openssl和ssl证书的那些事

openssl 的相关用法，自签 CA 证书，签发 SSL 证书、多域名证书、通配型证书等等.

  

 自建CA证书

### 配置openssl.cnf, 不修改也行，主要就是一些默认参数
--- /etc/pki/tls/openssl.cnf ---
...
[ CA_default ]
...
default_days    = 3650            # how long to certify for
...
[ req_distinguished_name ]
countryName            = Country Name (2 letter code)
countryName_default        = CN
countryName_min            = 2
countryName_max            = 2
stateOrProvinceName        = State or Province Name (full name)
stateOrProvinceName_default    = GD
localityName            = Locality Name (eg, city)
localityName_default        = GZ
0.organizationName        = Organization Name (eg, company)
0.organizationName_default    = Otokaze
organizationalUnitName        = Organizational Unit Name (eg, section)
organizationalUnitName_default    = Otokaze
commonName            = Common Name (eg, your name or your server\'s hostname)
commonName_max            = 64
emailAddress            = Email Address
emailAddress_default    = 
emailAddress_max        = 64
...

### touch index.txt serial
cd /etc/pki/CA/
touch index.txt serial
echo 01 > serial

### 生成CA私钥
openssl genrsa -out private/cakey.pem 2048
chmod 600 private/cakey.pem

### 签署CA证书
openssl req -new -x509 -key private/cakey.pem -out cacert.pem
Bash
Copy

 单域名证书

### 以nginx为例，apache同理
mkdir /etc/pki/nginx
cd /etc/pki/nginx/

### 生成私钥
openssl genrsa -out www.zfl.com.key 2048

### 生成csr证书签名请求
openssl req -new -key www.zfl.com.key -out www.zfl.com.csr  (Commone Name 填写域名)

### CA签署证书
openssl ca -in www.zfl.com.csr -out www.zfl.com.crt
或
openssl x509 -req -in www.zfl.com.csr -CA /etc/pki/CA/cacert.pem -CAkey /etc/pki/CA/private/cakey.pem -CAcreateserial -out www.zfl.com.crt
Bash
Copy

 多域名SAN/通配符CN 证书

### 生成私钥
openssl genrsa -out zfl.key 2048

### 生成csr证书签名请求
openssl req -new \
-key zfl.key \
-subj "/C=CN/ST=GD/L=GZ/O=Otokaze/OU=Otokaze/CN=Otokaze" \
-reqexts SAN \
-config <(cat /etc/pki/tls/openssl.cnf \
<(printf "[SAN]\nsubjectAltName=DNS:zfl.com,DNS:*.zfl.com")) \
-out zfl.csr
# 注意到subjectAltName=DNS:zfl.com,DNS:*.zfl.com
# SAN多域名证书可以是通配型的域名，也可以是单个具体域名
# *.zfl.com 不包含 zfl.com
# 你可以写任意多个域名上去

### 查看csr文件信息
openssl req -text -noout -in zfl.csr
# 可以看到包含了 Subject Alternative Names 字段

### CA签署证书
openssl ca -in zfl.csr \
-extensions SAN \
-config <(cat /etc/pki/tls/openssl.cnf \
<(printf "[SAN]\nsubjectAltName=DNS:zfl.com,DNS:*.zfl.com")) \
-out zfl.crt

### 查看crt证书信息
openssl x509 -text -noout -in zfl.crt
Bash
Copy

 TXT_DB error number 2 错误

rm -fr /etc/pki/CA/index.txt
touch /etc/pki/CA/index.txt
Bash
Copy

 导入CA证书

### 我们自己颁发的CA证书是不被系统信任的，需要自己添加，否则浏览器或提示证书不安全，curl也会报错

### windows
Win+R 运行 certmgr.msc
定位到 受信任的根证书颁发机构 -> 证书 -> 右键单击 -> 所有任务 -> 导入
选择你的证书文件 cacert.pem，导入即可

### linux
先备份系统默认的根证书 cp -af /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem{,.bak}
然后追加进去就行  cat /etc/pki/CA/cacert.pem >> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Bash
Copy

 查看证书链

# 查看证书链
openssl s_client -connect www.zfl9.com:443

# 可看到这些字段
Certificate chain
 0 s:/CN=www.zfl9.com
   i:/C=CN/O=TrustAsia Technologies, Inc./OU=Symantec Trust Network/OU=Domain Validated SSL/CN=TrustAsia DV SSL CA - G5
 1 s:/C=CN/O=TrustAsia Technologies, Inc./OU=Symantec Trust Network/OU=Domain Validated SSL/CN=TrustAsia DV SSL CA - G5
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5