使用 Openssl 备忘录

最新推荐文章于 2023-09-18 15:00:09 发布

几十年黄钻会员

最新推荐文章于 2023-09-18 15:00:09 发布

阅读量569

点赞数

分类专栏：备忘文章标签： bash linux 开发语言

本文链接：https://blog.csdn.net/Kgong/article/details/129475593

版权

备忘专栏收录该内容

16 篇文章 0 订阅

订阅专栏

Openssl 创建 certificates

创建 self-signed 证书

“certificate authority” 要创建一个自己的证书来签名别的 server 证书

创建 CA 的 private key 和 self-signed certificate。

openssl req -x509 -newkey rsa:4096 -days 365 -keyout ca-key.pem -out ca-cert.pem

req: request 请求创建
-x509: 用来告知 openssl 输出一个 x509 格式的 public key certificate，而不是创建一个 CSR。
-newkey: 用来告知 openssl 使用 rsa 4096 bit key 来创建 private key。
-days: 用来告知 openssl certificate 的有效期。
pem: 常用格式后缀。

命令执行过程中会要求设置密码，用于保护 ca-key.pem private key。同时会需要输入一些身份信息，其中比较重要的是 Common Name（Domain name）用于后续的访问。如下

 openssl req -x509 -newkey rsa:4096 -days 365 -keyout ca-key.pem -out ca-cert.pem
Generating a 4096 bit RSA private key
..........................................................++
..............................................................................................................................++
writing new private key to 'ca-key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) []:CY
Organization Name (eg, company) []:GOV
Organizational Unit Name (eg, section) []:SEC
Common Name (eg, fully qualified host name) []:*.test.com
Email Address []:

cat 一下 ca-key.pem，可以看到 ENCRYPTED PRIVATE KEY。

 cat ca-key.pem
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIJnzBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQIvFS8k4gUo4ECAggA
MB0GCWCGSAFlAwQBKgQQBpr4eUDvLnLDM/vByHSJxgSCCVAMn4NTiA5PKYpvbGfI
...
z2bl5JB7l32UU1nlgql3b5m+6w==
-----END ENCRYPTED PRIVATE KEY-----

cat 一下 ca-cert.pem，可以看到 crt 并没有 ENCRYPTED，只是 base64 了一下。因为 ca-cert.pem 只包含 public key，身份信息，和 signature。这些都是一些公开的信息。

 cat ca-cert.pem
-----BEGIN CERTIFICATE-----
MIIFLDCCAxQCCQCO9xL3XIFtpTANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJD
TjELMAkGA1UECAwCQkoxCzAJBgNVBAcMAkNZMQwwCgYDVQQKDANHT1YxDDAKBgNV
...
zF5g86JXkox1GzAYaU3VCzGaH+hbKZFZFiz7T2f/VWA=
-----END CERTIFICATE-----

ca-cert.pem 信息可以使用 openssl x509 命令查看。
openssl x509 -in ca-cert.pem -noout -text

-noout：告知 openssl 不用输出 base64 后的值。
-text：告知 openssl 输出 readable text 格式。

 openssl x509 -in ca-cert.pem -noout -text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 10301723526251507109 (0x8ef712f75c816da5)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=BJ, L=CY, O=GOV, OU=SEC, CN=*.test.com
        Validity
            Not Before: Mar 12 06:59:43 2023 GMT
            Not After : Mar 11 06:59:43 2024 GMT
        Subject: C=CN, ST=BJ, L=CY, O=GOV, OU=SEC, CN=*.test.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:bb:3c:ab:8f:2c:2f:61:04:f2:a1:48:02:0c:48:
                    85:9d:35:2e:7f:58:a3:db:0f:af:11:ac:3d:44:34:
                    0d:12:3e:c7:25:9b:8c:93:06:5b:c8:a1:ee:12:4d:
                    e2:c5:0b:07:2f:46:b8:e8:3d:a5:97:da:27:88:1f:
                    01:b1:59:79:91:56:e6:c6:a0:1e:95:12:1c:0c:a3:
                    54:dd:ce:45:d1:2b:61:98:ef:c1:41:c2:f9:c9:4c:
                    b6:5b:54:43:00:9c:87:8a:73:c4:8e:ca:28:8c:f1:
                    29:2a:a4:8b:6e:c4:86:fb:56:fe:17:a4:e0:9b:b1:
                    a5:f0:8f:8f:a8:5a:bb:8f:81:da:e4:39:e9:44:0c:
                    dd:f4:d2:29:13:3d:73:ce:4a:82:90:70:c5:c5:9a:
                    20:cf:d5:48:a3:13:2a:bb:09:8a:d8:ae:76:3c:af:
                    1d:e8:80:e2:a6:48:f2:55:8c:27:4c:19:08:d1:a0:
                    da:d1:70:c4:d9:90:b5:df:8f:4c:e1:26:3e:2d:48:
                    4f:a1:28:42:0e:4e:02:34:f3:cb:9f:6b:23:e6:33:
                    fd:64:6c:4d:77:45:09:97:42:5c:cb:71:de:94:49:
                    41:27:28:30:dd:c9:7f:35:08:a5:6f:2b:ea:35:f2:
                    77:3a:a7:a3:71:75:9b:60:d4:59:31:3f:08:44:af:
                    aa:00:4b:c9:d7:21:02:77:e9:9f:f8:47:f5:84:cd:
                    ff:9c:aa:bd:66:d3:53:fa:7e:60:07:c3:a7:f5:f9:
                    b3:dd:25:3c:4f:7f:95:62:72:f4:9b:0f:e4:f2:09:
                    74:96:a7:96:33:4a:fd:51:3b:f3:51:f2:41:97:51:
                    51:c6:fe:95:25:97:fc:15:22:51:79:78:b7:a3:f3:
                    e6:2d:69:49:1b:18:02:99:20:8e:fd:c8:86:ac:d8:
                    ab:fa:cf:1e:43:1c:be:c2:1f:a2:61:0d:3c:11:6f:
                    06:b6:36:c1:20:83:ef:4d:e8:e5:8c:cd:f9:fd:cf:
                    b2:1a:9d:09:99:94:2d:d6:0c:bf:88:6a:03:f8:6d:
                    20:94:48:f5:6e:74:cf:ba:7b:d4:f7:a1:29:7e:95:
                    60:1f:ed:2b:e4:54:2c:d3:dd:67:a4:b9:af:30:55:
                    b1:74:c7:f8:05:7b:d2:f4:8f:ac:4c:cc:27:de:1d:
                    4a:89:09:80:f1:3d:3d:ba:92:c0:71:50:3f:7a:08:
                    d8:10:49:4d:69:b2:74:1e:b6:34:06:c3:19:6f:ba:
                    24:75:97:bc:40:f4:6a:13:50:c8:fe:e9:c8:b8:10:
                    94:af:f5:57:8d:3c:38:2e:2a:4d:b4:03:58:ed:8c:
                    1d:86:ce:61:15:69:14:1f:bc:d0:b6:86:34:86:4b:
                    1d:69:91
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         2f:7d:64:1d:6f:45:58:7a:d9:13:ec:d5:22:31:95:87:58:d4:
         2e:ae:e9:0e:7f:d1:c9:ce:57:e2:b8:38:e0:c5:c7:f9:03:23:
         ca:4c:2d:6b:80:40:51:71:5d:87:2e:29:c2:cd:a9:72:08:10:
         1e:86:10:bf:4d:b7:9a:69:61:78:90:97:7a:8c:c1:8b:48:fc:
         b0:d7:e5:96:c6:6a:3f:b7:3d:41:91:20:0e:2b:d2:16:60:a8:
         56:03:c5:10:f8:ed:14:b9:1e:8f:6b:b2:2f:e9:2d:fe:ea:25:
         15:85:6c:65:51:96:f8:c3:99:66:72:c5:d9:93:bf:b4:c4:4d:
         32:21:dd:84:68:c7:d7:69:ca:6b:26:cd:83:39:11:6e:56:ae:
         90:2e:f8:0e:3b:43:e1:89:9a:c7:7d:be:30:8b:13:5c:1b:5c:
         f2:b7:35:dc:e9:2c:76:fd:fa:c3:b2:ef:ba:57:2a:e1:60:a0:
         e4:62:7d:ee:ff:f7:23:4d:14:43:6e:c2:53:a2:09:ef:b3:36:
         13:31:80:42:12:17:b9:47:ef:88:e3:91:bc:af:0c:93:02:fd:
         0b:58:8d:f2:1d:b1:14:b6:8c:eb:71:22:06:c0:ec:3b:a4:d9:
         86:65:42:ca:30:b3:b2:24:fb:1d:20:55:e8:74:d8:3f:77:7e:
         11:46:aa:7e:90:17:52:69:03:fc:21:2f:6e:c4:4a:5f:25:85:
         9c:be:8b:25:f5:24:7a:83:e7:98:ee:7f:27:97:47:6e:57:68:
         84:9f:bb:07:d1:7c:2c:f6:dd:c1:6e:a4:a8:63:99:5d:96:33:
         f0:a2:91:d4:71:51:81:5d:c8:61:9f:fe:bf:1d:91:ab:fa:dd:
         67:91:15:eb:26:f1:22:58:22:ad:16:01:78:f2:14:57:fa:ec:
         ad:98:cc:be:e5:a7:24:04:2b:84:2a:22:cc:d1:e8:b6:0f:e4:
         19:8a:a4:66:15:a2:f9:c5:94:a7:4e:00:51:02:0e:2e:24:e3:
         52:e2:ce:79:34:62:1e:c2:3e:01:d5:1e:85:5b:33:07:61:83:
         00:a8:00:48:43:82:0e:7d:33:cf:79:52:36:c9:2e:87:fc:b1:
         ed:5a:34:0d:d3:41:2a:4b:e4:4b:a6:4c:fa:e4:1d:09:41:1a:
         98:92:ec:d1:40:3c:fa:55:0e:e3:9a:b4:b9:7b:f9:f0:02:0c:
         09:c3:d8:9d:04:50:f6:e4:5c:1d:d8:1c:43:ce:88:bf:b1:38:
         35:05:99:00:e1:42:dc:d7:cf:1b:e8:db:cc:5e:60:f3:a2:57:
         92:8c:75:1b:30:18:69:4d:d5:0b:31:9a:1f:e8:5b:29:91:59:
         16:2c:fb:4f:67:ff:55:60

这个证书的 Issuer 和 Subject 一样，原因是这是我们自己 self signed CA 证书。同时可以看到 Subject Public Key 和 Signature。

如何避免交互模式

避免交互身份信息

openssl 如何避免使用interactive mode。可以使用 -subj 选项配置身份信息，但是还是需要输入 private key 的密码。
openssl req -x509 -newkey rsa:4096 -days 365 -keyout ca-key.pem -out ca-cert.pem -subj "/C=CN/ST=BJ/L=CY/O=GOV/OU=SEC/CN=*.test.com"

openssl req -x509 -newkey rsa:4096 -days 365 -keyout ca-key.pem -out ca-cert.pem -subj "/C=CN/ST=BJ/L=CY/O=GOV/OU=SEC/CN=*.test.com"
Generating a 4096 bit RSA private key
..............++
.......................................................................++
writing new private key to 'ca-key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----

避免 encrypted private key（测试使用）

-nodes 选项可以让 openssl 命令避免加密 private key。

openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ca-key.pem -out ca-cert.pem -subj "/C=CN/ST=BJ/L=CY/O=GOV/OU=SEC/CN=*.test.com"
Generating a 4096 bit RSA private key
....................++
......++
writing new private key to 'ca-key.pem'
-----

cat 一下 ca-key.pem，看看 private key 文件内容变化。

 cat ca-key.pem
-----BEGIN PRIVATE KEY-----
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQC+z0yX8yIOlNB1
BxxG1nbarVqUuh+V4wyGBNT+Klo/Dov0iaUg6giTYVtSsYrQ+0IN8YhiezIc6e9N
...
lA8Y3j5m24j01sWZm9K8xI/plLI/dFo=
-----END PRIVATE KEY-----

可以看到这里已经不是 encrypted private，只是-----BEGIN PRIVATE KEY-----。

创建 `web server` 的 `private key` 和 `certificate signing request（CSR）`。

创建CA 根证书命令如下

openssl req -x509 -newkey rsa:4096 -days 365 -keyout ca-key.pem -out ca-cert.pem -subj "/C=CN/ST=BJ/L=CY/O=GOV/OU=SEC/CN=*.test.com"

对比创建 web server 的 private key 和 CSR 命令几乎和创建 CA 根证书类似，只是去掉了-x509 ，-days 365，修改了身份信息和输出文件，如下

openssl req -newkey rsa:4096 -keyout server-key.pem -out server-req.pem -subj "/C=CN/ST=SH/L=YY/O=OV/OU=SEC/CN=*.shtest.com"

cat 一下 server-key.pem 可以看到 private key 还是 ENCRYPTED。

cat server-key.pem
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIJnzBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQIdM4hPMIR/pgCAggA
MB0GCWCGSAFlAwQBKgQQ92ZEhY0dtQ12BtIZT8aA+ASCCVC+3tpLpF1uPztSpCkt
...
jMKNNOB34KxuOtJirCCHMJ31ww==
-----END ENCRYPTED PRIVATE KEY-----

cat 一下 server-req.pem 可以看到 server-req.pem 是 CERTIFICATE REQUEST。

cat server-req.pem
-----BEGIN CERTIFICATE REQUEST-----
MIIEnjCCAoYCAQAwWTELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAlNIMQswCQYDVQQH
DAJZWTELMAkGA1UECgwCT1YxDDAKBgNVBAsMA1NFQzEVMBMGA1UEAwwMKi5zaHRl
...
zTYvI36Tn9F6HiRoxa4X7qanazYDKWDIvmKn9PskWY0GAg==
-----END CERTIFICATE REQUEST-----

用 `self-signed CA` 证书的 `private key` 签名 web server 的 `certificate signing request（CSR）`，最后得到 `signed web server certificate`。

openssl x509 -req -in server-req.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem

-req: 告知 openssl 命令传入一个 certificate signing request。
-in: 传入certificate signing request。
-CA: 指定 CA 根证书。
-CAkey: 指定 CA 根证书的 private key。
-CAcreateserial: 给每个 certificate 一个独有的序列号。
-out: 输出 web server 的 certificate。

openssl x509 -req -in server-req.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
Signature ok
subject=/C=CN/ST=SH/L=YY/O=OV/OU=SEC/CN=*.shtest.com
Getting CA Private Key
Enter pass phrase for ca-key.pem:

运行后，因为 CA 根证书的 private key 创建时候有设置密码，所以使用的时候需要同样输入 private key 的密码。

创建完 web server 的 certificate 后可以使用之前 openssl x509 命令查看

openssl x509 -in server-cert.pem -noout -text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 11480488640831871058 (0x9f52e397b4b0d852)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=CN, ST=BJ, L=CY, O=GOV, OU=SEC, CN=*.test.com
        Validity
            Not Before: Mar 12 07:58:37 2023 GMT
            Not After : Apr 11 07:58:37 2023 GMT
        Subject: C=CN, ST=SH, L=YY, O=OV, OU=SEC, CN=*.shtest.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:b7:8f:5b:b8:a0:8e:53:ab:4e:8b:23:ee:49:7a:
                    e8:07:ec:d2:0d:11:83:65:93:dc:1b:ed:ac:81:3f:
                    5b:70:d5:6e:2d:14:f1:b1:62:92:3e:70:9e:6e:78:
                    06:43:b5:3b:c2:ed:e6:7e:f4:2f:59:c1:b9:aa:cc:
                    0b:09:a2:a0:15:90:e9:8d:da:1d:b4:73:ea:83:6a:
                    13:48:57:dc:1c:f3:45:86:e7:d8:48:98:df:ae:4d:
                    e5:7f:dc:23:54:64:58:34:28:88:39:b0:89:bc:af:
                    75:1d:6a:a3:c6:87:56:3a:4f:c9:a6:6f:d7:74:ba:
                    79:5d:9b:79:ab:dc:c7:06:c5:d9:05:9e:fa:52:d8:
                    d2:4d:95:e9:61:ec:ca:5a:1b:0e:0a:c9:09:c1:10:
                    1e:61:3f:84:99:f9:ab:c8:f1:16:65:53:ad:f2:b0:
                    4d:33:35:e9:06:30:bf:08:6e:ec:df:ac:cd:19:cc:
                    8e:62:73:8f:63:65:a3:32:35:a0:83:b8:a8:a3:f2:
                    8a:80:0f:62:82:49:7f:5c:c0:b4:c4:ec:e3:3c:4b:
                    ef:ca:fd:99:8e:67:e0:99:a5:32:2a:33:49:73:81:
                    05:e2:99:04:20:ad:a5:10:3f:f4:f4:35:d4:8e:f4:
                    6c:f5:e2:32:99:56:0c:34:c7:80:d3:4f:a2:af:fa:
                    b0:ef:1b:70:44:7a:7a:29:f6:d8:d8:05:3a:3f:b1:
                    4b:91:07:7e:36:6f:5f:83:f7:5e:6f:c4:b9:bc:c4:
                    0d:cb:57:58:99:a3:91:7e:fb:a0:93:91:4f:84:be:
                    b4:00:81:e8:94:d9:f5:c7:a4:57:b1:f3:a0:e4:71:
                    08:ad:90:0f:ea:ae:63:64:92:88:7e:44:e1:3a:f5:
                    87:9f:eb:bb:a5:b0:49:f3:99:68:38:17:ca:32:60:
                    ea:ec:ef:9d:80:05:a3:6d:bb:e5:ed:a2:c2:ae:38:
                    96:d1:e0:fa:b8:a8:ed:be:54:13:97:5d:ce:35:f1:
                    06:cb:1c:35:2d:5c:ea:2b:91:4c:99:cd:9b:da:21:
                    ec:2b:a3:ff:1d:3c:0e:9e:dc:25:c0:06:37:81:e5:
                    14:80:c5:6f:22:58:bf:25:04:00:0f:a4:6d:0c:d9:
                    e6:68:bc:f7:61:5d:04:e9:d9:c7:e7:8c:15:82:f1:
                    df:26:cc:46:1e:fb:ef:d8:96:36:c7:3e:6c:06:cb:
                    56:72:9a:d1:78:79:65:cc:b8:40:13:31:a0:6e:29:
                    e2:80:93:7d:a4:ac:73:fc:24:70:de:8c:74:9c:36:
                    91:7d:f1:5b:6c:69:37:63:3c:10:04:49:8c:17:84:
                    75:d9:0b:86:3f:1c:00:43:5b:b2:76:85:e8:bd:ed:
                    95:8d:db
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
         13:c4:26:76:2e:d9:22:13:9a:41:d0:6d:45:a2:f0:06:b2:83:
         85:7b:fc:e6:34:9e:e4:14:64:23:59:08:bf:0d:b1:55:e8:56:
         ce:91:05:0f:5b:80:28:89:8a:4a:bd:1f:39:61:1f:b9:f7:45:
         55:38:8b:8f:c2:ad:a9:cc:58:6a:d5:f7:a7:0f:f4:6f:af:b3:
         6a:0d:d7:35:10:8e:65:ba:17:5a:da:9e:cf:b5:e3:9f:db:43:
         76:81:89:ee:77:23:5c:4b:d6:bc:df:81:44:ce:7a:7f:b3:bb:
         97:9d:cf:61:c5:b2:07:d9:12:5e:26:8b:e2:f8:7a:02:18:b7:
         42:db:2f:74:7e:bf:71:65:4d:c9:d2:21:92:75:56:7b:e5:32:
         86:50:22:72:65:e1:1c:c4:0a:a4:ac:d9:47:98:6e:1a:c6:08:
         d9:11:2b:1d:f8:14:f3:d4:0f:99:79:35:a5:c5:95:20:09:f0:
         1c:1b:34:ff:f5:09:1a:74:14:dc:4e:a3:c1:0c:a2:33:0a:59:
         51:95:2f:ef:30:7f:9f:7c:54:35:88:5e:a0:f1:31:99:19:d0:
         e7:c2:fb:a8:50:9e:9f:48:95:2b:af:a1:1c:9e:13:9f:e7:eb:
         92:19:55:9c:db:1c:fe:bd:80:a9:bb:62:68:1c:10:c4:5c:7f:
         6f:93:7e:40:54:77:26:78:d8:a6:f7:f6:f0:a3:a2:92:08:5f:
         67:0b:d3:19:34:85:59:61:2d:87:f7:ea:d4:f4:59:ae:0f:2b:
         e3:10:b5:96:1b:e9:fb:d0:8f:83:6a:28:6f:42:40:1a:83:43:
         5b:49:ea:c5:4e:80:af:51:b8:cc:82:e8:8c:d7:0f:59:29:59:
         53:c7:0a:2e:c8:8e:99:17:a7:a0:f9:d6:33:5e:63:12:bd:26:
         13:2b:d0:a3:5e:a4:a0:24:2c:3b:d9:6b:43:44:84:82:bd:53:
         2e:ed:c4:b9:8d:29:e5:a0:7a:f3:fa:97:6c:df:9b:95:94:1d:
         40:29:cf:67:ac:27:ec:04:44:9d:08:56:1d:95:00:7f:ed:e2:
         63:44:b5:03:f9:09:9f:df:db:ed:38:da:e4:ce:e3:df:78:ac:
         0b:bf:69:8f:ab:e1:f5:21:47:96:f4:ac:73:79:d8:cd:a1:71:
         89:b4:4d:0d:96:82:64:7b:b1:66:c3:d0:28:ad:a2:10:80:27:
         80:8e:df:f3:ae:b9:27:e2:04:68:68:53:60:c4:d3:2e:9e:e0:
         38:88:38:b1:da:92:b6:23:ee:42:1f:b2:89:57:c9:7f:40:56:
         11:b7:98:01:a2:28:65:b0:e3:c2:a1:fc:4d:08:03:ba:9f:87:
         84:4d:e6:88:f2:e3:e1:bd

修改 web server certificate validate days

可以看到 web server certificate validate 30 days

        Validity
            Not Before: Mar 12 07:58:37 2023 GMT
            Not After : Apr 11 07:58:37 2023 GMT

可以通过 -days 选项指定 certificate 的 validate days。

openssl x509 -req -in server-req.pem -days 60 -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
Signature ok
subject=/C=CN/ST=SH/L=YY/O=OV/OU=SEC/CN=*.shtest.com
Getting CA Private Key
Enter pass phrase for ca-key.pem:

这里可以看到 Validity 为 60 天。

 openssl x509 -in server-cert.pem -noout -text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 11480488640831871059 (0x9f52e397b4b0d853)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=CN, ST=BJ, L=CY, O=GOV, OU=SEC, CN=*.test.com
        Validity
            Not Before: Mar 12 08:12:00 2023 GMT
            Not After : May 11 08:12:00 2023 GMT
        Subject: C=CN, ST=SH, L=YY, O=OV, OU=SEC, CN=*.shtest.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:b7:8f:5b:b8:a0:8e:53:ab:4

给 web server certificate 指定多个 domain name 和 IP address

可以通过给 certificate 的 Extension Subject Alternative Name 来制定 certificate 的不同 domain name，甚至到是 IP 地址。

subject
指定 Extension Subject Alternative Name 需要再创建一个文件 server-ext.cnf，内容如下

# cat server-ext.cnf
subjectAltName=DNS:*.hello.com,DNS:*.world.org,IP:0.0.0.0

DNS：指定其他的 domain name
IP：指定 IP 地址

重新生成带 web server certificate。通过 -extfile 选项指定 Extension Subject Alternative Name 文件 server-ext.cnf 。

openssl x509 -req -in server-req.pem -days 60 -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile server-ext.cnf
Signature ok
subject=/C=CN/ST=SH/L=YY/O=OV/OU=SEC/CN=*.shtest.com
Getting CA Private Key
Enter pass phrase for ca-key.pem:

查看 web server certificate。

 openssl x509 -in server-cert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 11480488640831871060 (0x9f52e397b4b0d854)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=CN, ST=BJ, L=CY, O=GOV, OU=SEC, CN=*.test.com
        Validity
            Not Before: Mar 12 08:23:43 2023 GMT
            Not After : May 11 08:23:43 2023 GMT
        Subject: C=CN, ST=SH, L=YY, O=OV, OU=SEC, CN=*.shtest.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:b7:8f:5b:b8:a0:8e:53:ab:4e:8b:23:ee:49:7a:
                    e8:07:ec:d2:0d:11:83:65:93:dc:1b:ed:ac:81:3f:
                    5b:70:d5:6e:2d:14:f1:b1:62:92:3e:70:9e:6e:78:
                    06:43:b5:3b:c2:ed:e6:7e:f4:2f:59:c1:b9:aa:cc:
                    0b:09:a2:a0:15:90:e9:8d:da:1d:b4:73:ea:83:6a:
                    13:48:57:dc:1c:f3:45:86:e7:d8:48:98:df:ae:4d:
                    e5:7f:dc:23:54:64:58:34:28:88:39:b0:89:bc:af:
                    75:1d:6a:a3:c6:87:56:3a:4f:c9:a6:6f:d7:74:ba:
                    79:5d:9b:79:ab:dc:c7:06:c5:d9:05:9e:fa:52:d8:
                    d2:4d:95:e9:61:ec:ca:5a:1b:0e:0a:c9:09:c1:10:
                    1e:61:3f:84:99:f9:ab:c8:f1:16:65:53:ad:f2:b0:
                    4d:33:35:e9:06:30:bf:08:6e:ec:df:ac:cd:19:cc:
                    8e:62:73:8f:63:65:a3:32:35:a0:83:b8:a8:a3:f2:
                    8a:80:0f:62:82:49:7f:5c:c0:b4:c4:ec:e3:3c:4b:
                    ef:ca:fd:99:8e:67:e0:99:a5:32:2a:33:49:73:81:
                    05:e2:99:04:20:ad:a5:10:3f:f4:f4:35:d4:8e:f4:
                    6c:f5:e2:32:99:56:0c:34:c7:80:d3:4f:a2:af:fa:
                    b0:ef:1b:70:44:7a:7a:29:f6:d8:d8:05:3a:3f:b1:
                    4b:91:07:7e:36:6f:5f:83:f7:5e:6f:c4:b9:bc:c4:
                    0d:cb:57:58:99:a3:91:7e:fb:a0:93:91:4f:84:be:
                    b4:00:81:e8:94:d9:f5:c7:a4:57:b1:f3:a0:e4:71:
                    08:ad:90:0f:ea:ae:63:64:92:88:7e:44:e1:3a:f5:
                    87:9f:eb:bb:a5:b0:49:f3:99:68:38:17:ca:32:60:
                    ea:ec:ef:9d:80:05:a3:6d:bb:e5:ed:a2:c2:ae:38:
                    96:d1:e0:fa:b8:a8:ed:be:54:13:97:5d:ce:35:f1:
                    06:cb:1c:35:2d:5c:ea:2b:91:4c:99:cd:9b:da:21:
                    ec:2b:a3:ff:1d:3c:0e:9e:dc:25:c0:06:37:81:e5:
                    14:80:c5:6f:22:58:bf:25:04:00:0f:a4:6d:0c:d9:
                    e6:68:bc:f7:61:5d:04:e9:d9:c7:e7:8c:15:82:f1:
                    df:26:cc:46:1e:fb:ef:d8:96:36:c7:3e:6c:06:cb:
                    56:72:9a:d1:78:79:65:cc:b8:40:13:31:a0:6e:29:
                    e2:80:93:7d:a4:ac:73:fc:24:70:de:8c:74:9c:36:
                    91:7d:f1:5b:6c:69:37:63:3c:10:04:49:8c:17:84:
                    75:d9:0b:86:3f:1c:00:43:5b:b2:76:85:e8:bd:ed:
                    95:8d:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:*.hello.com, DNS:*.world.org, IP Address:0.0.0.0
    Signature Algorithm: sha1WithRSAEncryption
         90:3d:97:f8:03:bb:8c:f4:35:2d:3a:7a:46:6e:92:0b:93:bb:
         dd:a5:b0:2a:cb:0f:0f:aa:76:50:f0:71:a8:0c:8e:08:36:36:
         b8:44:cc:e1:d8:06:7e:ab:5f:29:e7:f4:2d:e2:20:2a:b4:8a:
         eb:61:9f:b5:fa:3a:8d:3c:fc:df:b3:2a:c2:be:de:e1:e5:31:
         6f:82:cc:54:83:8a:4c:c2:cc:fe:e8:04:64:8d:8e:bb:f5:54:
         f8:e5:c1:1e:3f:30:26:87:45:e6:72:5a:ae:1d:ef:a1:8e:7a:
         59:54:05:0e:b4:e9:bb:ff:4b:c3:16:b8:f7:77:50:d0:7f:ce:
         4b:81:0b:ba:8d:07:93:c2:6f:dc:31:8d:6d:4d:76:fc:84:47:
         7b:8e:bc:12:dd:2c:df:3c:32:18:e7:6b:77:1e:6c:6d:99:72:
         ca:1e:fe:7c:cf:85:40:90:7b:64:c2:22:e5:eb:f1:78:ab:4f:
         d5:9d:77:28:84:e4:1a:14:01:54:32:6b:4d:40:ba:8c:ea:c3:
         c8:5e:9b:cd:a9:7e:e6:89:21:75:1c:3c:75:4f:29:04:ff:77:
         46:34:b6:14:32:3c:98:8f:11:5e:5f:7f:54:b7:30:42:63:b6:
         cf:a5:52:85:42:29:23:a2:15:55:13:3d:20:91:b0:d3:4a:f9:
         40:21:a2:86:7d:1d:b0:46:03:e7:3f:89:e4:0f:fc:ce:bb:a6:
         dd:f6:63:80:74:f0:bb:22:77:ba:f3:c0:24:e4:ce:74:37:32:
         c5:a7:52:db:e9:19:51:91:da:7b:a8:51:df:b7:1f:42:ad:25:
         a5:ec:2d:01:b5:f5:45:11:34:2c:b9:57:99:c9:f7:25:f7:04:
         81:74:f5:e3:c3:62:b3:e5:b7:89:57:c4:4a:20:23:9e:50:24:
         b2:cd:8d:33:d6:80:8c:28:13:89:92:1b:c3:66:11:9f:6d:96:
         c8:14:41:18:90:bc:09:9b:69:64:7c:57:5e:85:47:14:e9:39:
         48:5f:57:69:bb:40:11:5e:de:99:26:66:f0:98:32:ce:f6:5f:
         be:a7:a3:d7:9c:a5:45:cb:71:cb:45:df:f7:11:9c:95:3e:f9:
         10:80:77:57:c1:ce:40:fa:46:53:da:3d:ef:67:f6:79:d3:2c:
         5a:dc:de:6d:ad:ff:04:c1:86:94:b0:ab:32:e0:83:db:09:cd:
         79:4b:c0:3e:29:b8:60:e1:25:fe:45:26:3b:3c:31:79:1d:8c:
         bc:af:56:9b:65:97:ce:5d:ae:9e:30:28:12:7c:fb:8e:e1:f6:
         a8:65:4f:fb:ef:28:d5:20:70:3a:bf:a6:e9:b0:5b:0a:a1:d3:
         33:b0:55:52:43:ca:0f:dc

可以看到 Subject Alternative Name 改变。

        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:*.hello.com, DNS:*.world.org, IP Address:0.0.0.0

用 self-sgined CA 验证 web server certificate

可以使用命令 openssl verify -CAfile ca-cert.pem server-cert.pem

-CAfile：指定 self-signed CA 证书

openssl verify -CAfile ca-cert.pem server-cert.pem
server-cert.pem: OK

reference

https://www.youtube.com/watch?v=7YgaZIFn7mY