openssl smime 加密邮件 和发送邮件

概述

非对称加密, 通常是RSA加密, 由公开密匙和私人密匙两部分组成, 公开密匙可用于分发给公众,或者是所有需要参与验证签名,或发送加邮件的人员. 邮件可以通过签名,来证明这邮件的确是由签名者发出, 签名需要用私人密匙, 接收者通过用公开密匙来验证邮件是否有发件人的签名.但邮件内容不会加密. 加密邮件需要用收信人的公开密匙来加密邮件, 加了密的邮件只能用对应的私人密钥解密, 其它有收件人公开密钥的人员并不能用公开密钥来解密邮件,从而实现加密的目的. 

用到的软件

系统: Raspberry PI

加密: openssl

邮件发送: msmtp

MacOS

james@testpi:~/smime $ uname -a
Linux testpi 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr  3 17:24:16 BST 2023 aarch64 GNU/Linux
james@testpi:~/smime $ openssl version
OpenSSL 1.1.1w  11 Sep 2023
james@testpi:~/smime $ msmtp --version
msmtp version 1.8.11
Platform: aarch64-unknown-linux-gnu
TLS/SSL library: GnuTLS
Authentication library: GNU SASL; oauthbearer: built-in
Supported authentication methods:
plain scram-sha-1 external gssapi cram-md5 digest-md5 login ntlm oauthbearer
IDN support: enabled
NLS: enabled, LOCALEDIR is /usr/share/locale
Keyring support: Gnome
System configuration file name: /etc/msmtprc
User configuration file name: /home/james/.config/msmtp/config

Copyright (C) 2020 Martin Lambers and others.
This is free software.  You may redistribute copies of it under the terms of
the GNU General Public License <http://www.gnu.org/licenses/gpl.html>.
There is NO WARRANTY, to the extent permitted by law.
james@testpi:~/smime $

Debian相关基本概念

Debian/linux是用于邮件加密的软件是openssl. 可以用它完成: 1)生成自己的密钥对. 2) 对密钥对进行加密. 3) 对密钥的文件格式进行转换. 4)对邮件进行签名加密. 5)对邮件进行验证与解密 

Debian 生成密码

james@testpi:~/test02 $ openssl genrsa -out leohzhuicloud.pem 4096

james@testpi:~/test $ head leohzhuicloud-key.pem
-----BEGIN RSA PRIVATE KEY-----
MIIJJwIBAAKCAgEA0kiGmTSQA0AneKEKeg9Z7WXSL9wApMHZbZzOcMCk7fDx6DsV
+GdvS46TaW/7UPAFxz4YrYYbfTA+AuBEF+SIfGa2INi26CaKrre+PhixTzXosCqz
Rg1M7HdOfZKlIiXxq7BiXHPkQnoGWDsjJ3c2PbiRuIG5ybAO4qFALeJJQBURFldq
jr3HAz0YFr9x9NOyuCp9eUkDMLJgW/nfGu5K+PT2BzxYDrK3jjX7h5PtdMunqRv/
+YUjX7kv7D4FfCj+lEFKcW8SabP9I1z6+N6zlkXU+VwABVt4A0ikgA8SgvzYHqD8

Debian 生成CSR

james@testpi:~/test02 $ openssl req -new -key leohzhuicloud-key.pem -subj "/CN=leohzhuicloud" -out leohzhuicloud-csr.pem

james@testpi:~/test $ head leohzhuicloud-csr.pem
-----BEGIN CERTIFICATE REQUEST-----
MIIEXTCCAkUCAQAwGDEWMBQGA1UEAwwNbGVvaHpodWljbG91ZDCCAiIwDQYJKoZI
hvcNAQEBBQADggIPADCCAgoCggIBANJIhpk0kANAJ3ihCnoPWe1l0i/cAKTB2W2c
znDApO3w8eg7Ffhnb0uOk2lv+1DwBcc+GK2GG30wPgLgRBfkiHxmtiDYtugmiq63
vj4YsU816LAqs0YNTOx3Tn2SpSIl8auwYlxz5EJ6Blg7Iyd3Nj24kbiBucmwDuKh

 Debian从来自Mac的PEM证书分离证书与私匙

导出证书

james@testpi:~/test $ openssl pkcs12 -in leohzhuicloud.p12 -out leohzhuicloudcert.pem -clcerts -nokeys
Enter Import Password:
james@testpi:~/test $ head leohzhuicloudcert.pem
Bag Attributes
    friendlyName: leohzhuicloud
    localKeyID: 23 01 3E 3F 54 0D AC 83 F2 3D F3 A7 A6 46 5A A9 9F 52 C5 C1
subject=CN = leohzhuicloud, C = CN, emailAddress = my@icloud.email.address

issuer=CN = james\E7\9A\84CA, C = CN, emailAddress = my@CA.email.address

-----BEGIN CERTIFICATE-----
MIIEmzCCAoOgAwIBAgIEU2jZgTANBgkqhkiG9w0BAQsFADBGMRMwEQYDVQQDDApq
YW1lc+eahENBMQswCQYDVQQGEwJDTjEiMCAGCSqGSIb3DQEJARYTamFtZXMuaC56

私匙

james@testpi:~/test $ openssl pkcs12 -in leohzhuicloud.p12 -out leohzhuicloud-key-01.pem  -nocerts
Enter Import Password:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
james@testpi:~/test $ head leohzhuicloud-key-01.pem
Bag Attributes
    friendlyName: leohzhuicloud
    localKeyID: 23 01 3E 3F 54 0D AC 83 F2 3D F3 A7 A6 46 5A A9 9F 52 C5 C1
Key Attributes: <No Attributes>
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIFRHruntZf/gCAggA
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECABB0a78wFD7BIIEyNPEL6qTJLB+

去除证书或私匙中的密码

james@testpi:~/test $ openssl rsa -in leohzhuicloud-key-01.pem -out leohzhuicloud-key-01-.pem
Enter pass phrase for leohzhuicloud-key-01.pem:
writing RSA key
james@testpi:~/test $ head leohzhuicloud-key-01-.pem
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEA3/p/ihnUCL4G5rNOfYwb93LOAsNLGPgSN/tKI7AbCjb/yEHT
uiwDKyWJcTiQ0VvZ+4YUVSSemwVsuGUNnMb27SvnJHNYZKTzWEFwQjR0ly8ZQNdJ

Debian生成加密邮件

james@testpi:~/test $ openssl smime -encrypt -in message.txt -out message.txt.encrypt -text -from my@icloud.email.address -to my@icloud.email.address -des3 leohzhuicloudcert.pem
james@testpi:~/test $ head message.txt.encrypt
To: my@icloud.email.address
From: my@icloud.email.address
MIME-Version: 1.0
Content-Disposition: attachment; filename="smime.p7m"
Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
Content-Transfer-Encoding: base64

MIIBwQYJKoZIhvcNAQcDoIIBsjCCAa4CAQAxggFqMIIBZgIBADBOMEYxEzARBgNV
BAMMCmphbWVz55qEQ0ExCzAJBgNVBAYTAkNOMSIwIAYJKoZIhvcNAQkBFhNqYW1l

Debian 生成签名邮件

james@testpi:~/test03 $ openssl smime -sign -in ../test/message.txt -out message.txt.sig -signer 13763380496crt.pem -inkey 13763380496.pem -nocerts -nodetach -text -from from@email.address -to to@email.address -subject "test gpg 03"
james@testpi:~/test03 $ head message.txt.sig
To: james.h.zhu@163.com
From: 13763380496@139.com
Subject: test gpg 03
MIME-Version: 1.0
Content-Disposition: attachment; filename="smime.p7m"
Content-Type: application/x-pkcs7-mime; smime-type=signed-data; name="smime.p7m"
Content-Transfer-Encoding: base64

MIICzAYJKoZIhvcNAQcCoIICvTCCArkCAQExDzANBglghkgBZQMEAgEFADBCBgkq
hkiG9w0BBwGgNQQzQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluDQoNCmhlbGxvIHdv

 Debian 解密邮件

james@testpi:~/test $ openssl smime -decrypt -in message.txt.encrypt -recip leohzhuicloudcert.pem -inkey leohzhuicloud-key-01-.pem
hello world!
test 01
james@testpi:~/test $

Debian 验证签名邮件

james@testpi:~/test03 $ openssl smime -verify -in message.txt.sig -certfile 13763380496crt.pem -CAfile jamescert.pem
Content-Type: text/plain

hello world!
test 01
Verification successful

Debian发送加密邮件

echo "subject:"hello world"" |msmtp -a 163 my@email.address

 将Mac导出证书的证书转换为PEM证书

james@testpi:~/test03 $ head jamescert.cer
0�a0�I�0*�H��
0F10U

james的CA1
250330020610Z0F10Uu@163.com0�
james@testpi:~/test03 $ openssl x509 -in jamescert.cer -inform der -out jamescert.pem
james@testpi:~/test03 $ head jamescert.pem
-----BEGIN CERTIFICATE-----
MIIFYTCCA0mgAwIBAgIBATANBgkqhkiG9w0BAQsFADBGMRMwEQYDVQQDDApqYW1l
c+eahENBMQswCQYDVQQGEwJDTjEiMCAGCSqGSIb3DQEJARYTamFtZXMuaC56aHVA

 Debian生成可在Mac导入的含秘匙证书

james@testpi:~/test03 $ openssl pkcs12 -inkey 13763380496key.pem -in 13763380496crt.pem -export -out 13763380496key.pfx

james@testpi:~/test03 $ head 13763380496key.pfx
0�
a0�
��	*�H��
�
0�
0��0��0���H��   *�H��
*�H��

Debian 生成可在iphone/Mac导入的公开密钥证书

在Debian发个含签名的邮件, 附上证书, 收件人即可将公开密钥保存.

Mac相关基本概念

Mac用钥匙串访问来管理密钥, iphone在/设置/通用/VPN与设备管理/配置描术文件中管理. 首先需要用证书,可以是来自Debian/Linux发过来的,也可以是直接在Mac上用钥匙串访问生成证书. 有了密钥后,才会在写邮件时, 发件人信箱与密钥相同时,才会有签名项的提示. 有收件人的公开密钥, 才会在写邮件时, 出现加密的提示. 当首次收到含签名的邮件时, 会提示, 需要点击发件人,将证书保存,然后才能发送加密邮件给对方 

Mac 设置证书签发机构

设置证书签发机构的目的是为了对自己生成的证书进行签名, 这样自己生成的证书才能被认为是可信任的.

Mac生成CSR证书

​​​​​​​

Mac作为证书签发机构签发证书

用到的信息: CSR

特注:  如果是选择“让我覆盖此请求的默认值”, 则有可能会重新生成密匙. 有过经历在Debian生成4096位的秘匙, 形成CSR后,在Mac签发的证书密码已被改成2048位, 导致签名后的证书所含的密钥并不是在Debian中生成的密钥,注意注意!

Mac导入证书

Mac查收加密邮件