GMSSL 3.0生成自签名证书

ck1983

已于 2022-12-08 11:06:39 修改

阅读量2.1k

点赞数 1

文章标签： ssl

于 2022-11-24 18:17:11 首次发布

本文链接：https://blog.csdn.net/ck1983/article/details/128023867

版权

本文详细介绍了使用GMSSL工具生成SM2密钥对、证书请求、签名证书及加密证书的命令流程，包括服务器和客户端的签名及加密证书。涉及到的关键参数包括密码、用途、有效期等，为SSL证书的配置提供了清晰的操作指南。

摘要由CSDN通过智能技术生成

可以参考如下命令
gmssl sm2keygen -pass 123456 -out cakey.pem -pubout capubkey.pem
gmssl certgen -C CN -ST HN -L CS -O XXX -OU dev -CN CA -days 3650 -key cakey.pem -key_usage keyCertSign -pass 123456 -out ca.crt
gmssl certparse -in ca.crt

###server sign
gmssl sm2keygen -pass 123456 -out s_signkey.pem -pubout s_signpubkey.pem
gmssl reqgen -C CN -ST HN -L CS -O XXX -OU dev -CN s_sign -days 3650 -key s_signkey.pem -pass 123456 -out s_signreq.pem
gmssl reqsign -in s_signreq.pem -days 3650 -key_usage digitalSignature -cacert ca.crt -key cakey.pem -pass 123456 -out s_sign.crt
gmssl certparse -in s_sign.crt
###server enc
gmssl sm2keygen -pass 123456 -out s_enckey.pem -pubout s_encpubkey.pem
gmssl reqgen -C CN -ST HN -L CS -O XXX -OU dev -CN s_enc -days 3650 -key s_enckey.pem -pass 123456 -out s_encreq.pem
gmssl reqsign -in s_encreq.pem -days 3650 -key_usage keyEncipherment -cacert ca.crt -key cakey.pem -pass 123456 -out s_enc.crt
gmssl certparse -in s_enc.crt
###client sign
gmssl sm2keygen -pass 123456 -out c_signkey.pem -pubout c_signpubkey.pem
gmssl reqgen -C CN -ST HN -L CS -O XXX -OU dev -CN c_sign -days 3650 -key c_signkey.pem -pass 123456 -out c_signreq.pem
gmssl reqsign -in c_signreq.pem -days 3650 -key_usage digitalSignature -cacert ca.crt -key cakey.pem -pass 123456 -out c_sign.crt
gmssl certparse -in c_sign.crt
###client enc
gmssl sm2keygen -pass 123456 -out c_enckey.pem -pubout c_encpubkey.pem
gmssl reqgen -C CN -ST HN -L CS -O XXX -OU dev -CN c_enc -days 3650 -key c_enckey.pem -pass 123456 -out c_encreq.pem
gmssl reqsign -in c_encreq.pem -days 3650 -key_usage keyEncipherment -cacert ca.crt -key cakey.pem -pass 123456 -out c_enc.crt
gmssl certparse -in c_enc.crt

[-key_usage str]*
根据源码提示找到了，必须取下列值，一个或多个
static const char *x509_key_usages[] = {
"digitalSignature",
"nonRepudiation",
"keyEncipherment",
"dataEncipherment",
"keyAgreement",
"keyCertSign",
"cRLSign",
"encipherOnly",
"decipherOnly",
};