原文地址：http://www.eussi.top/view/27
KeyTool
public class _01_Keytool {
/**
* passwd:123456
*
1. 构建自签名证书
#构建证书前，生成密钥对，即基于一种非对称加密的公私钥
C:\Users\wangxueming>keytool -genkeypair -keyalg RSA -keysize 2048 -sigalg SHA1withRSA -validity 36000 -alias www.eussi.top -keystore eussi.keystore -storepass 123456 -dname "CN=www.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN"
输入 <www.eussi.top> 的密钥口令
(如果和密钥库口令相同, 按回车):
#上述操作创建了数字证书，虽然还未经过CA认证，但是并不影响使用，我们仍可以导出，发给合作伙伴进行加密交互
C:\Users\wangxueming>keytool -exportcert -alias www.eussi.top -keystore eussi.keystore -file eussi.cer -rfc -storepass 123456
存储在文件 <eussi.cer> 中的证书
#查看证书内容
C:\Users\wangxueming>keytool -printcert -file eussi.cer
所有者: CN=www.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
发布者: CN=www.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
序列号: 16126345
有效期开始日期: Sun Jun 23 11:30:40 CST 2019, 截止日期: Sat Jan 15 11:30:40 CST 2118
证书指纹:
MD5: 86:B7:1B:72:8F:1F:14:34:70:AD:B7:AE:4F:93:A0:F2
SHA1: C2:17:F8:02:73:95:CE:87:5F:B8:0B:15:22:FE:83:DB:62:5E:79:10
SHA256: F6:D7:DD:A9:83:2B:8C:E6:AE:F2:43:5B:93:67:6F:28:94:2F:28:75:B1:DE:FF:35:C5:44:C3:33:34:6A:06:D8
签名算法名称: SHA1withRSA
版本: 3
扩展:
#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 1F EB 76 14 B1 1B 95 AD 94 C7 80 45 15 7F BF 91 ..v........E....
0010: 7A 16 02 7E z...
]
]
2. 构建CA签发证书
#获取CA机构认证的数字证书，需要生成数字签发申请（CSR），经由CA机构认证并颁发，同时将认证后的证书导入本地密钥库和信任库
C:\Users\wangxueming>keytool -certreq -alias www.eussi.top -keystore eussi.keystore -file eussi.csr -V -storepass 123456
存储在文件 <eussi.csr> 中的认证请求
将此提交给您的 CA
#此处我并未提交给CA，只是重新导入一下自己生成的证书，这里会报错，正常情况下，是导入CA下发的证书
C:\Users\wangxueming>keytool -importcert -trustcacerts -alias www.eussi.top -file eussi.cer -keystore eussi.keystore -storepass 123456
keytool 错误: java.lang.Exception: 证书回复与密钥库中的证书是相同的
#导入后便可以查看证书了
C:\Users\wangxueming>keytool -list -alias www.eussi.top -keystore eussi.keystore
输入密钥库口令:
www.eussi.top, 2019-6-23, PrivateKeyEntry,
证书指纹 (SHA1): C2:17:F8:02:73:95:CE:87:5F:B8:0B:15:22:FE:83:DB:62:5E:79:10
#加-V或者-rfc显示更加详细的信息
C:\Users\wangxueming>keytool -list -alias www.eussi.top -keystore eussi.keystore -V -storepass 123456
别名: www.eussi.top
创建日期: 2019-6-23
条目类型: PrivateKeyEntry
证书链长度: 1
证书[1]:
所有者: CN=www.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
发布者: CN=www.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
序列号: 16126345
有效期开始日期: Sun Jun 23 11:30:40 CST 2019, 截止日期: Sat Jan 15 11:30:40 CST 2118
证书指纹:
MD5: 86:B7:1B:72:8F:1F:14:34:70:AD:B7:AE:4F:93:A0:F2
SHA1: C2:17:F8:02:73:95:CE:87:5F:B8:0B:15:22:FE:83:DB:62:5E:79:10
SHA256: F6:D7:DD:A9:83:2B:8C:E6:AE:F2:43:5B:93:67:6F:28:94:2F:28:75:B1:DE:FF:35:C5:44:C3:33:34:6A:06:D8
签名算法名称: SHA1withRSA
版本: 3
扩展:
#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 1F EB 76 14 B1 1B 95 AD 94 C7 80 45 15 7F BF 91 ..v........E....
0010: 7A 16 02 7E z...
]
]
C:\Users\wangxueming>keytool -list -alias www.eussi.top -keystore eussi.keystore -rfc -storepass 123456
别名: www.eussi.top
创建日期: 2019-6-23
条目类型: PrivateKeyEntry
证书链长度: 1
证书[1]:
-----BEGIN CERTIFICATE-----
MIIDXzCCAkegAwIBAgIEFhJjRTANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJDTjELMAkGA1UE
CBMCU0gxCzAJBgNVBAcTAlNIMQ4wDAYDVQQKEwVldXNzaTEOMAwGA1UECxMFZXVzc2kxFjAUBgNV
BAMTDXd3dy5ldXNzaS50b3AwIBcNMTkwNjIzMDMzMDQwWhgPMjExODAxMTUwMzMwNDBaMF8xCzAJ
BgNVBAYTAkNOMQswCQYDVQQIEwJTSDELMAkGA1UEBxMCU0gxDjAMBgNVBAoTBWV1c3NpMQ4wDAYD
VQQLEwVldXNzaTEWMBQGA1UEAxMNd3d3LmV1c3NpLnRvcDCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAOTK7kQEXiKFUaLeX6b7e3Brk1oOOb4TCH8q/MYbsnO3Bqo4/lbVTok1drHk4OUJ
kg/+IzkZNptNFCM5prk/PBVyqGnq4JHgoRr8vTLendGxP+198RdudJf7rZfSQM2IrV1ZEbBqD6Kd
3oiQJQYRCgX9KZmc/zqFLv7ZzoHA7hd0+itlAjby3a+Tl9GPOQz1AA2O/0J8G7KqqJNscCyoEsxL
oIlKeYFOr89e7qDElzaVnmaC62i9ZsOTr/sCXz+AZvb6sWjJiRx4T+iYAa+AM824ojdvVr2ka04M
HH0S1RiaMz8/25cJNBwyCusWaOEmu55Kd66GfhcAr1WKzJaVg78CAwEAAaMhMB8wHQYDVR0OBBYE
FB/rdhSxG5WtlMeARRV/v5F6FgJ+MA0GCSqGSIb3DQEBBQUAA4IBAQAt0+iPcNzs25UWC67kqwGD
nMdRDGfoJqpzVoaFRe7xsWlZ/2RZ9FCMTXAFPEvChY1cPrOUzpqQ6ZoAQqvGPL1jhObGsBqjL51o
1LjSKLAtYHjBMFCldgKSZJLEm8GMqaDFDNlEMaRhQrkrcTXJ22qgv/9SQOObJT0r+Q18H147BsHG
kQnLlRKwGoW++zIWsLaxbTw0kDvwFS1jr+BghqTNdocf0XDBalDsJJ9WsP5GlcfRKT94FRht4+Sr
DdJy33OTpIjv+EoCD7qSC2caPBWwsvGhM5SkRETeNq+Pmju2sDzWKVsaYf7bEjtT/KoXjNN5jVMZ
3jDPs6jx0QGHc6X3
-----END CERTIFICATE-----
#完成以上操作后，我们需要再次导出证书，将上面【-exportcert】证书导出命令，接着便可以将证书发给合作伙伴使用了
#注意，此处的CA认证可以省略，直接使用步骤1里导出的未认证的证书，同样可以实现证书的功能
*/
}
OpenSSL
public class _02_Openssl {
/**
* passwd:123456
*
OpenSSL是一个开源的代码软件包，实现了SSL及相关加密技术，时最常用的证书管理工具。
其功能远胜于KeyTool，可用于根证书，服务器证书和客户证书的管理
1. 准备工作
# 配置openssl配置文件
[root@app2 ~]# pwd
/root
[root@app2 ~]# cp /etc/pki/tls/openssl.cnf ./
[root@app2 ~]# grep dir openssl.cnf
dir = /root/TestCa # Where everything is kept
......
[root@app2 ~]# export OPENSSL_CONF=/root/openssl.cnf
#建立CA工作目录，以及一些子目录，用于存放证书，密钥等，最终证书在certs目录中
[root@app2 ~]# mkdir TestCa
[root@app2 ~]# cd TestCa/
[root@app2 TestCa]# mkdir certs #构建已发行证书存放目录
[root@app2 TestCa]# mkdir newcerts #构建新证书存放目录
[root@app2 TestCa]# mkdir private #构建私钥存放目录
[root@app2 TestCa]# mkdir crl #构建证书吊销列表存放目录
#创建一些需要的文件
[root@app2 TestCa]# echo 0>index.txt #构建索引文件
#注意，应该是>index.txt,此文件有值，
#签发客户端证书时：wrong number of fields on line 1 (looking for field 6, got 1, '' left)
[root@app2 TestCa]# echo 01>serial #构建序列号文件
2. 构建根证书
#构建随机数文件
[root@app2 TestCa]# openssl rand -out private/.rand 1000
#构建根证书密钥
[root@app2 TestCa]# openssl genrsa -aes256 -out private/ca.key.pem 2048
Generating RSA private key, 2048 bit long modulus
........................................+++
....................................+++
e is 65537 (0x10001)
Enter pass phrase for private/ca.key.pem:
Verifying - Enter pass phrase for private/ca.key.pem:
#生成根证书签发申请文件
[root@app2 TestCa]# openssl req -new -key private/ca.key.pem -out private/ca.csr -subj "/C=CN/ST=SH/L=SH/O=eussi/OU=eussi/CN=*.eussi.top"
Enter pass phrase for private/ca.key.pem:
#申请文件可以将其发送给CA机构，也可以自行签发根证书
[root@app2 TestCa]# openssl x509 -req -days 10000 -sha1 -extensions v3_ca -signkey private/ca.key.pem -in private/ca.csr -out certs/ca.cer
Signature ok
subject=/C=CN/ST=SH/L=SH/O=eussi/OU=eussi/CN=*.eussi.top
Getting Private key
Enter pass phrase for private/ca.key.pem:
#Openssl产生的证书不能在Java环境直接使用，需要将其转化为PKCS#12编码格式
[root@app2 TestCa]# openssl pkcs12 -export -cacerts -inkey private/ca.key.pem -in certs/ca.cer -out certs/ca.p12
Enter pass phrase for private/ca.key.pem:
Enter Export Password:
Verifying - Enter Export Password:
#keytool工具查看
[root@app2 TestCa]# keytool -list -keystore certs/ca.p12 -storetype pkcs12 -v -storepass 123456
Keystore type: PKCS12
Keystore provider: SunJSSE
Your keystore contains 1 entry
Alias name: 1
Creation date: Jun 23, 2019
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=*.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
Issuer: CN=*.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
Serial number: 895882440522d5af
Valid from: Sun Jun 23 13:18:05 CST 2019 until: Thu Nov 08 13:18:05 CST 2046
Certificate fingerprints:
MD5: 91:4F:72:33:F2:E0:A8:58:98:E6:C6:1A:D0:1D:93:4B
SHA1: 54:71:67:D8:2C:35:98:07:C7:90:87:0C:DB:9B:A5:B9:7E:BB:69:E1
SHA256: 7E:0A:DA:6D:D6:A5:35:03:C9:85:F0:4B:C3:DF:A4:C5:3A:D7:5C:52:D6:0F:AD:1F:64:99:85:18:CF:AB:B3:60
Signature algorithm name: SHA1withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 1
3. 构建服务器证书
#构建私钥
[root@app2 TestCa]# openssl genrsa -aes256 -out private/server.key.pem 2048
Generating RSA private key, 2048 bit long modulus
...........................+++
.......................................................+++
e is 65537 (0x10001)
Enter pass phrase for private/server.key.pem:
Verifying - Enter pass phrase for private/server.key.pem:
#生成服务器签发申请
[root@app2 TestCa]# openssl req -new -key private/server.key.pem -out private/server.csr -subj "/C=CN/ST=SH/L=SH/O=eussi/OU=eussi/CN=www.eussi.top"
Enter pass phrase for private/server.key.pem:
#使用根证书签发服务器证书
[root@app2 TestCa]# openssl x509 -req -days 3650 -sha1 -extensions v3_req -CA certs/ca.cer -CAkey private/ca.key.pem -CAserial ca.srl -CAcreateserial -in private/server.csr -out certs/server.cer
Signature ok
subject=/C=CN/ST=SH/L=SH/O=eussi/OU=eussi/CN=www.eussi.top
Getting CA Private Key
Enter pass phrase for private/ca.key.pem:
#以下同理，转格式，然后查看
[root@app2 TestCa]# openssl pkcs12 -export -clcerts -inkey private/server.key.pem -in certs/server.cer -out certs/server.p12
Enter pass phrase for private/server.key.pem:
Enter Export Password:
Verifying - Enter Export Password:
[root@app2 TestCa]# keytool -list -keystore certs/server.p12 -storetype pkcs12 -v -storepass 123456
Keystore type: PKCS12
Keystore provider: SunJSSE
Your keystore contains 1 entry
Alias name: 1
Creation date: Jun 23, 2019
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=www.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
Issuer: CN=*.eussi.top, OU=eussi, O=eussi, L=SH, ST=SH, C=CN
Serial number: 8b4ad5defd96b19c
Valid from: Sun Jun 23 13:32:23 CST 2019 until: Wed Jun 20 13:32:23 CST 2029
Certificate fingerprints:
MD5: A7:8F:7B:3E:89:1F:A0:71:7F:66:96:B8:91:51:B3:37
SHA1: 04:D1:35:54:27:40:D5:65:66:23:AD:32:18:AF:C3:31:F0:A5:4E:68
SHA256: 8C:64:14:28:AC:5A:37:3D:E6:1B:4B:E6:37:CF:CB:8A:12:34:41:CA:DB:2F:BD:A2:0E:9B:5E:38:3D:AD:7C:1C
Signature algorithm name: SHA1withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 1
*******************************************
*******************************************
4. 构建客户端证书
#构建私钥
[root@app2 TestCa]# openssl genrsa -aes256 -out private/client.key.pem 2048
Generating RSA private key, 2048 bit long modulus
......+++
.................................................................+++
e is 65537 (0x10001)
Enter pass phrase for private/client.key.pem:
Verifying - Enter pass phrase for private/client.key.pem:
#生成客户端签发申请
[root@app2 TestCa]# openssl req -new -key private/client.key.pem -out private/client.csr -subj "/C=CN/ST=SH/L=SH/O=eussi/OU=eussi/CN=eussi"
Enter pass phrase for private/client.key.pem:
#使用根证书签发客户端证书
[root@app2 TestCa]# openssl ca -days 3650 -in private/client.csr -out certs/client.cer -cert certs/ca.cer -keyfile private/ca.key.pem
Using configuration from /root/openssl.cnf
Enter pass phrase for private/ca.key.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 23 05:46:39 2019 GMT
Not After : Jun 20 05:46:39 2029 GMT
Subject:
countryName = CN
stateOrProvinceName = SH
organizationName = eussi
organizationalUnitName = eussi
commonName = eussi
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
E2:DA:CC:8C:DA:08:15:11:BB:96:48:7F:5D:90:E5:30:D2:F4:C1:E6
X509v3 Authority Key Identifier:
DirName:/C=CN/ST=SH/L=SH/O=eussi/OU=eussi/CN=*.eussi.top
serial:89:58:82:44:05:22:D5:AF
Certificate is to be certified until Jun 20 05:46:39 2029 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
#以下同理，转格式，然后查看
[root@app2 TestCa]# openssl pkcs12 -export -inkey private/client.key.pem -in certs/client.cer -out certs/client.p12
Enter pass phrase for private/client.key.pem:
Enter Export Password:
Verifying - Enter Export Password:
*/
}
参考：《JAVA加密与解密的艺术》
3816
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
