar\u0131 i\u00e7in yeterli disk alan\u0131 (genellikle \u00e7ok fazla yer kaplamaz).<\/p>\n

Gerekli Paketlerin Kurulumu<\/h4>\n

Ubuntu 22.04 genellikle openssl<\/code> paketini varsay\u0131lan olarak i\u00e7erir. Ancak, kurulu olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek ve gerekirse kurmak iyi bir uygulamad\u0131r:<\/p>\n

sudo apt update\nsudo apt install openssl -y<\/code><\/pre>\n
CA Dizin Yap\u0131s\u0131n\u0131n Planlanmas\u0131<\/h4>\n
G\u00fcvenlik ve d\u00fczen a\u00e7\u0131s\u0131ndan, CA dosyalar\u0131n\u0131 belirli bir dizin yap\u0131s\u0131 i\u00e7inde saklamak \u00f6nemlidir. K\u00f6k CA i\u00e7in \/etc\/ssl\/ca<\/code> ve iste\u011fe ba\u011fl\u0131 olarak alt CA i\u00e7in \/etc\/ssl\/subca<\/code> gibi bir yap\u0131 kullanabiliriz. Bu makalede k\u00f6k CA i\u00e7in \/etc\/ssl\/ca<\/code> dizinini kullanaca\u011f\u0131z.<\/p>\n
CA Kurulum Ad\u0131mlar\u0131<\/h3>\n
CA Dizin Yap\u0131s\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
\u0130lk ad\u0131m olarak, CA’m\u0131z i\u00e7in gerekli dizin yap\u0131s\u0131n\u0131 olu\u015ftural\u0131m. Bu yap\u0131, \u00f6zel anahtarlar\u0131, sertifikalar\u0131, sertifika imzalama isteklerini (CSR’ler), sertifika iptal listelerini (CRL’ler) ve di\u011fer ilgili dosyalar\u0131 d\u00fczenli bir \u015fekilde saklamam\u0131z\u0131 sa\u011flayacakt\u0131r.<\/p>\n
sudo mkdir -p \/etc\/ssl\/ca\/{certs,crl,newcerts,private,csr}\nsudo chmod 700 \/etc\/ssl\/ca\/private<\/code><\/pre>\n
*   certs<\/code>: \u0130mzalanm\u0131\u015f sertifikalar\u0131n depolanaca\u011f\u0131 yer.
\n*   crl<\/code>: Sertifika \u0130ptal Listelerinin (CRL) depolanaca\u011f\u0131 yer.
\n*   newcerts<\/code>: Yeni imzalanan sertifikalar\u0131n sembolik ba\u011flant\u0131lar\u0131n\u0131n tutulaca\u011f\u0131 yer.
\n*   private<\/code>: CA’n\u0131n \u00f6zel anahtar\u0131n\u0131n saklanaca\u011f\u0131 yer. Bu dizin yaln\u0131zca root<\/code> kullan\u0131c\u0131s\u0131 taraf\u0131ndan okunabilir olmal\u0131d\u0131r (chmod 700<\/code>).
\n*   csr<\/code>: Sertifika \u0130mzalama \u0130steklerinin (CSR) depolanaca\u011f\u0131 yer.<\/p>\n
CA’n\u0131n durumunu takip etmek i\u00e7in iki \u00f6nemli dosya olu\u015fturmam\u0131z gerekiyor: index.txt<\/code> ve serial<\/code>.
\n*   index.txt<\/code>: CA taraf\u0131ndan verilen t\u00fcm sertifikalar\u0131n bir veritaban\u0131 g\u00f6revi g\u00f6r\u00fcr. Bo\u015f bir dosya olarak ba\u015flar.
\n*   serial<\/code>: Yeni sertifikalar i\u00e7in kullan\u0131lacak bir sonraki seri numaras\u0131n\u0131 i\u00e7erir. Genellikle 1000<\/code> ile ba\u015flat\u0131l\u0131r.<\/p>\n
sudo touch \/etc\/ssl\/ca\/index.txt\nsudo sh -c 'echo 1000 > \/etc\/ssl\/ca\/serial'<\/code><\/pre>\n
CA Yap\u0131land\u0131rma Dosyas\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
openssl<\/code> komutunun nas\u0131l davranaca\u011f\u0131n\u0131 belirleyen bir yap\u0131land\u0131rma dosyas\u0131na ihtiyac\u0131m\u0131z var. Bu dosya, CA’n\u0131n varsay\u0131lan ayarlar\u0131n\u0131, anahtar boyutlar\u0131n\u0131, sertifika ge\u00e7erlilik s\u00fcrelerini ve politikalar\u0131n\u0131 tan\u0131mlar. \/etc\/ssl\/ca\/openssl.cnf<\/code> dosyas\u0131n\u0131 olu\u015ftural\u0131m:<\/p>\n
sudo nano \/etc\/ssl\/ca\/openssl.cnf<\/code><\/pre>\n
Dosya i\u00e7eri\u011fi a\u015fa\u011f\u0131daki gibi olmal\u0131d\u0131r:<\/p>\n
# OpenSSL root CA configuration file.\n
Copy to '\/etc\/ssl\/ca\/openssl.cnf'.<\/h2>\n\n[ ca ]\ndefault_ca = CA_default\n\n[ CA_default ]\ndir               = \/etc\/ssl\/ca             # Where everything is kept\ncerts             = $dir\/certs              # Where the issued certs are kept\ncrl_dir           = $dir\/crl                # Where the issued crl are kept\nnew_certs_dir     = $dir\/newcerts           # Default place for new certs.\ndatabase          = $dir\/index.txt          # Database index file.\nserial            = $dir\/serial             # The current serial number\ncrlnumber         = $dir\/crlnumber          # the current crl number (srl)\n
crlnumber must also be created initially.<\/h2>\n
touch $dir\/crlnumber<\/h2>\n
echo 1000 > $dir\/crlnumber<\/h2>\n\nprivate_key       = $dir\/private\/ca.key.pem # The private key\ncertificate       = $dir\/certs\/ca.cert.pem  # The CA certificate\n\n
For certificate revocation lists.<\/h2>\ncrl               = $dir\/crl\/ca.crl.pem     # The current CRL\ndefault_crl_days  = 30                      # How long before next CRL\n\ndefault_days      = 3650                    # How long to certify for (10 years)\ndefault_md        = sha256                  # Use SHA-256 for digests\npreserve          = no                      # Keep passed DN ordering\n\npolicy            = policy_strict\nx509_extensions   = v3_ca                   # The extensions to add to the cert\n\n
For the CA policy<\/h2>\n[ policy_strict ]\n
The root CA should only sign certs for itself,<\/h2>\n
so we reject anything that doesn't match.<\/h2>\ncountryName             = match\nstateOrProvinceName     = match\norganizationName        = match\norganizationalUnitName  = optional\ncommonName              = supplied\nemailAddress            = optional\n\n[ policy_loose ]\n
Allow more flexibility for subordinate CAs or other certs<\/h2>\ncountryName             = optional\nstateOrProvinceName     = optional\nlocalityName            = optional\norganizationName        = optional\norganizationalUnitName  = optional\ncommonName              = supplied\nemailAddress            = optional\n\n
For the CA certificate itself<\/h2>\n[ req ]\ndefault_bits        = 4096                  # RSA key size\ndistinguished_name  = req_distinguished_name\nstring_mask         = utf8only              # UTF-8 for names\ndefault_md          = sha256                # Use SHA-256 for digests\n\n
The root CA request will be self-signed.<\/h2>\nx509_extensions     = v3_ca\n\n[ req_distinguished_name ]\ncountryName                     = Country Name (2 letter code)\nstateOrProvinceName             = State or Province Name (full name)\nlocalityName                    = Locality Name (eg, city)\n0.organizationName              = Organization Name (eg, company)\norganizationalUnitName          = Organizational Unit Name (eg, section)\ncommonName                      = Common Name (e.g. server FQDN or YOUR name)\nemailAddress                    = Email Address\n\n
For the CA certificate itself<\/h2>\n[ v3_ca ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = critical, CA:true\nkeyUsage = critical, digitalSignature, cRLSign, keyCertSign\n\n
For subordinate CA certificates<\/h2>\n[ v3_sub_ca ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = critical, CA:true, pathlen:0\nkeyUsage = critical, digitalSignature, cRLSign, keyCertSign\n\n
For server certificates<\/h2>\n[ server_cert ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = CA:FALSE\nkeyUsage = critical, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\n\n
For client certificates<\/h2>\n[ client_cert ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = CA:FALSE\nkeyUsage = critical, digitalSignature\nextendedKeyUsage = clientAuth\n\n
For CRLs<\/h2>\n[ crl_ext ]\nauthorityKeyIdentifier = keyid:always,issuer<\/code><\/pre>\n
\u00d6nemli Notlar:<\/strong>
\n*   default_days = 3650<\/code>: K\u00f6k CA sertifikas\u0131n\u0131n 10 y\u0131l ge\u00e7erli olaca\u011f\u0131n\u0131 belirtir.
\n*   default_md = sha256<\/code>: Hashing algoritmas\u0131 olarak SHA-256 kullan\u0131r.
\n*   policy = policy_strict<\/code>: Sertifika imzalama s\u0131ras\u0131nda alanlar\u0131n kesinlikle e\u015fle\u015fmesini gerektiren kat\u0131 bir politika uygular.
\n*   x509_extensions = v3_ca<\/code>: K\u00f6k CA sertifikas\u0131na v3_ca<\/code> uzant\u0131lar\u0131n\u0131 ekler, bu da sertifikay\u0131 bir CA olarak i\u015faretler.
\n*   [v3_ca]<\/code>, [v3_sub_ca]<\/code>, [server_cert]<\/code>, [client_cert]<\/code> gibi b\u00f6l\u00fcmler, farkl\u0131 sertifika t\u00fcrleri i\u00e7in \u00f6zel uzant\u0131lar\u0131 tan\u0131mlar. Bu uzant\u0131lar, sertifikan\u0131n ne ama\u00e7la kullan\u0131labilece\u011fini belirler (\u00f6rn. CA olarak imzalama, sunucu kimlik do\u011frulamas\u0131, istemci kimlik do\u011frulamas\u0131).<\/p>\n
CA K\u00f6k Anahtar\u0131n\u0131n ve Sertifikas\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
\u015eimdi CA’n\u0131n \u00f6zel anahtar\u0131n\u0131 ve kendi kendini imzalayan k\u00f6k sertifikas\u0131n\u0131 olu\u015fturabiliriz.<\/p>\n
K\u00f6k CA \u00d6zel Anahtar\u0131n\u0131n Olu\u015fturulmas\u0131<\/h5>\n
Bu anahtar, t\u00fcm sertifikalar\u0131 imzalamak i\u00e7in kullan\u0131laca\u011f\u0131ndan son derece \u00f6nemlidir ve g\u00fcvenli bir \u015fekilde saklanmal\u0131d\u0131r. aes256<\/code> ile \u015fifrelenecek ve bir parola ile korunacakt\u0131r.<\/p>\n
sudo openssl genrsa -aes256 -out \/etc\/ssl\/ca\/private\/ca.key.pem 4096\nsudo chmod 400 \/etc\/ssl\/ca\/private\/ca.key.pem<\/code><\/pre>\n
*   genrsa<\/code>: RSA \u00f6zel anahtar\u0131 olu\u015fturur.
\n*   -aes256<\/code>: Anahtar\u0131 AES-256 \u015fifrelemesi ile korur. Bir parola girmeniz istenecektir. Bu parolay\u0131 unutmay\u0131n!
\n*   -out<\/code>: Anahtar\u0131n kaydedilece\u011fi dosya.
\n*   4096<\/code>: Anahtar\u0131n bit cinsinden boyutu. Daha b\u00fcy\u00fck boyut, daha g\u00fc\u00e7l\u00fc g\u00fcvenlik sa\u011flar.
\n*   chmod 400<\/code>: \u00d6zel anahtar dosyas\u0131n\u0131n yaln\u0131zca root<\/code> kullan\u0131c\u0131s\u0131 taraf\u0131ndan okunabilir olmas\u0131n\u0131 sa\u011flar.<\/p>\n
K\u00f6k CA Kendi Kendini \u0130mzalayan Sertifikas\u0131n\u0131n Olu\u015fturulmas\u0131<\/h5>\n
Bu sertifika, CA’n\u0131n kimli\u011fini do\u011frular ve di\u011fer t\u00fcm sertifikalar\u0131n g\u00fcven zincirinin k\u00f6k\u00fcn\u00fc olu\u015fturur.<\/p>\n
sudo openssl req -x509 -new -nodes -key \/etc\/ssl\/ca\/private\/ca.key.pem -sha256 -days 3650 -out \/etc\/ssl\/ca\/certs\/ca.cert.pem -config \/etc\/ssl\/ca\/openssl.cnf<\/code><\/pre>\n
*   req<\/code>: Sertifika imzalama iste\u011fi (CSR) veya kendi kendini imzalayan sertifika olu\u015fturur.
\n*   -x509<\/code>: Kendi kendini imzalayan bir sertifika olu\u015fturur.
\n*   -new<\/code>: Yeni bir sertifika iste\u011fi olu\u015fturur.
\n*   -nodes<\/code>: Anahtar\u0131n \u015fifrelenmemesini sa\u011flar (ancak biz anahtar\u0131 zaten \u015fifreledik, bu komut sertifika iste\u011fi i\u00e7in parolay\u0131 sormaz).
\n*   -key<\/code>: Kullan\u0131lacak \u00f6zel anahtar.
\n*   -sha256<\/code>: Hashing algoritmas\u0131.
\n*   -days 3650<\/code>: Sertifikan\u0131n ge\u00e7erlilik s\u00fcresi (10 y\u0131l).
\n*   -out<\/code>: Sertifikan\u0131n kaydedilece\u011fi dosya.
\n*   -config<\/code>: Kullan\u0131lacak yap\u0131land\u0131rma dosyas\u0131.<\/p>\n
Komutu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, CA’n\u0131n kimli\u011fini belirten bilgiler girmeniz istenecektir. Bu bilgiler, sertifikada “Subject” alan\u0131 olarak g\u00f6r\u00fcnecektir:
\n*   Country Name (2 letter code) [AU]: TR<\/code>
\n*   State or Province Name (full name) [Some-State]: Istanbul<\/code>
\n*   Locality Name (eg, city) []: Kadikoy<\/code>
\n*   Organization Name (eg, company) [Internet Widgits Pty Ltd]: MyCompany CA<\/code>
\n*   Organizational Unit Name (eg, section) []: IT<\/code>
\n*   Common Name (e.g. server FQDN or YOUR name) []: MyCompany Root CA<\/code>
\n*   Email Address []: ca@mycompany.com<\/code><\/p>\n
Common Name<\/code> (Ortak Ad) alan\u0131, CA’n\u0131n ad\u0131n\u0131 a\u00e7\u0131k\u00e7a belirtmelidir. \u00d6rne\u011fin, “MyCompany Root CA”.<\/p>\n
CA Sertifikas\u0131n\u0131 Do\u011frulama<\/h5>\n
Olu\u015fturdu\u011funuz k\u00f6k CA sertifikas\u0131n\u0131n i\u00e7eri\u011fini kontrol edebilirsiniz:<\/p>\n
sudo openssl x509 -in \/etc\/ssl\/ca\/certs\/ca.cert.pem -text -noout<\/code><\/pre>\n
Bu komut, sertifikan\u0131n t\u00fcm detaylar\u0131n\u0131 (ge\u00e7erlilik s\u00fcresi, veren, konu, uzant\u0131lar vb.) g\u00f6sterecektir. Basic Constraints: CA:TRUE<\/code> ve Key Usage: ... keyCertSign, cRLSign<\/code> gibi uzant\u0131lar\u0131n do\u011fru \u015fekilde ayarland\u0131\u011f\u0131ndan emin olun.<\/p>\n
Alt Sertifika Otoritesi (Subordinate CA) Olu\u015fturma (\u0130ste\u011fe Ba\u011fl\u0131)<\/h3>\n
G\u00fcvenlik en iyi uygulamalar\u0131ndan biri, k\u00f6k CA’y\u0131 \u00e7evrimd\u0131\u015f\u0131 (air-gapped) tutmak ve g\u00fcnl\u00fck sertifika imzalama i\u015flemleri i\u00e7in bir alt (subordinate) CA kullanmakt\u0131r. Bu b\u00f6l\u00fcm, b\u00f6yle bir alt CA’n\u0131n nas\u0131l olu\u015fturulaca\u011f\u0131n\u0131 a\u00e7\u0131klar. E\u011fer sadece basit bir k\u00f6k CA yeterliyse, bu b\u00f6l\u00fcm\u00fc atlayabilirsiniz.<\/p>\n
Alt CA Dizin Yap\u0131s\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
Alt CA i\u00e7in de benzer bir dizin yap\u0131s\u0131 olu\u015fturaca\u011f\u0131z, \u00f6rne\u011fin \/etc\/ssl\/subca<\/code>.<\/p>\n
sudo mkdir -p \/etc\/ssl\/subca\/{certs,crl,newcerts,private,csr}\nsudo chmod 700 \/etc\/ssl\/subca\/private\nsudo touch \/etc\/ssl\/subca\/index.txt\nsudo sh -c 'echo 1000 > \/etc\/ssl\/subca\/serial'<\/code><\/pre>\n
Alt CA Yap\u0131land\u0131rma Dosyas\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
Alt CA i\u00e7in de kendi openssl.cnf<\/code> dosyas\u0131na ihtiyac\u0131m\u0131z var. Bu dosya, k\u00f6k CA’n\u0131nkiyle benzer olacak, ancak dir<\/code> yolu ve baz\u0131 varsay\u0131lan ayarlar farkl\u0131l\u0131k g\u00f6sterecektir. En \u00f6nemlisi, alt CA sertifikas\u0131 imzalan\u0131rken v3_sub_ca<\/code> uzant\u0131lar\u0131 kullan\u0131lacakt\u0131r.<\/p>\n
sudo nano \/etc\/ssl\/subca\/openssl.cnf<\/code><\/pre>\n
Dosya i\u00e7eri\u011fi, dir<\/code> yolunu \/etc\/ssl\/subca<\/code> olarak g\u00fcncelleyerek ve x509_extensions = v3_sub_ca<\/code> kullanarak k\u00f6k CA yap\u0131land\u0131rma dosyas\u0131na benzer olacakt\u0131r:<\/p>\n
# OpenSSL subordinate CA configuration file.\n
Copy to '\/etc\/ssl\/subca\/openssl.cnf'.<\/h2>\n\n[ ca ]\ndefault_ca = CA_default\n\n[ CA_default ]\ndir               = \/etc\/ssl\/subca          # Where everything is kept\ncerts             = $dir\/certs              # Where the issued certs are kept\ncrl_dir           = $dir\/crl                # Where the issued crl are kept\nnew_certs_dir     = $dir\/newcerts           # Default place for new certs.\ndatabase          = $dir\/index.txt          # Database index file.\nserial            = $dir\/serial             # The current serial number\ncrlnumber         = $dir\/crlnumber          # the current crl number (srl)\n
touch $dir\/crlnumber<\/h2>\n
echo 1000 > $dir\/crlnumber<\/h2>\n\nprivate_key       = $dir\/private\/subca.key.pem # The private key\ncertificate       = $dir\/certs\/subca.cert.pem  # The CA certificate\n\ncrl               = $dir\/crl\/subca.crl.pem     # The current CRL\ndefault_crl_days  = 7                       # How long before next CRL\n\ndefault_days      = 1825                    # How long to certify for (5 years)\ndefault_md        = sha256                  # Use SHA-256 for digests\npreserve          = no                      # Keep passed DN ordering\n\npolicy            = policy_strict\nx509_extensions   = v3_sub_ca               # The extensions to add to the cert\n\n
... (policy_strict, policy_loose, req, req_distinguished_name b\u00f6l\u00fcmleri k\u00f6k CA ile ayn\u0131 kalabilir) ...<\/h2>\n
Sadece uzant\u0131lar b\u00f6l\u00fcm\u00fcn\u00fc tekrar ekleyelim, tam bir dosya olsun<\/h2>\n[ policy_strict ]\ncountryName             = match\nstateOrProvinceName     = match\norganizationName        = match\norganizationalUnitName  = optional\ncommonName              = supplied\nemailAddress            = optional\n\n[ policy_loose ]\ncountryName             = optional\nstateOrProvinceName     = optional\nlocalityName            = optional\norganizationName        = optional\norganizationalUnitName  = optional\ncommonName              = supplied\nemailAddress            = optional\n\n[ req ]\ndefault_bits        = 4096\ndistinguished_name  = req_distinguished_name\nstring_mask         = utf8only\ndefault_md          = sha256\nx509_extensions     = v3_sub_ca\n\n[ req_distinguished_name ]\ncountryName                     = Country Name (2 letter code)\nstateOrProvinceName             = State or Province Name (full name)\nlocalityName                    = Locality Name (eg, city)\n0.organizationName              = Organization Name (eg, company)\norganizationalUnitName          = Organizational Unit Name (eg, section)\ncommonName                      = Common Name (e.g. server FQDN or YOUR name)\nemailAddress                    = Email Address\n\n[ v3_ca ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = critical, CA:true\nkeyUsage = critical, digitalSignature, cRLSign, keyCertSign\n\n[ v3_sub_ca ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = critical, CA:true, pathlen:0\nkeyUsage = critical, digitalSignature, cRLSign, keyCertSign\n\n[ server_cert ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = CA:FALSE\nkeyUsage = critical, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\n\n[ client_cert ]\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints = CA:FALSE\nkeyUsage = critical, digitalSignature\nextendedKeyUsage = clientAuth\n\n[ crl_ext ]\nauthorityKeyIdentifier = keyid:always,issuer<\/code><\/pre>\n
\u00d6nemli Not:<\/strong> pathlen:0<\/code> uzant\u0131s\u0131, bu alt CA’n\u0131n ba\u015fka bir alt CA imzalayamayaca\u011f\u0131n\u0131 belirtir. Bu, g\u00fcven zincirinin derinli\u011fini s\u0131n\u0131rlar ve g\u00fcvenlik a\u00e7\u0131s\u0131ndan iyi bir uygulamad\u0131r.<\/p>\n
Alt CA Anahtar\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
sudo openssl genrsa -aes256 -out \/etc\/ssl\/subca\/private\/subca.key.pem 4096\nsudo chmod 400 \/etc\/ssl\/subca\/private\/subca.key.pem<\/code><\/pre>\n
Alt CA Sertifika \u0130mzalama \u0130ste\u011fi (CSR) Olu\u015fturma<\/h4>\n
Alt CA i\u00e7in bir CSR olu\u015fturulur. Bu CSR, k\u00f6k CA taraf\u0131ndan imzalanacakt\u0131r.<\/p>\n
sudo openssl req -new -sha256 -key \/etc\/ssl\/subca\/private\/subca.key.pem -out \/etc\/ssl\/subca\/csr\/subca.csr.pem -config \/etc\/ssl\/subca\/openssl.cnf<\/code><\/pre>\n
Common Name<\/code> i\u00e7in “MyCompany Subordinate CA” gibi bir isim kullan\u0131n.<\/p>\n
K\u00f6k CA Taraf\u0131ndan Alt CA Sertifikas\u0131n\u0131n \u0130mzalama<\/h4>\n
\u015eimdi k\u00f6k CA’y\u0131 kullanarak alt CA’n\u0131n CSR’sini imzalayaca\u011f\u0131z. Bu i\u015flem i\u00e7in k\u00f6k CA’n\u0131n \u00f6zel anahtar\u0131n\u0131n parolas\u0131na ihtiyac\u0131n\u0131z olacakt\u0131r.<\/p>\n
sudo openssl ca -config \/etc\/ssl\/ca\/openssl.cnf -extensions v3_sub_ca -days 1825 -notext -md sha256 -in \/etc\/ssl\/subca\/csr\/subca.csr.pem -out \/etc\/ssl\/subca\/certs\/subca.cert.pem<\/code><\/pre>\n
*   -config \/etc\/ssl\/ca\/openssl.cnf<\/code>: K\u00f6k CA’n\u0131n yap\u0131land\u0131rma dosyas\u0131n\u0131 kullan\u0131r.
\n*   -extensions v3_sub_ca<\/code>: Alt CA i\u00e7in \u00f6zel uzant\u0131lar\u0131 uygular.
\n*   -days 1825<\/code>: Alt CA sertifikas\u0131n\u0131n 5 y\u0131l ge\u00e7erli olaca\u011f\u0131n\u0131 belirtir.<\/p>\n
Komutu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, sertifika iste\u011fini onaylaman\u0131z istenecektir (Sign the certificate? [y\/n]<\/code>) ve ard\u0131ndan k\u00f6k CA’n\u0131n \u00f6zel anahtar\u0131n\u0131n parolas\u0131 sorulacakt\u0131r.<\/p>\n
Alt CA Sertifikas\u0131n\u0131 Do\u011frulama<\/h5>\n
sudo openssl x509 -in \/etc\/ssl\/subca\/certs\/subca.cert.pem -text -noout<\/code><\/pre>\n
Burada Basic Constraints: CA:TRUE, pathlen:0<\/code> ve Key Usage: ... keyCertSign, cRLSign<\/code> uzant\u0131lar\u0131n\u0131n do\u011fru ayarland\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n
Bundan sonraki t\u00fcm sertifika imzalama i\u015flemleri i\u00e7in (sunucu, istemci) alt CA’y\u0131 kullanabilirsiniz. Bu, k\u00f6k CA’y\u0131 \u00e7evrimd\u0131\u015f\u0131 tutman\u0131za olanak tan\u0131r. E\u011fer alt CA olu\u015fturmad\u0131ysan\u0131z, a\u015fa\u011f\u0131daki ad\u0131mlarda \/etc\/ssl\/ca\/openssl.cnf<\/code> dosyas\u0131n\u0131 kullanmaya devam edin.<\/p>\n
Sunucu Sertifikas\u0131 Olu\u015fturma ve \u0130mzalama<\/h3>\n
Bir web sunucusu (Apache, Nginx vb.) veya ba\u015fka bir hizmet i\u00e7in SSL\/TLS \u015fifrelemesi sa\u011flamak amac\u0131yla bir sunucu sertifikas\u0131na ihtiyac\u0131m\u0131z var.<\/p>\n
Sunucu Anahtar\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
Sunucu i\u00e7in \u00f6zel anahtar olu\u015fturulur. Bu anahtar\u0131n \u015fifresiz olmas\u0131 tercih edilir, b\u00f6ylece sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda otomatik olarak ba\u015flat\u0131labilir.<\/p>\n
sudo openssl genrsa -out \/etc\/ssl\/ca\/private\/server.key.pem 2048\nsudo chmod 400 \/etc\/ssl\/ca\/private\/server.key.pem<\/code><\/pre>\n
*   2048<\/code>: Anahtar boyutu. \u00dcretim ortamlar\u0131 i\u00e7in genellikle 2048 veya 4096 bit kullan\u0131l\u0131r.<\/p>\n
Sunucu Sertifika \u0130mzalama \u0130ste\u011fi (CSR) Olu\u015fturma<\/h4>\n
Sunucu sertifikas\u0131 i\u00e7in bir CSR olu\u015fturulur. Common Name<\/code> (Ortak Ad) alan\u0131, sunucunun tam nitelikli alan ad\u0131n\u0131 (FQDN) i\u00e7ermelidir (\u00f6rn. www.example.com<\/code>).<\/p>\n
sudo openssl req -new -sha256 -key \/etc\/ssl\/ca\/private\/server.key.pem -out \/etc\/ssl\/ca\/csr\/server.csr.pem -config \/etc\/ssl\/ca\/openssl.cnf<\/code><\/pre>\n
*   Common Name<\/code>: www.example.com<\/code> veya sunucunuzun IP adresi.<\/p>\n
CA Taraf\u0131ndan Sunucu Sertifikas\u0131n\u0131n \u0130mzalama<\/h4>\n
\u015eimdi CA (k\u00f6k veya alt CA) kullanarak sunucu CSR’sini imzalayaca\u011f\u0131z. Bu \u00f6rnekte k\u00f6k CA’y\u0131 kullan\u0131yoruz. E\u011fer alt CA’y\u0131 kullan\u0131yorsan\u0131z, openssl ca -config \/etc\/ssl\/subca\/openssl.cnf ...<\/code> komutunu kullanmal\u0131s\u0131n\u0131z.<\/p>\n
sudo openssl ca -config \/etc\/ssl\/ca\/openssl.cnf -extensions server_cert -days 375 -notext -md sha256 -in \/etc\/ssl\/ca\/csr\/server.csr.pem -out \/etc\/ssl\/ca\/certs\/server.cert.pem<\/code><\/pre>\n
*   -extensions server_cert<\/code>: Sunucu sertifikas\u0131 i\u00e7in \u00f6zel uzant\u0131lar\u0131 uygular. Bu uzant\u0131lar, sertifikan\u0131n serverAuth<\/code> i\u00e7in kullan\u0131labilece\u011fini belirtir.
\n*   -days 375<\/code>: Sertifikan\u0131n ge\u00e7erlilik s\u00fcresi (genellikle 1 y\u0131l + birka\u00e7 g\u00fcn).<\/p>\n
Sunucu Sertifikas\u0131n\u0131 Do\u011frulama<\/h4>\n
sudo openssl x509 -in \/etc\/ssl\/ca\/certs\/server.cert.pem -text -noout<\/code><\/pre>\n
Burada Basic Constraints: CA:FALSE<\/code> ve Extended Key Usage: TLS Web Server Authentication<\/code> uzant\u0131lar\u0131n\u0131n do\u011fru ayarland\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n
Bu sertifikay\u0131, Apache, Nginx veya di\u011fer web sunucular\u0131n\u0131zda kullanabilirsiniz. Genellikle sunucuya server.key.pem<\/code> ve server.cert.pem<\/code> dosyalar\u0131n\u0131 kopyalaman\u0131z ve web sunucusunun yap\u0131land\u0131rma dosyalar\u0131nda belirtmeniz gerekir. Ayr\u0131ca, CA sertifikas\u0131n\u0131 (\u00f6rn. ca.cert.pem<\/code> veya subca.cert.pem<\/code>) web sunucusuna zincir sertifika olarak eklemeniz gerekebilir, b\u00f6ylece istemciler sunucu sertifikas\u0131n\u0131n g\u00fcvenilirli\u011fini do\u011frulayabilir.<\/p>\n
\u0130stemci Sertifikas\u0131 Olu\u015fturma ve \u0130mzalama<\/h3>\n
\u0130stemci sertifikalar\u0131, kullan\u0131c\u0131lar\u0131n veya cihazlar\u0131n belirli hizmetlere eri\u015firken kimliklerini do\u011frulamak i\u00e7in kullan\u0131l\u0131r. \u00d6rne\u011fin, VPN’ler, SSH veya belirli web uygulamalar\u0131 i\u00e7in kullan\u0131labilirler.<\/p>\n
\u0130stemci Anahtar\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
sudo openssl genrsa -out \/etc\/ssl\/ca\/private\/client.key.pem 2048\nsudo chmod 400 \/etc\/ssl\/ca\/private\/client.key.pem<\/code><\/pre>\n
\u0130stemci Sertifika \u0130mzalama \u0130ste\u011fi (CSR) Olu\u015fturma<\/h4>\n
Common Name<\/code> alan\u0131, istemcinin kimli\u011fini belirten bir isim veya kullan\u0131c\u0131 ad\u0131 i\u00e7ermelidir (\u00f6rn. john.doe<\/code>).<\/p>\n
sudo openssl req -new -sha256 -key \/etc\/ssl\/ca\/private\/client.key.pem -out \/etc\/ssl\/ca\/csr\/client.csr.pem -config \/etc\/ssl\/ca\/openssl.cnf<\/code><\/pre>\n
*   Common Name<\/code>: john.doe<\/code><\/p>\n
CA Taraf\u0131ndan \u0130stemci Sertifikas\u0131n\u0131n \u0130mzalama<\/h4>\n
Yine, k\u00f6k CA’y\u0131 (veya alt CA’y\u0131) kullanarak istemci CSR’sini imzalayaca\u011f\u0131z.<\/p>\n
sudo openssl ca -config \/etc\/ssl\/ca\/openssl.cnf -extensions client_cert -days 375 -notext -md sha256 -in \/etc\/ssl\/ca\/csr\/client.csr.pem -out \/etc\/ssl\/ca\/certs\/client.cert.pem<\/code><\/pre>\n
*   -extensions client_cert<\/code>: \u0130stemci sertifikas\u0131 i\u00e7in \u00f6zel uzant\u0131lar\u0131 uygular. Bu uzant\u0131lar, sertifikan\u0131n clientAuth<\/code> i\u00e7in kullan\u0131labilece\u011fini belirtir.<\/p>\n
\u0130stemci Sertifikas\u0131n\u0131 Do\u011frulama<\/h4>\n
sudo openssl x509 -in \/etc\/ssl\/ca\/certs\/client.cert.pem -text -noout<\/code><\/pre>\n
Burada Basic Constraints: CA:FALSE<\/code> ve Extended Key Usage: TLS Web Client Authentication<\/code> uzant\u0131lar\u0131n\u0131n do\u011fru ayarland\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n
\u0130stemci sertifikalar\u0131n\u0131 genellikle .p12<\/code> veya .pfx<\/code> format\u0131na d\u00f6n\u00fc\u015ft\u00fcr\u00fcp kullan\u0131c\u0131lara da\u011f\u0131tman\u0131z gerekir, b\u00f6ylece taray\u0131c\u0131lara veya i\u015fletim sistemlerine kolayca aktar\u0131labilirler.<\/p>\n
# \u0130stemci sertifikas\u0131n\u0131 ve anahtar\u0131n\u0131 bir .p12 dosyas\u0131na d\u00f6n\u00fc\u015ft\u00fcrme\nsudo openssl pkcs12 -export -out \/etc\/ssl\/ca\/certs\/client.p12 -inkey \/etc\/ssl\/ca\/private\/client.key.pem -in \/etc\/ssl\/ca\/certs\/client.cert.pem -certfile \/etc\/ssl\/ca\/certs\/ca.cert.pem -name \"John Doe Client Cert\"<\/code><\/pre>\n
Bu komut, istemcinin \u00f6zel anahtar\u0131n\u0131, sertifikas\u0131n\u0131 ve CA sertifikas\u0131n\u0131 tek bir \u015fifreli dosyada birle\u015ftirir. Bir d\u0131\u015fa aktarma parolas\u0131 belirlemeniz istenecektir.<\/p>\n
Sertifika \u0130ptal Listesi (CRL) Y\u00f6netimi<\/h3>\n
Bazen bir sertifika, ge\u00e7erlilik s\u00fcresi dolmadan \u00f6nce iptal edilmesi gerekebilir (\u00f6rn. \u00f6zel anahtar\u0131n ele ge\u00e7irilmesi, kullan\u0131c\u0131n\u0131n i\u015ften ayr\u0131lmas\u0131). Sertifika \u0130ptal Listesi (CRL), iptal edilen sertifikalar\u0131n bir listesidir.<\/p>\n
CRL Numaras\u0131 Dosyas\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
\u0130lk CRL’yi olu\u015fturmadan \u00f6nce bir crlnumber<\/code> dosyas\u0131 olu\u015fturmal\u0131y\u0131z.<\/p>\n
sudo sh -c 'echo 1000 > \/etc\/ssl\/ca\/crlnumber'<\/code><\/pre>\n
CRL Olu\u015fturma<\/h4>\n
\u0130lk CRL’yi olu\u015fturun:<\/p>\n
sudo openssl ca -config \/etc\/ssl\/ca\/openssl.cnf -gencrl -out \/etc\/ssl\/ca\/crl\/ca.crl.pem<\/code><\/pre>\n
Bu komut, CA’n\u0131n \u00f6zel anahtar\u0131n\u0131n parolas\u0131n\u0131 isteyecektir.<\/p>\n
Sertifika \u0130ptal Etme<\/h4>\n
Bir sertifikay\u0131 iptal etmek i\u00e7in revoke<\/code> komutunu kullan\u0131n:<\/p>\n
sudo openssl ca -config \/etc\/ssl\/ca\/openssl.cnf -revoke \/etc\/ssl\/ca\/certs\/server.cert.pem<\/code><\/pre>\n
Bu komut, belirtilen sertifikay\u0131 CA’n\u0131n index.txt<\/code> veritaban\u0131nda “Revoked” (\u0130ptal Edildi) olarak i\u015faretler. Ancak, bu de\u011fi\u015fiklik CRL’ye yans\u0131maz.<\/p>\n
CRL G\u00fcncelleme<\/h4>\n
\u0130ptal edilen sertifikalar\u0131n CRL’ye yans\u0131mas\u0131 i\u00e7in CRL’yi yeniden olu\u015fturman\u0131z veya g\u00fcncellemeniz gerekir:<\/p>\n
sudo openssl ca -config \/etc\/ssl\/ca\/openssl.cnf -gencrl -out \/etc\/ssl\/ca\/crl\/ca.crl.pem<\/code><\/pre>\n
G\u00fcncellenmi\u015f CRL, iptal edilen sertifikalar\u0131n seri numaralar\u0131n\u0131 i\u00e7erecektir. Sunucular\u0131n\u0131z\u0131n veya istemcilerinizin bu CRL’yi d\u00fczenli olarak kontrol etmesi \u00f6nemlidir.<\/p>\n
G\u00fcvenlik Hususlar\u0131<\/h3>\n
Kendi CA’n\u0131z\u0131 y\u00f6netirken g\u00fcvenlik son derece \u00f6nemlidir. \u0130\u015fte dikkat etmeniz gereken baz\u0131 temel noktalar:<\/p>\n
*   K\u00f6k CA’y\u0131 \u00c7evrimd\u0131\u015f\u0131 Tutun (Air-Gapped):<\/strong> K\u00f6k CA’n\u0131n \u00f6zel anahtar\u0131, PKI’n\u0131z\u0131n en kritik bile\u015fenidir. Bu anahtar\u0131n ele ge\u00e7irilmesi, t\u00fcm g\u00fcven zincirinizin tehlikeye girmesi anlam\u0131na gelir. K\u00f6k CA’y\u0131 fiziksel olarak a\u011fdan izole edilmi\u015f bir makinede tutmak en g\u00fcvenli yakla\u015f\u0131md\u0131r. G\u00fcnl\u00fck imzalama i\u015flemleri i\u00e7in bir alt CA kullan\u0131n.
\n*   \u00d6zel Anahtarlar\u0131 Koruyun:<\/strong> T\u00fcm \u00f6zel anahtarlar (CA, alt CA, sunucu, istemci) g\u00fc\u00e7l\u00fc parolalarla \u015fifrelenmeli ve dosya izinleri (chmod 400<\/code>) ile korunmal\u0131d\u0131r. Yaln\u0131zca yetkili ki\u015filerin bu anahtarlara eri\u015fimi olmal\u0131d\u0131r.
\n*   D\u00fczenli Yedeklemeler:<\/strong> CA dizin yap\u0131s\u0131n\u0131n (\u00f6zellikle private<\/code> dizini, index.txt<\/code> ve serial<\/code> dosyalar\u0131) d\u00fczenli ve g\u00fcvenli yedeklerini al\u0131n.
\n*   Fiziksel G\u00fcvenlik:<\/strong> CA sunucusunun fiziksel g\u00fcvenli\u011fini sa\u011flay\u0131n. Yaln\u0131zca yetkili personele eri\u015fim izni verin.
\n*   CRL ve OCSP:<\/strong> Sertifika iptal listelerini (CRL) d\u00fczenli olarak g\u00fcncelleyin ve da\u011f\u0131t\u0131m\u0131n\u0131 sa\u011flay\u0131n. B\u00fcy\u00fck \u00f6l\u00e7ekli PKI’lar i\u00e7in daha verimli bir alternatif olan \u00c7evrimi\u00e7i Sertifika Durumu Protokol\u00fc (OCSP) d\u00fc\u015f\u00fcn\u00fclmelidir.
\n*   G\u00fcncel Yaz\u0131l\u0131m:<\/strong> Ubuntu ve OpenSSL paketlerini d\u00fczenli olarak g\u00fcncelleyerek bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131ndan korunmaya dikkat edin.
\n*   Denetim Kay\u0131tlar\u0131:<\/strong> CA i\u015flemlerinin (sertifika verme, iptal etme vb.) denetim kay\u0131tlar\u0131n\u0131 tutun.<\/p>\n
Sonu\u00e7<\/h3>\n
Bu makalede, Ubuntu 22.04 \u00fczerinde kendi Sertifika Otoritenizi (CA) kurmak ve yap\u0131land\u0131rmak i\u00e7in gerekli t\u00fcm ad\u0131mlar\u0131 detayl\u0131 bir \u015fekilde inceledik. K\u00f6k CA olu\u015fturmaktan ba\u015flayarak, alt CA, sunucu ve istemci sertifikalar\u0131n\u0131n nas\u0131l olu\u015fturulaca\u011f\u0131n\u0131, imzalanaca\u011f\u0131n\u0131 ve iptal listelerinin nas\u0131l y\u00f6netilece\u011fini \u00f6\u011frendik. Ayr\u0131ca, CA’n\u0131z\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in \u00f6nemli hususlara da de\u011findik.<\/p>\n
Kendi CA’n\u0131z\u0131 y\u00f6netmek, i\u00e7 a\u011flar\u0131n\u0131zda ve \u00f6zel hizmetlerinizde g\u00fc\u00e7l\u00fc bir g\u00fcvenlik kontrol\u00fc sa\u011flar. Ancak, bu sorumlulukla birlikte gelen g\u00fcvenlik risklerinin fark\u0131nda olmak ve en iyi uygulamalar\u0131 takip etmek hayati \u00f6nem ta\u015f\u0131r. Do\u011fru yap\u0131land\u0131r\u0131lm\u0131\u015f ve g\u00fcvenli bir CA ile, dijital ileti\u015fimlerinizi g\u00fcvenilir bir \u015fekilde \u015fifreleyebilir, kimlikleri do\u011frulayabilir ve veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flayabilirsiniz. Bu kurulum, PKI d\u00fcnyas\u0131na sa\u011flam bir giri\u015f noktas\u0131 sunarak, dijital g\u00fcvenli\u011finizi kendi ellerinize alman\u0131z\u0131 sa\u011flar.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131\nGiri\u015f\nG\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda g\u00fcvenli ileti\u015fim, veri b\u00fc","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-38600","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nUbuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131\" \/>\n<meta property=\"og:description\" content=\"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131 Giri\u015f G\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda g\u00fcvenli ileti\u015fim, veri b\u00fc\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-03T15:40:56+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131\",\"datePublished\":\"2026-02-03T15:40:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\"},\"wordCount\":2745,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\",\"name\":\"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-02-03T15:40:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/","og_locale":"tr_TR","og_type":"article","og_title":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131","og_description":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131 Giri\u015f G\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda g\u00fcvenli ileti\u015fim, veri b\u00fc","og_url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-02-03T15:40:56+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"21 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131","datePublished":"2026-02-03T15:40:56+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/"},"wordCount":2745,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/","url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/","name":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-02-03T15:40:56+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-22-04-uzerinde-bir-sertifika-otoritesi-ca-kurulumu-ve-yapilandirmasi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Ubuntu 22.04 \u00dczerinde Bir Sertifika Otoritesi (CA) Kurulumu ve Yap\u0131land\u0131rmas\u0131"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=38600"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38600\/revisions"}],"predecessor-version":[{"id":38601,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38600\/revisions\/38601"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=38600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=38600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=38600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}