Https中相关证书的关系

Https中相关证书的关系

Https中相关证书的关系图：

PEM

pem 是一种容器格式，它其中可以包含certificate 或者包含公钥的证书链，或者 私钥。
它可以用各种后缀（.PEM, .key .cer, .cert,…)
典型的PEM 文件

• key.pem 包含私钥
• cert.pem 包含证书信息

pem 格式

pem 由 header，body，footer构成的单元组成，即一个pem文件可以有一个或多个这种单元。header和body 是可视的字符，字符表示这个单元的类型。
例如

---BEGIN CERTIFICATE REQUEST----  
---END CERTIFICATE REQUEST----

第一行是header，第二行是footer，两行之间是body，body是用base64编码的不可读字符，上边的单元表示含有CSR(证书申请）的PEM 格式

---BEGIN RSA PRIVATE KEY----  
---END RSA PRIVATE KEY----

表示含有私钥的PEM 格式单元

---BEGIN CERTIFICATE-------
---END CERTIFICATE---------

表示含有证书文件的格式
如果pem文件包含ssl证书链，它的格式如下

---BEGIN CERTIFICATE----
//end-user
---END CERTIFICATE----
---BEGIN CERTIFICATE----
//intermediate
---END CERTIFICATE-----
---BEGIN CERTIFICATE----
//root
---END CERTIFICATE-----

生成私钥

openssl genrsa -out private_key_in_pkcs1.pem 512

内容

-----BEGIN PRIVATE KEY-----
MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAxTbcl7JmDGbwzzpl
ejqQtQmpQfLd6aG/uINbpGkeQsN0PYjX1sLMrRda+gg4feIqlFQGYCcdUtf7v3Cz
L+tUqwIDAQABAkEAvLRLDWgpl1Jkt5VEBlnFn0TYTP9L8cLQxYgDh2UCDJR0Rilo
2sNV+uuIrKaltU3FzS8ByVxaIx6Ha79fP4/0SQIhAPB8zpHdG9xP4n4oa+s0Rc/a
u7H0yegxTM+2t8JXs9OdAiEA0e9639isktg3wjSIX97fKFMRUHp59BKi4li3hjSs
SucCIBal6l5aUHFjJJV1ARTZi2mT0/FieFFhszYsowmucMURAiAe4ubnDA/Hwvvh
HK17vWSDoEUJ3BsZJ6zDNF475n/6vQIhAM0fEr+/TeWIRwUY4NbP6SV3BKc6w3S0
8m94jiojVtRD
-----END PRIVATE KEY-----

base64编码的每一行都是64个字符，最后一行小于64
PKCS1是专门用于RSA 算法的格式。PKCS8可以用于各种算法。
将PKCS1 转换为PKCS8

openssl pkcs8 -topk8 -in private_key_in_pkcs1.pem -outform pem -nocrypt -out private_key_in_pkcs8.pem

pub格式

pub也是pem 格式后缀的一种用来保存公钥
生成公钥

openssl rsa -in private_key_in_pkcs8.pem -pubout > public.pub

-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMU23JeyZgxm8M86ZXo6kLUJqUHy3emh
v7iDW6RpHkLDdD2I19bCzK0XWvoIOH3iKpRUBmAnHVLX+79wsy/rVKsCAwEAAQ==
-----END PUBLIC KEY-----

CSR

csr后缀文件是pem的一种后缀类型 表示证书签名申请(certificate signing request)

crt

crt 后缀文件是证书文件（certificate)

创建CA 并生成CA证书

1. 生成CA （验证中心）私钥

openssl genrsa -out ca.key 2048

cat ca.key                                                                        
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCw2J+sJC6felBN
zCgT+34/2WU9Y0pyLs2kDn51pHb7ePXVeSOdLvZKqaVg8vtC6ARkfNLYfFZtA3Gf
kkcH250VrTtZf3arwKTjz9qc2fLfQAK3RmlqYQdW9F/iNFpxQhj7BuOscYPZsVbM
9i0s1724rzBFMrV/V0TNRybEel5OveQoe5ZYR2sPV/utwfB9xQ3A48FZJCgXQD1X
0NoYqmQYfYIui2Py53AFJeNfk/5WTte/7UmsQDJE1CNuA2TCpjSSclXJByvzXwEG
s2wHSnS3ejof54lDhgS/02enzEzEggFQ1RaWAKMjbRviQ3lQviRj/pQz3ZaqxR4v
a8x9k33vAgMBAAECggEAVVWydtZeyQW0ilXhYQMSQK0edSjcW4zKHkgALbRW1bHg
rknuLYLjxdNmwgl9xSNAO10gQOZ+rcvjoCRtshT/D96vrNgc43PqHSPHUbi5wZCZ
vuZzJ6n6aLMzMWwh2FUUyMziP+vmu70fLXf9BI52NhATMtDtU61Ave1/f3+s0kFw
HFWmZGWUneGR9caHeFKqYNqsaRMcajyXDUDWKiscRZ7Q9BErwQqlNx28lRq8yBr0
MdzPZJy4U3t8Cv1Wut+Dqo/glQDy/pHhCGZvkcVGyikj7/UG/kX9GyZtH4+4Z53J
cJXqjKmSECITVH4yILiclSqQ/n21jQzoMRFikSE7AQKBgQC6d1FRRD0+G6Rv39tl
pRmWmjtpp7fCvDv3g+hTd01x1b1X9zuGwk+lIQynXIzrDKRA3cR3l3HiK6t0tQnf
px1Gvp9bIZ4lCVMmkWO3TCwpmcmTJ2ypbDMo7p3H6K14cnYnjzSAosx4OIscO2mL
Cwv69yTGNSZkLRkwZVOpUPfLUQKBgQDyyvVF9+a+P1tXznq82eIJe3QaRPPlaM15
ffiwP03/yjSd2xM/zYWLSBDJGljaZ5aLH2pIpaSRHdsJuVohHW1aSQND7H9vLumZ
GJP22aVx6Y7cxzBoZSyv5mwmh8Z+5/uFtbdrxQ+F9SVzld8fb0ATKlkjuttNFdcE
aErha+nlPwKBgQCiqcHbZe8TBiQtoBgRlLQ8x/D6W2AX1gNuCbkbTuDVZELXwQpB
pbK695jFSxx3U8DaAVwJg6jKR5Q7rE6ft3X3qAT2B96gqoDKDVzyotWHuOu6nlLR
fV0n4PjtUpI5l4hxPCDt8pbybUkVaNLKg+mAliaTbfw+uYTWzh3sf4Ca8QKBgBAI
pzn/rRVTScz6rdBa8zp9FKXHd/Pmf+tODmZVR+lkiSUDmrnT8MXJ9JHTU5rYzHBT
mslBZyTOO/DgdLtLHjWgLL8Hl0LYbkTWAq+CoBJtwimCXggG5nSXWv0QamNnHo0t
+vb7BJNsJRUFCL8isbCSU2Cwrlrg3lpEKO3KGqAxAoGAHv5joeaVpzW4SL/Qpmx2
ZEQchEjqn6+CFR+sl+2xIjKeYngyZmjU3PhGMjSJv3nCMNOMmHVN5TX+7zhfhOVB
8xXeC591gamcuZA1UpAljaS0RN+8Sgfn5S3bBCofuk9z94XEk7tJsTkgCdb3Hf6Q
/YfsjTfgEZXB0M58bwVA4sA=
-----END PRIVATE KEY-----

2. 生成CA x509证书

openssl req -x509 -new -nodes \
     -key ca.key -sha256 \
     -days 1825 -out ca.crt

cat ca.crt
-----BEGIN CERTIFICATE-----
MIIEBTCCAu2gAwIBAgIUcmYvAp6eEyhCOAW6QKvIg52qy/UwDQYJKoZIhvcNAQEL
BQAwgZExCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZWaW5uZWExFTATBgNVBAcMDERl
ZmF1bHQgQ2l0eTESMBAGA1UECgwJYW1iYXJlbGxhMRIwEAYDVQQLDAlhbWJhcmVs
bGExDjAMBgNVBAMMBWtkb25nMSIwIAYJKoZIhvcNAQkBFhNrZG9uZ0BhbWJhcmVs
bGEuY29tMB4XDTIyMDkxNjA0MjgxNFoXDTI3MDkxNTA0MjgxNFowgZExCzAJBgNV
BAYTAlVTMQ8wDQYDVQQIDAZWaW5uZWExFTATBgNVBAcMDERlZmF1bHQgQ2l0eTES
MBAGA1UECgwJYW1iYXJlbGxhMRIwEAYDVQQLDAlhbWJhcmVsbGExDjAMBgNVBAMM
BWtkb25nMSIwIAYJKoZIhvcNAQkBFhNrZG9uZ0BhbWJhcmVsbGEuY29tMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsNifrCQun3pQTcwoE/t+P9llPWNK
ci7NpA5+daR2+3j11XkjnS72SqmlYPL7QugEZHzS2HxWbQNxn5JHB9udFa07WX92
q8Ck48/anNny30ACt0ZpamEHVvRf4jRacUIY+wbjrHGD2bFWzPYtLNe9uK8wRTK1
f1dEzUcmxHpeTr3kKHuWWEdrD1f7rcHwfcUNwOPBWSQoF0A9V9DaGKpkGH2CLotj
8udwBSXjX5P+Vk7Xv+1JrEAyRNQjbgNkwqY0knJVyQcr818BBrNsB0p0t3o6H+eJ
Q4YEv9Nnp8xMxIIBUNUWlgCjI20b4kN5UL4kY/6UM92WqsUeL2vMfZN97wIDAQAB
o1MwUTAdBgNVHQ4EFgQUydTWsn0rWUKNC2ZXlo6h2Q6B0XMwHwYDVR0jBBgwFoAU
ydTWsn0rWUKNC2ZXlo6h2Q6B0XMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
AQsFAAOCAQEAcdlL7ILakncrwl0L/B6U+dq03r8De+gNqNGLzclR/Fi6kqxuTN1/
yj5TeaUnQ5VBLXNr52gjvHbNABalPF3TRVULq+wWuEN9LZnhuHFvu//ZpadMg1/x
1yl8eX9Q/JGdUEimiGEU/vLrL7ZWqPbg5QGwi+WHGupVt2pF2IsG3WCJL2PV1lgh
PPhGKY7vxSc1aXvEhhYpkbKcaj4JIdEOB/3qaficz2OflZ93RarvfhZu4tWFHJxL
EKjPX+G27APEBBcTvm2BM+n4pWJ1WL9pPV/NNg/bAYepdtRUSGyVyPYWUWeWAzhX
xLTYhlfOaofYAhqmNKMZ3nHrWSGbcnP5kg==
-----END CERTIFICATE-----

为服务器生成SSL certificate

1. 创建server 私钥

openssl genrsa -out server.key 2048

cat server.key
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNWtb6Z5MLlL/F
z67RBbDKaTx0sGC0FiAjxBWIXL+isPTfeYGe//bmOC2Sul4R+Js3rKRj63FSRG0d
QoZqKVxk7K01izvsIYy2ZWv52X+ap8Lj71c7MUaI7yhHoFJTy5QqvdEMX64Z3pDK
Tb71J5PjgYbSjGCJ39q20DSqtTXZB8Qsy7q9Q4AXpoDTmEeWbauucXEYnu7ptn3p
MkRUK0+gX+/L3cww58QoLZDqj4pLk3n6ZjJszGM/S9HMnw0RbG/I25Bqo0uyZvSF
LCkbTZ828xa0KI6MPjKgqUmAvXWCieHrXx6FPqOC28rsM7MKit0IXuyKh9klLh9N
1EokPqspAgMBAAECggEAZeznFC1xckeX8eZVtiCVcbnPDHn43Zm3xRjPuTmT0nvz
ZrJH8HPKh9UtZY0EIPZckEMr6v5S5krZP7MjxTCXT+6bQB7GFLtIPMXVVJMsP0Zy
OLE0gkhAYroVq4t7IWVDuv0w8+vPnb527jqtg7/rqvnAweN0DSrjQ2bPJUXBHuFU
JdGa8IiwSErs3h9by+8Hxtibf7fAYaFbA/kE7NmcKmyiDW9EN3b7HPJDWDPxlt7o
4kVPY6e5/bjPelmXnEI1upZsL0NATryACKHQ5bUb+EMhtjNzjfqEYSvOS2BSY6UW
x1X3hzsD7PYLzwfWtFU9PdJrt4Le9RUVQcKHUTp4wwKBgQDUJ871Dvn9Bt0sNEXX
A16K6/rP0znJhJqI4k/GeEGJAWOfWVoORTl8mH9GKgQvpWjINSuc3306SHlRRnyz
g0jupcvychgfgkkdbAkdzeHqoOLB/IQjF/FnzDl7z6Yz2rgUDJVDxteHokGsC9JS
2MOTjjlIyaymy2/r5/QZzaO22wKBgQD3yz02vY3SPvpYApCuMcVwddZ88MRMPASZ
BxbN8gYTitgHmhQhyRMiHMGBHlZFvmwUmsvM8gZgfNCcllJ/uduqv1Kx74dvDT/8
csIIuo7mFO6CfJ2mRn/z1srXGVQP5cjKJ/1UVIHhqLechE/P3F+ZUWoZxdFN52Qo
PU+33a0bSwKBgH1Y29U8OQV/RbP1WoI0EmrgC/s4YH8o4qkXlWy85nONJ5Ahmayu
x81OyHvrHTgNccBAcfkornN+GHelvs3NNo0R1lLziD8tmgdRKn26g809q1xT1rpp
Tg82wYveXuNqSbJG0PYPiI4xlr2Q6n5aZgtLT5sq1OBjeEgYbsfEEQNbAoGBAJfX
G4CSsPf3jXImyD9l0kWyf6d55d+NG4gmFuxF9UE+YFhwKwv06duKYWzciSMdp58M
p/vDBvNTKIX7ezw3SIsdx++vBn+fT+lC7PFqWCxXATxGXlhIdRmXMh6Sr7c6KErw
LETjr972guTPExUdRhtuDyUR2cryEqaxw0q49N13AoGAJ40yMagXUI8prlbPVfrC
bG8o7dmPUDRsRhZhFPPUa49HgE5QfHudiWfN6+/3GoudHx0UlPnXsEX+Rd2PzlMO
zTTBQVOsilQgUCsAZxgSviDJ2bsG49SHkDxzIeNItIlQCIWMDby0HGbZK8VGBuPS
XxvTi+mw9WZH2Ue/YQRrwX0=
-----END PRIVATE KEY-----

2. 使用配置文件生成签名申请csr
   配置文件 csr.conf

cat > csr.conf <<EOF
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C = US
ST = California
L = San Fransisco
O = Scriptcrunch
OU = Scriptcrunch Dev
CN = scriptcrunch.com

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = scriptcrunch
DNS.2 = scriptcrunch.com
IP.1 = 10.34.12.5
IP.2 = 10.34.12.5

EOF

3. 使用配置文件 和私钥生成签名申请

openssl req -new -key server.key -out server.csr -config csr.conf

cat server.csr      
-----BEGIN CERTIFICATE REQUEST-----
MIIDFTCCAf0CAQAwgYcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
MRYwFAYDVQQHDA1TYW4gRnJhbnNpc2NvMRUwEwYDVQQKDAxTY3JpcHRjcnVuY2gx
GTAXBgNVBAsMEFNjcmlwdGNydW5jaCBEZXYxGTAXBgNVBAMMEHNjcmlwdGNydW5j
aC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNWtb6Z5MLlL/F
z67RBbDKaTx0sGC0FiAjxBWIXL+isPTfeYGe//bmOC2Sul4R+Js3rKRj63FSRG0d
QoZqKVxk7K01izvsIYy2ZWv52X+ap8Lj71c7MUaI7yhHoFJTy5QqvdEMX64Z3pDK
Tb71J5PjgYbSjGCJ39q20DSqtTXZB8Qsy7q9Q4AXpoDTmEeWbauucXEYnu7ptn3p
MkRUK0+gX+/L3cww58QoLZDqj4pLk3n6ZjJszGM/S9HMnw0RbG/I25Bqo0uyZvSF
LCkbTZ828xa0KI6MPjKgqUmAvXWCieHrXx6FPqOC28rsM7MKit0IXuyKh9klLh9N
1EokPqspAgMBAAGgSDBGBgkqhkiG9w0BCQ4xOTA3MDUGA1UdEQQuMCyCDHNjcmlw
dGNydW5jaIIQc2NyaXB0Y3J1bmNoLmNvbYcECiIMBYcECiIMBTANBgkqhkiG9w0B
AQsFAAOCAQEAMrq4qw1jg3LJ6IjsrImVtYn/XDh32e6/dDBuTEKltpsv/Fx+57kz
FM4kEhoXHcfBhtJFPW0Fsf3h3N42YFRFmKHvgw3U9I5no03A0FGvIJVtFpLrKVHs
UZpMOcdEqsaJl/Ws1P62eagV72ckx12NwZXT2qtwQhjpuoLMATGGStGp2DLhYOPi
5H9FCSQXQvZsusb0e693w5OrIUgUhPvYiGiOD6gTcUBj02HJriSdDboEIEyl05S3
bgNWM44ShWsOkDNOkNu1LzaaaDEtO45apoTwSvVv5SpNn3xtjhtV5O+sjuiMmC9e
s6eNkFMBGBDHVVFUCHhuLIdNljOUOvTtqA==
-----END CERTIFICATE REQUEST-----

4. 使用ca 私钥，ca证书和server 签名申请生成SSL证书

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
-CAcreateserial -out server.crt -days 10000 \
-extfile csr.conf

cat server.crt 
-----BEGIN CERTIFICATE-----
MIIDozCCAosCFDKxhfsgLXtFmBKL61YfUNnBbW/tMA0GCSqGSIb3DQEBCwUAMIGR
MQswCQYDVQQGEwJVUzEPMA0GA1UECAwGVmlubmVhMRUwEwYDVQQHDAxEZWZhdWx0
IENpdHkxEjAQBgNVBAoMCWFtYmFyZWxsYTESMBAGA1UECwwJYW1iYXJlbGxhMQ4w
DAYDVQQDDAVrZG9uZzEiMCAGCSqGSIb3DQEJARYTa2RvbmdAYW1iYXJlbGxhLmNv
bTAgFw0yMjA5MTYwNDQ0NDhaGA8yMDUwMDIwMTA0NDQ0OFowgYcxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbnNpc2Nv
MRUwEwYDVQQKDAxTY3JpcHRjcnVuY2gxGTAXBgNVBAsMEFNjcmlwdGNydW5jaCBE
ZXYxGTAXBgNVBAMMEHNjcmlwdGNydW5jaC5jb20wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDNWtb6Z5MLlL/Fz67RBbDKaTx0sGC0FiAjxBWIXL+isPTf
eYGe//bmOC2Sul4R+Js3rKRj63FSRG0dQoZqKVxk7K01izvsIYy2ZWv52X+ap8Lj
71c7MUaI7yhHoFJTy5QqvdEMX64Z3pDKTb71J5PjgYbSjGCJ39q20DSqtTXZB8Qs
y7q9Q4AXpoDTmEeWbauucXEYnu7ptn3pMkRUK0+gX+/L3cww58QoLZDqj4pLk3n6
ZjJszGM/S9HMnw0RbG/I25Bqo0uyZvSFLCkbTZ828xa0KI6MPjKgqUmAvXWCieHr
Xx6FPqOC28rsM7MKit0IXuyKh9klLh9N1EokPqspAgMBAAEwDQYJKoZIhvcNAQEL
BQADggEBAGqgzo0gmOqvb0Xbe6cD5/cxyY9Os9/o+GgBSo6nqnzG7LlF9AV5uzbB
TN6yKNI0kXwl12jXY60nJWRVq4Ce6n2IqaRjgumDR7QM+lwdMifZDMxIud9Ruz0u
E0zPWNmgM/k+EDK0fAr2Zzh3RHkhxoBx/yU9jXE5C8I/PPIsGk71MOKuE9KL0Ebl
zCQ8/dese8sbZ0m2OKQ5uYrvp+/dI1+cSTrJUSNkQOBVOmekUqBK5q6IFJMqu1BI
1w/HU/dWzzCfjROw3tgUBzTTPjq0qc3aoUXvF0XXbgNgJrCog+p4j6+QHqXZaZBx
Yg460I3rKbGZpCowiOq7/XE9pgCLUlk=
-----END CERTIFICATE-----