openssl使用

1. website
SSL(secure Socket Layer)
TLS(transport Layer Security) - SSL3.0基础之上提出的安全通信标准,目前版本是1.0
openssl 主页 -> http://www.openssl.org/
openssl 中文文档 -> http://www.chinaunix.net/jh/13/478901.html

2. 如何编译OpenSSL in Windows?
a) 下载openssl -> openssl-0.9.8i
b) 下载perl -> http://downloads.activestate.com/ActivePerl/Windows/5.8/ActivePerl-5.8.8.822-MSWin32-x86-280952.zip
c) 安装perl -> ActivePerl-5.8.8.822-MSWin32-x86-280952/Installer.bat (之前先运行vcvars32.bat,需要运行perf Configure VC-WIN32来设置环境变量)
d) 使windows支持nmake -> C:\Program Files\Microsoft Visual Studio 10.0\VC\bin\vcvars32.bat
e) 进入openssl路径 -> cd C:\devdiv\openssl-0.9.8i    (工作路径)
f) 创建Makefile文件: ms\do_ms     (出现%osversion% is not defined的错误忽略即可)
g) 编译动态库： nmake -f ms\ntdll.mak
   编译静态库： nmake -f ms\nt.mak

   测试动态库： nmake -f ms\ntdll.mak test
   测试静态库： nmake -f ms\nt.mak test

   安装动态库： nmake -f ms\ntdll.mak install
   安装静态库： nmake -f ms\nt.mak install

   清除上次动态库的编译，以便重新编译： nmake -f ms\ntdll.mak clean
   清除上次静态库的编译，以便重新编译： nmake -f ms\nt.mak clean
  
3. 如何使用openssl?
a) library path -> C:\devdiv\openssl-0.9.8i\out32
b) include path -> C:\devdiv\openssl-0.9.8i\include
c) 库文件 -> libeay32.lib, ssleay32.lib

4. 配置文件在哪里?
C:\devdiv\openssl-0.9.8i\apps\openssl.cnf

5. 关于key:
key一般分为public key和private key,在openssl中,private key中包含了public key的信息,所以public key不需要单独创建. 如何创建一个RSA key?
openssl.exe genrsa -des3 -out privatekey.pem 2048  (需要添加密码保护)
openssl.exe genrsa -out privatekey.pem 2048

6. 关于certificates(证书文件), 如何创建一个证书呢?
一般流程是:
a. 创建一个private key
b. 创建一个certificate signing request(证书请求), 这个需要a#中创建的private key.因为证书中需要包含public key,
创建的priavate key中有这些信息.
(openssl.exe req -new -key privatekey.pem-out cacert.csr)
c. 把创建好的证书请求拿到CA(certificate authority)证书认证机构审批.

7. 如何做一个自签名的证书呢?
openssl.exe req -new -x509 -key privatekey.pem -out cacert.pem -days 1095
(Note: privatekey.pem需要自己创建)

8. Demo: 来自openssl自带的demo,略做修改.
Server:

#include <openssl/rsa.h>       /* SSLeay stuff */
#include <openssl/crypto.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <iostream>
#include <winsock2.h>

#define SERVER_PORT    5003

// certificate & key 的存放路径
// Note: 必须是全路径, 否则SSL_CTX_use_certificate_file等函数
//       无法找到文件在windows平台上.
// How to:
// #privatekey.pem
// openssl.exe genrsa -out privatekey.pem 2048
// #cacert.pem
// openssl.exe req -new -x509 -key privatekey.pem -out cacert.pem -days 1095 -config openssl.cnf
//
#define SERVER_CERTIFICATE   "c:\\config\\cacert.pem"    
#define SERVER_KEY           "c:\\config\\privatekey.pem"

#pragma comment( lib, "ws2_32.lib" )
#pragma comment( lib, "libeay32.lib" )
#pragma comment( lib, "ssleay32.lib" )

int main( int argc, char* argv[] ) {
  int ret;

  
  // 初始化 //
  
  SSL_CTX* ctx;
  SSL_METHOD *meth;

  SSL_load_error_strings();
  SSLeay_add_ssl_algorithms();
  meth = SSLv23_server_method(); 

  ctx = SSL_CTX_new (meth);
  if (!ctx) {
    ERR_print_errors_fp(stderr);
    std::cout<<"SSL_CTX_new error."<<std::endl;
    return -1;
  }
  
  if (SSL_CTX_use_certificate_file(ctx, SERVER_CERTIFICATE, SSL_FILETYPE_PEM) <= 0) {
    ERR_print_errors_fp(stderr);
    std::cout<<"SSL_CTX_use_certificate_file error."<<std::endl;
    return -1;
  }
  if (SSL_CTX_use_PrivateKey_file(ctx, SERVER_KEY, SSL_FILETYPE_PEM) <= 0) {
    ERR_print_errors_fp(stderr);
    std::cout<<"SSL_CTX_use_PrivateKey_file error."<<std::endl;
    return -1;
  }

  if (!SSL_CTX_check_private_key(ctx)) {
    ERR_print_errors_fp(stderr);
    std::cout<<"SSL_CTX_check_private_key error."<<std::endl;
    return -1;
  }

  ///
  // 建立原始的TCP连接 //
  ///
  WSADATA wsaData;
  SOCKET listen_socket;
  SOCKET accept_socket;
  struct sockaddr_in addr_server;
  struct sockaddr_in addr_client;
  int addr_client_len;

  ret = WSAStartup( MAKEWORD(2, 2), &wsaData );
  if ( ret != 0 ) {
    std::cout<<"WSAStartup error."<<std::endl;
    return -1;
  }

  listen_socket = socket (AF_INET, SOCK_STREAM, 0);  
  if( listen_socket == INVALID_SOCKET  ) {
    std::cout<<"socket error."<<std::endl;
    return -1;
  }
  
  memset (&addr_server, 0, sizeof(addr_server));
  addr_server.sin_family           = AF_INET;
  addr_server.sin_addr.S_un.S_addr = INADDR_ANY;
  addr_server.sin_port             = htons (SERVER_PORT);        
  
  ret = bind(listen_socket, (struct sockaddr*)&addr_server, sizeof(addr_server) ); 
  if( ret == SOCKET_ERROR )  {
     std::cout<<"bind error."<<std::endl;
     return -1;
  }
         
  ret = listen (listen_socket, 5); 
  if( ret == SOCKET_ERROR ) {
    std::cout<<"listen error."<<std::endl;
    return -1;
  }
  
  addr_client_len = sizeof(addr_client);
  accept_socket = accept (listen_socket, (struct sockaddr*) &addr_client, &addr_client_len);
  if( accept_socket == INVALID_SOCKET  ) {
    std::cout<<"accept error."<<std::endl;
    return -1;
  }
  closesocket(listen_socket);
  std::cout<<" Connection from "<<addr_client.sin_addr.S_un.S_addr<<":"<<addr_client.sin_port<<std::endl;

  /
  // TCP连接已经建立，执行Server SSL //
  /
  SSL*     ssl;
  X509*    client_certificate;
  char*    str;

  ssl = SSL_new (ctx);                           
  if( ssl == NULL ) {
    std::cout<<"SSL_new error."<<std::endl;
    return -1;
  } 
  SSL_set_fd (ssl, accept_socket);
  ret = SSL_accept (ssl);                     
  if( ret == -1 ) {
    std::cout<<"SSL_accept error."<<std::endl;
    return -1;
  }
  
  // 获取cipher
  std::cout<<"SSL connection using: "<<SSL_get_cipher(ssl)<<std::endl;
  
  // 获取客户端的证书
  client_certificate = SSL_get_peer_certificate (ssl);
  if (client_certificate != NULL) {
    std::cout<<"Client certificate:"<<std::endl;
    
    str = X509_NAME_oneline (X509_get_subject_name (client_certificate), 0, 0);
    if( str == NULL ) {
      std::cout<<"X509_NAME_oneline error."<<std::endl;
    } else {
      std::cout<<"subject: "<<str<<std::endl;
      OPENSSL_free (str);
    }
    
    str = X509_NAME_oneline (X509_get_issuer_name  (client_certificate), 0, 0);
    if( str == NULL ) {
      std::cout<<"X509_NAME_oneline error."<<std::endl;
    } else {
      std::cout<<"issuer: "<<str<<std::endl;
      OPENSSL_free (str);
    }

    X509_free (client_certificate);
  } else {
    std::cout<<"Client does not have certificate. "<<std::endl;
  }

  
  //  数据交换  //
  
  char     buf [4096];

  ret = SSL_read (ssl, buf, sizeof(buf) - 1);    
  if( ret == -1 ) {
    std::cout<<"SSL_read error."<<std::endl;
    return -1;
  }
  buf[ret] = '\0';
  std::cout<<buf<<std::endl;
  
  ret = SSL_write (ssl, "I hear you.", strlen("I hear you.")); 
  if( ret == -1 ) {
    std::cout<<"SSL_write error."<<std::endl;
    return -1;
  }

  /
  // Cleanup //
  /
  closesocket(accept_socket);
  SSL_free (ssl);
  SSL_CTX_free (ctx);
  WSACleanup();
  return 0;
}

Client:

#include <openssl/rsa.h>       /* SSLeay stuff */
#include <openssl/crypto.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
#include <openssl/ssl.h>
#include <openssl/err.h>


#include <iostream>
#include <winsock2.h>

#define SERVER_IP      "127.0.0.1"
#define SERVER_PORT    5003

#pragma comment( lib, "ws2_32.lib" )
#pragma comment( lib, "libeay32.lib" )
#pragma comment( lib, "ssleay32.lib" )


int main( int argc, char* argv[] ) {
  int ret;
  
  // 初始化 //
  
  SSL_CTX* ctx;
  SSL_METHOD *meth;

  SSL_load_error_strings();
  SSLeay_add_ssl_algorithms();
  meth = SSLv23_client_method();

  ctx = SSL_CTX_new (meth);
  if (!ctx) {
    ERR_print_errors_fp(stderr);
    std::cout<<"SSL_CTX_new error."<<std::endl;
    return -1;
  }

  ///
  // 建立原始的TCP连接 //
  ///
  WSADATA wsaData;
  SOCKET client_socket;
  struct sockaddr_in addr_server;

  ret = WSAStartup( MAKEWORD(2, 2), &wsaData );
  if ( ret != 0 ) {
    std::cout<<"WSAStartup error."<<std::endl;
    return -1;
  }
  client_socket = socket (AF_INET, SOCK_STREAM, 0);  
  if( client_socket == INVALID_SOCKET  ) {
    std::cout<<"socket error."<<std::endl;
    return -1;
  }
  
  memset (&addr_server, 0, sizeof(addr_server));
  addr_server.sin_family           = AF_INET;
  addr_server.sin_addr.S_un.S_addr = inet_addr(SERVER_IP);
  addr_server.sin_port             = htons (SERVER_PORT);

  ret = connect(client_socket, (struct sockaddr*) &addr_server, sizeof(addr_server)); 
  if( client_socket == SOCKET_ERROR  ) {
    std::cout<<"connect error."<<std::endl;
    return -1;
  }

  /
  // TCP连接已经建立，执行Client SSL //
  /
  SSL*     ssl;
  X509*    server_certificate;
  char*    str;

  ssl = SSL_new (ctx);                         
  if( ssl == NULL ) {
    std::cout<<"SSL_new error."<<std::endl;
    return -1;
  } 
  SSL_set_fd (ssl, client_socket);
  ret = SSL_connect (ssl);                     
  if( ret == -1 ) {
    std::cout<<"SSL_accept error."<<std::endl;
    return -1;
  }
    
  // 接下来的获取密码和获取服务器端证书的两部是可选的，不会影响数据交换
  
  // 获取cipher
  std::cout<<"SSL connection using: "<<SSL_get_cipher(ssl)<<std::endl;
  
  // 获取服务器端的证书
  server_certificate = SSL_get_peer_certificate (ssl);       
  if( server_certificate != NULL ) {
    std::cout<<"Server certificate:"<<std::endl;

    str = X509_NAME_oneline (X509_get_subject_name (server_certificate),0,0);
    if( str == NULL ) {
      std::cout<<"X509_NAME_oneline error."<<std::endl;
    } else {
      std::cout<<"subject: "<<str<<std::endl;
      OPENSSL_free (str);
    }

    str = X509_NAME_oneline (X509_get_issuer_name  (server_certificate),0,0);
    if( str == NULL ) {
      std::cout<<"X509_NAME_oneline error."<<std::endl;
    } else {
      std::cout<<"issuer: "<<str<<std::endl;
      OPENSSL_free (str);
    }

    X509_free (server_certificate);
  } else {
    std::cout<<"Server does not have certificate. we sould Esc!"<<std::endl;
    return -1;
  }

  
  //  数据交换  //
  
  char     buf [4096];

  ret = SSL_write (ssl, "Hello World!", strlen("Hello World!"));  
  if( ret == -1 ) {
    std::cout<<"SSL_write error."<<std::endl;
    return -1;
  }
  ret = SSL_read (ssl, buf, sizeof(buf) - 1);  
  if( ret == -1 ) {
    std::cout<<"SSL_read error."<<std::endl;
    return -1;
  }
  buf[ret] = '\0';
  std::cout<<buf<<std::endl;
  SSL_shutdown(ssl);  /* send SSL/TLS close_notify */
  
  /
  // Cleanup //
  /
  closesocket(client_socket);
  SSL_free (ssl);
  SSL_CTX_free (ctx);
  WSACleanup();
  return 0;
}
最后的输出结果:
Server-Console:
Connection from 16777343:20314
SSL connection using: AES256-SHA
Client does not have certificate.
Hello World!

Client-Console:
SSL connection using: AES256-SHA
Server certificate:
subject: /C=cn/ST=shanghai/L=shanghai/O=shanghai/OU=shanghai/CN=shanghai/emailAd
dress=ysong.lee@gmail.com
issuer: /C=cn/ST=shanghai/L=shanghai/O=shanghai/OU=shanghai/CN=shanghai/emailAdd
ress=ysong.lee@gmail.com
I hear you.