HTTPS 单双向认证及证书相关

1
2
3
4

# 查看 PEM 证书信息
openssl x509 -in certificate.pem -text -noout
# PEM 转 DER
openssl x509 -in cert.crt -outform der -out cert.der

1
2
3
4

# 查看 DER 证书信息
openssl x509 -in certificate.der -inform der -text -noout
# DER 转 PEM
openssl x509 -in cert.crt -inform der -outform pem -out cert.pem

1
2
3
4

# 查看 p12 证书信息
openssl pkcs12 -info -in your_certificate.p12
# p12 转 pem
openssl pkcs12 -in your_certificate.p12 -nocerts -out private_key.pem

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 先创建一个私钥 key
openssl genrsa -out root.key 4096
# 再根据 key 生成一个证书请求
openssl req -new -out root.csr -key root.key
# 下面是提示出来需要填写到 csr 的信息，包括国家、省、城市、公司、单位、域名、密码等信息
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:bj
Locality Name (eg, city) [Default City]:bj
Organization Name (eg, company) [Default Company Ltd]:alibaba
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your servers hostname) []:root
Email Address []:a.alibaba.com
A challenge password []:
An optional company name []:

# 用 key 和 csr 生成 10 年期限的根证书 root.crt
openssl x509 -req -in root.csr -out root.crt -signkey root.key -CAcreateserial -days 3650

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

openssl genrsa -out root.key 4096  # 根私钥
# 根证书
openssl req -new -x509 -days 3650 -key root.key -out root.crt -subj "/CN=Root CA"

openssl genrsa -out intermediate1.key 4096 # 中间证书 1 私钥
# 中间证书请求 1
openssl req -new -key intermediate1.key -out intermediate1.csr -subj "/CN=Intermediate CA 1"
# 根证书签发中间证书 1
openssl x509 -req -in intermediate1.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate1.crt -days 3650

openssl genrsa -out intermediate2.key 4096 # 中间证书 2 私钥
# 中间证书请求 2
openssl req -new -key intermediate2.key -out intermediate2.csr -subj "/CN=Intermediate CA 2"
# 中间证书 1 做 CA 签发中间证书 2
openssl x509 -req -in intermediate2.csr -CA intermediate1.crt -CAkey intermediate1.key -CAcreateserial -out intermediate2.crt -days 3650

openssl genrsa -out server.key 4096 # 终端用户证书私钥
# 终端用户证书请求
openssl req -new -key server.key -out server.csr -subj "/CN=server.example.com"
# 中间证书 2 做 CA 签发终端用户证书
openssl x509 -req -in server.csr -CA intermediate2.crt -CAkey intermediate2.key -CAcreateserial -out server.crt -days 365

1

cat server.crt intermediate2.crt intermediate1.crt > fullchain.crt

1
2
3
4
5
6
7

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /path/to/fullchain.crt;
    ssl_certificate_key /path/to/server.key;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 验证中间证书一是否由根证书签发
openssl verify -CAfile root.crt intermediate1.crt # intermediate1.crt: OK

# 接下来，验证中间证书二是否由中间证书一签发。
# 为了验证中间证书二，先创建一个证书链文件，包含根证书和中间证书一。
cat root.crt intermediate1.crt > chain1.pem
openssl verify -CAfile chain1.pem intermediate2.crt # intermediate2.crt: OK

# 最后，验证终端用户证书是否由中间证书二签发。
# 创建一个证书链文件，包含根证书和所有中间证书。
cat root.crt intermediate1.crt intermediate2.crt > chain2.pem
openssl verify -CAfile chain2.pem server.crt # server.crt: OK

# 为了完整验证整个证书链，你可以使用以下命令验证整个证书链文件 fullchain.crt：
cat server.crt intermediate2.crt intermediate1.crt > fullchain.crt
openssl verify -CAfile root.crt fullchain.crt # fullchain.crt: OK

1

openssl genrsa -out root.key 1024

1

openssl req -new -out root.csr -key root.key

1
2
3
4
5
6
7
8
9

Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:bj
Locality Name (eg, city) [Default City]:bj
Organization Name (eg, company) [Default Company Ltd]:alibaba
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your servers hostname) []:root
Email Address []:a.alibaba.com
A challenge password []:
An optional company name []:

1

openssl x509 -req -in root.csr -out root.crt -signkey root.key -CAcreateserial -days 3650

1

openssl genrsa -out server.key 1024

1

openssl req -new -out server.csr -key server.key

1

openssl x509 -req -in server.csr -out server.crt -signkey server.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650

1
2

openssl genrsa -out client.key 1024
openssl genrsa -out client2.key 1024

1
2

openssl req -new -out client.csr -key client.key
openssl req -new -out client2.csr -key client2.key

1
2

openssl x509 -req -in client.csr -out client.crt -signkey client.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650
openssl x509 -req -in client2.csr -out client2.crt -signkey client2.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650

1
2

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
openssl pkcs12 -export -clcerts -in client2.crt -inkey client2.key -out client2.p12

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

#--cert指定客户端公钥证书的路径
#--key指定客户端私钥文件的路径
#-k 使用本参数不校验证书的合法性，因为我们用的是自签名证书
#可以使用-v来观察具体的SSL握手过程
curl --cert ./client.crt --key ./client.key https://integration-fred2.fredhuang.com -k -v
* Rebuilt URL to: https://47.93.XX.XX/
*   Trying 47.93.XX.XX...
* TCP_NODELAY set
* Connected to 47.93.XX.XX (47.93.XX.XX) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=BJ; L=BJ; O=Alibaba; OU=Test; CN=integration-fred2.fredhuang.com; emailAddress=a@alibaba.com
*  start date: Nov  2 01:01:34 2019 GMT
*  expire date: Oct 30 01:01:34 2029 GMT
*  issuer: C=CN; ST=BJ; L=BJ; O=Alibaba; OU=Test; CN=root; emailAddress=a@alibaba.com
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> GET / HTTP/1.1
> host:integration-fred2.fredhuang.com
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.17.5
< Date: Sat, 02 Nov 2019 02:39:43 GMT
< Content-Type: text/html
< Content-Length: 612
< Last-Modified: Wed, 30 Oct 2019 11:29:45 GMT
< Connection: keep-alive
< ETag: "5db97429-264"
< Accept-Ranges: bytes
<
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
* Connection #0 to host 47.93.XX.XX left intact

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

curl --cert ./client2.crt --key ./client2.key https://integration-fred2.fredhuang.com -k
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>

1
2
3
4
5
6
7
8
9

curl https://integration-fred2.fredhuang.com -k
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx/1.17.5</center>
</body>
</html>