openssl之带你走CA认证

环境

• 直接安装openssl，最方便的是下载exe双击安装
• 安装之后需添加环境变量，才能全局使用openssl的命令
  • 右击此电脑-属性-高级系统设置-环境变量-系统变量path
  • 例如path添加;C:\Program Files\OpenSSL-Win64\bin

基本概念

首先明确一些概念

• x509证书跟CER证书差不多，一般有PEM格式和DER格式
• 谁签发证书谁当CA,自己签发证书就是自建CA
• 私钥是不外发的，公钥才可外发(用于证书请求等)
• 证书请求pkcs10：DN信息+密钥对中的公钥
• DN信息：即用户信息，到时候在证书中显示,例如/CN=linggo/O=lingg_O/OU=lingg_OU/ST=GuangDong/L=GuangZhou/C=CN
  • ca的为颁发者DN信息，用户的称为使用者DN信息

流程

• 自建CA,可理解为服务端

• 用户,可理解为客户端

• CA根据用户的证书请求颁发x509证书

实现及签发证书

在线转换RSA无密码为带密码保护的

以下流程的均为PEM格式，私钥是无密码的，私钥可导出公钥也可转换为DER格式

• 实现自建CA
  • bat脚本直接执行即可

echo 1.CA生成密钥对[pem文件]
openssl genrsa -out ca_priKey.pem 2048

echo 2.生成p10请求
openssl req -new -key ca_priKey.pem -out ca_pkcs10.pem -subj /CN=gushuai.fun/O=gushuai/OU=linggo/ST=GuangDong/L=GuangZhou/C=CN  -config openssl.cnf

echo 3.CA自签发x509[pem文件]
openssl x509 -req -in ca_pkcs10.pem -out ca_x509.pem -signkey ca_priKey.pem

echo 4.根据密钥对和x509证书生成密码为888888的证书文件p12
openssl pkcs12 -export -clcerts -in ca_x509.pem -inkey ca_priKey.pem -out ca_p12.p12  -passout  pass:888888

@pause

• 用户申请证书
  • bat脚本直接执行即可

echo 1.用户生成密钥对[pem文件]
openssl genrsa -out priKey.pem 2048

echo 1.1.生成p10请求
openssl req -new -key priKey.pem -out pkcs10.pem -subj /CN=linggo/O=lingg_O/OU=lingg_OU/ST=GuangDong/L=GuangZhou/C=CN  -config openssl.cnf

echo 2.使用CA证书及CA密钥 对请求证书进行签发 生成x509证书[pem文件]
openssl x509 -req -in pkcs10.pem -out x509.pem -CA ca_x509.pem -CAkey ca_priKey.pem -CAcreateserial

echo 3.根据密钥对和x509证书生成密码为888888的证书文件p12
openssl pkcs12 -export -clcerts -in x509.pem -inkey priKey.pem -out p12.p12  -passout  pass:888888
@pause

示例

• 示例bat脚本及文件在笔者的GitHub可查看
• 在线解析csr地址
• ca_pkcs10.pem

-----BEGIN CERTIFICATE REQUEST-----
MIICszCCAZsCAQAwbjEUMBIGA1UEAwwLZ3VzaHVhaS5mdW4xEDAOBgNVBAoMB2d1
c2h1YWkxDzANBgNVBAsMBmxpbmdnbzESMBAGA1UECAwJR3VhbmdEb25nMRIwEAYD
VQQHDAlHdWFuZ1pob3UxCzAJBgNVBAYTAkNOMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAt7MSIwy1n6RbB1ZuIlA2OOEpNZzhT+5NIUz3yY3BuLr10fBK
/nVB55B6RapizK7D5M09lzoMPuCO7ziiBorBfY8eW0jVS8BJ871wAqQRdmXxFQSi
7wkE/LUaIkPUPuN5yExi+AbfSdY6WzxktN+Jkjj1iugABywI+WXem2UEHRzMUoDp
Tv8Nk1+9N7LlzcQbOxNLuozKPK/azl3YnzJuinCsnC1kWfYsajPUdxmpye6wEGlw
CExgJv8bopzJhzcgGYIy5n9r+3ZE3A0lu3U7Bg7ujIbVD5mBJM8gnZ1TDMkBzoM8
FM+CajZU55SxWvrbsA/wualuZXf214549uoRJQIDAQABoAAwDQYJKoZIhvcNAQEL
BQADggEBAEr1wex7NKO0RsRgV/G5cwif6stxAkmT14nrkE+kIX4uHYz6YbIR+Dhm
bd0p0ALZTq0ajctEgaSFnGlcceBlifuYr+aan1cWgssJExbGtnhMhqK8ck7DIhjU
JLJZLoaRTHgoxJ/R6/lz7f8R84FeVGPfbTJGQk+VrE6kuDtNay6x+GqHqUsXLWcq
ceU7Sp7iIA3uCt9TiB/8MHoUJ6RX8xRFxybIumL8aJV2PYw6gyWO/gzF2fLRHtuT
oQHuDIY5E3x73VrIvMY+dF3dkzbW+OD1t/f0zKqOGb/S58eDbrjSOSNC1zUrfDwK
G4MhijAS8KCdVY/ymzqtV0QuiHtky5s=
-----END CERTIFICATE REQUEST-----

• ca_priKey.pem

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAt7MSIwy1n6RbB1ZuIlA2OOEpNZzhT+5NIUz3yY3BuLr10fBK
/nVB55B6RapizK7D5M09lzoMPuCO7ziiBorBfY8eW0jVS8BJ871wAqQRdmXxFQSi
7wkE/LUaIkPUPuN5yExi+AbfSdY6WzxktN+Jkjj1iugABywI+WXem2UEHRzMUoDp
Tv8Nk1+9N7LlzcQbOxNLuozKPK/azl3YnzJuinCsnC1kWfYsajPUdxmpye6wEGlw
CExgJv8bopzJhzcgGYIy5n9r+3ZE3A0lu3U7Bg7ujIbVD5mBJM8gnZ1TDMkBzoM8
FM+CajZU55SxWvrbsA/wualuZXf214549uoRJQIDAQABAoIBADunOQKMxAYddzoA
xS77YUBDTgCM+1Xbisx/lA+tqvT0MZOFNrU/GrG55xrsY70YG6EXTSLoxMU+Yuwo
NeVt9btyWGdIVYuN2/X81HznDoymOg2bPdXl1erCXMQ3xprNf+SdeZ4VjTkLClRK
XmGmHaSQPpxnDmtFz3w9qnZH7XgOLykmCzaoAjTU/MmR4Y3sJuadKC3K4LMVb0Os
+KNOtlLUAwIiooZw0PxYNsjKadjnbK4NdopYz4Kw9SJu8XtsvHbv+fL7z27rpT/v
Ar9j7dUyn1OhT6kfjcdwt+TVt3Cx5oYTWALOERWZIZY3p3Vpff3+BGMjYFufbIGo
h5jghNkCgYEA24ACHdwQRzKMLeIktt2LAxCMyBP21NMca8qb9IxG7YtSMi6R13En
4rYiDVG4oS67f7khCYdqIUs7mDaVJdNLbf7tLrsEX6GnE17x3B+95vfmm5uhfLWb
FWDCVdF6a4prkvDF+eXhUzCeZ/K9RyhQqtiBEO7B73+STfI25ZlDEMcCgYEA1j8N
1qzyFaOMcwkRPLnU6E5GV6MuT7O+qVd525ooOv5ehbWkJ7uoNg7lyVjliWufSTL0
JH2q9lR03sbxlFNNNCQB6mqWX3xwklOm1tLAn8B+QKFBsBXfEAuRbmulFAkSsdHO
5FTquLIe8sMfeNxC8QXMGNHocKTMkNlZSu9F+rMCgYATyZJnRrNg97mTWVOd+JLT
j+ZhEwupW+6v+O/eN9cdCvY59+DF3zmNQoYHVVqjjSbx+Kp1xXNX1QRmUGVZp5ah
L94J3GokhNoe8Ow0v9fKvoZXeMwyBd0ZLEPYoK28jBnugS4XvRV2/mcJT+SoSYYc
ILBh6mQpRwLVbARu5kYZeQKBgQCSkPxEmnfaedJBeDiElJSkf7f7iDTMbajHbIJ+
yw0unonHayXr0KMYqERm5BvTUP7dMrB2rkngzpJNPUhTMlGkk+WDmntYw2a3k+aV
HASOxT8Zs7eeYLgC4AcTxSxfcn2JjIC/D6CrzZ8CcJ39LqHVBSRE7oTXWsZfaXF+
pAX5pQKBgQC9sZOVf2ExoSTdDFkOkmuc+goTZ/F4dTTir0WRuQRJ9YsG+Rs9ASqy
ve8KY3M8HCtTkVyQvCX0gXGaTrNcfEafj1aFN64RB7NRqpRg6sUP6X4waFvXWZV+
sAtPrwho8UBtSjt/wjSCrRS9rUB4aY8+xPcPxit56w7yfsxQJzwY/Q==
-----END RSA PRIVATE KEY-----

• ca_x509.pem

-----BEGIN CERTIFICATE-----
MIIDYzCCAksCFEWf+gf7D7EcY5jBRpH+NY1JRAh0MA0GCSqGSIb3DQEBCwUAMG4x
FDASBgNVBAMMC2d1c2h1YWkuZnVuMRAwDgYDVQQKDAdndXNodWFpMQ8wDQYDVQQL
DAZsaW5nZ28xEjAQBgNVBAgMCUd1YW5nRG9uZzESMBAGA1UEBwwJR3VhbmdaaG91
MQswCQYDVQQGEwJDTjAeFw0yMDA0MjQwNjEzNTFaFw0yMDA1MjQwNjEzNTFaMG4x
FDASBgNVBAMMC2d1c2h1YWkuZnVuMRAwDgYDVQQKDAdndXNodWFpMQ8wDQYDVQQL
DAZsaW5nZ28xEjAQBgNVBAgMCUd1YW5nRG9uZzESMBAGA1UEBwwJR3VhbmdaaG91
MQswCQYDVQQGEwJDTjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALez
EiMMtZ+kWwdWbiJQNjjhKTWc4U/uTSFM98mNwbi69dHwSv51QeeQekWqYsyuw+TN
PZc6DD7gju84ogaKwX2PHltI1UvASfO9cAKkEXZl8RUEou8JBPy1GiJD1D7jechM
YvgG30nWOls8ZLTfiZI49YroAAcsCPll3ptlBB0czFKA6U7/DZNfvTey5c3EGzsT
S7qMyjyv2s5d2J8ybopwrJwtZFn2LGoz1HcZqcnusBBpcAhMYCb/G6KcyYc3IBmC
MuZ/a/t2RNwNJbt1OwYO7oyG1Q+ZgSTPIJ2dUwzJAc6DPBTPgmo2VOeUsVr627AP
8LmpbmV39teOePbqESUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEABllZqTcseEZk
l6mSqERQuFAz1cE9Oy7ayJF8SFLjs7GrJJyJZWNJRrFbCMkYpnThKU2NU5pqLKXy
YhgHoBsWMwDo6/0VBE5hUmBuUKDqp1pDbkzqwM36QIh4PqPriwL6srZHxnQ13goz
zNe9LWEnMFIHTiGtVQ0+dqtXDp9Umr865D/crpJltegTa20Q1pWZvaTZo32/rYD8
YaBYm1QwLsJq8YB70stL56il6Fqm4Ol77mRuKMlsfN+2TQp+pepOju+vYN0Z96mH
fAf/rGZYe1hYmFqBkF5VMDaWDzqOpPLcIl2GDxTWCB/AjPsVX54ItCOoTwXRgdJi
3RuulphP/Q==
-----END CERTIFICATE-----

• priKey.pem

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAt4MAJyM1Cnchbfc8R0eS2GtBRXupLygS/dmAqAoCXQQ7q1/R
RZFjz5MCj5mdbYSYZCnNY0McG4cotql+aNCzRGu7D63Pjwjbow3kYl0II5mx9xGA
A+HRAMH7ffnYNjNpka5crL+82oyY9iFeCmpJ7uP/8T12zjvNNQFh3MwpqcXhSCCa
PoTl03KyGTN5C5en82hn+E31zzKqWUwS5tYRoR1eCuWwpn5y8nKmbkS5jUi+k1l7
r43wz8vcJOrPJdKiDQdNaZw9cxTHIRBML5wPXCOOeXnvD+McRlC37vis2GYAp3h8
/57xHGatCUugiAQQ4DWs89ifDLgekpGrS3BxnwIDAQABAoIBABXrW9VQ60D4wdF0
uop5Dh0zknRONQMg8kPH+woXR/j8THRH2aNJnnZoxOGKI7e1Is6z/4hft7fCCSbo
T+UNKJx/kbRpumUHVdTAEAt/uT0nWo58VKIiEujYQsXlVeIDehSgkwk/Tbt9F7gu
fCEaWQJj0WprQQmZMwWlyJ6q9D8G4/5XBhDNubCeb2BFMtcCn9Y0OPrFB8EPYGYU
h0pPY4bJEezME3uImNdcbsxUmuJxRbrDBD/LWgMTkrHHM8YwedNY6+AUyxLcEQe2
qYB3a3lXvI/0qK7ZOdB01VF0dFkwI8WbzPFOQL0lHVXfLISeDrR8PauuL+/L/vEL
9alMBQECgYEA2W6IBVhP02QdzCbRzBzafQRTocqGsCc2AJ/IlBlcRJYHnOqC33vD
SFtRy0mTIBLMpKss5cP+5UB0HFiFbaKlRF6Jpn+uC+WgnqA2+SveQ3pgEsaGj3d8
XClSj7l9N2Pq2VUvZ7AaryS+XMPV5YMI/Pire3hWtsa66PikGaox6+ECgYEA2BAt
TVm4t/eA2fRTLzcHxL4GR9jQvSaC1DDqROQEy2cG0Yw9qDxB5BVzlvcPSXPO5l2e
jj242JgvqaWdDmam4+amfazRtD7dEsuvCDfnygaMN9FCXP7D3gOozy59wSRG7ZNx
rrerbz+LMSvN0esgYaebY9kLAuTtrxeLPXnyDX8CgYBa8CGvqpnoXc0gn3PLnJ28
/9xCpMPkVOH/LNTlLB4tCVqxxFtsQQUR9C+niGQiW/p/PKCQkILBO03UtSlJC2d3
ytpjaq9OhoHBFl0npbNWIY6hC6snwd+fZCEFv5yhWAbXUwt6oGroqcN8ZOPHFCDk
PNTr1Q7fbwqpeaSYn1g1wQKBgFl/ofRXhP+XY2VlIov9RJeHizx5oEWpzSmuNWxh
82Z5/8YPTH8CrtyW0jGnl0p60Sp1fzc2c/osWBnywzLy7JCcuzx1uMvr+lFN0+wY
lEgIHE8GvHGfCm1NoMBpZqf5qfPBTqbr5/SGItc0aOZaeihZcDGU9020nIwZuZC2
kcBrAoGBAMLZ/3PUuXyHpOHuecKHdzygLwDwa4pwDl69G6+M7GvDNWtPzp1SIEVY
QhQVs29EjgeF1vm328OxNasMyyS0YpbkS9esWQv6CtePXEFhNE4ffS0M0GQ5zrE+
Ba/SgwYi1olo3SFYyd+ngIXVQS4FEWxm6UUMf9IndcrPHGtoQyYq
-----END RSA PRIVATE KEY-----

• pkcs10.pem

-----BEGIN CERTIFICATE REQUEST-----
MIICsDCCAZgCAQAwazEPMA0GA1UEAwwGbGluZ2dvMRAwDgYDVQQKDAdsaW5nZ19P
MREwDwYDVQQLDAhsaW5nZ19PVTESMBAGA1UECAwJR3VhbmdEb25nMRIwEAYDVQQH
DAlHdWFuZ1pob3UxCzAJBgNVBAYTAkNOMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAt4MAJyM1Cnchbfc8R0eS2GtBRXupLygS/dmAqAoCXQQ7q1/RRZFj
z5MCj5mdbYSYZCnNY0McG4cotql+aNCzRGu7D63Pjwjbow3kYl0II5mx9xGAA+HR
AMH7ffnYNjNpka5crL+82oyY9iFeCmpJ7uP/8T12zjvNNQFh3MwpqcXhSCCaPoTl
03KyGTN5C5en82hn+E31zzKqWUwS5tYRoR1eCuWwpn5y8nKmbkS5jUi+k1l7r43w
z8vcJOrPJdKiDQdNaZw9cxTHIRBML5wPXCOOeXnvD+McRlC37vis2GYAp3h8/57x
HGatCUugiAQQ4DWs89ifDLgekpGrS3BxnwIDAQABoAAwDQYJKoZIhvcNAQELBQAD
ggEBADKtO2bHIKiEPyAk6iZIOmLkwPSXdyzdEz9akBfNWVA+keh0WXsQfkKabXue
w1ZTjA4gV72G0p4buwbOupxzHCruqqFfv5xW3a6n304SQyc7016sBdX1jJSKHR2W
V98bjm8nsbWpSb5J6ZZjVa7ZiZ1eiUkQPxUPMAqOwltWOUF5Bd/l56frQntaWcny
hf5WVq/WcukUbCkmbhw1YrPc6aKnNHwOfPCHtF8H8t5+BBfmil4KgLM0GbaONYON
pjO0X66i6mw53s+HsW0OZB61ONHEvjp/4ZIVSMSojQb+eWco0UIgFAGxTe1MQsl9
6OYwV9pTA+DJaZyGNBRvrRJym6o=
-----END CERTIFICATE REQUEST-----

• x509.pem

-----BEGIN CERTIFICATE-----
MIIDYDCCAkgCFEWlOxsfyhYhO+pz0DIl7MAq/BpDMA0GCSqGSIb3DQEBCwUAMG4x
FDASBgNVBAMMC2d1c2h1YWkuZnVuMRAwDgYDVQQKDAdndXNodWFpMQ8wDQYDVQQL
DAZsaW5nZ28xEjAQBgNVBAgMCUd1YW5nRG9uZzESMBAGA1UEBwwJR3VhbmdaaG91
MQswCQYDVQQGEwJDTjAeFw0yMDA0MjQwNjEzNTRaFw0yMDA1MjQwNjEzNTRaMGsx
DzANBgNVBAMMBmxpbmdnbzEQMA4GA1UECgwHbGluZ2dfTzERMA8GA1UECwwIbGlu
Z2dfT1UxEjAQBgNVBAgMCUd1YW5nRG9uZzESMBAGA1UEBwwJR3VhbmdaaG91MQsw
CQYDVQQGEwJDTjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALeDACcj
NQp3IW33PEdHkthrQUV7qS8oEv3ZgKgKAl0EO6tf0UWRY8+TAo+ZnW2EmGQpzWND
HBuHKLapfmjQs0Rruw+tz48I26MN5GJdCCOZsfcRgAPh0QDB+3352DYzaZGuXKy/
vNqMmPYhXgpqSe7j//E9ds47zTUBYdzMKanF4Uggmj6E5dNyshkzeQuXp/NoZ/hN
9c8yqllMEubWEaEdXgrlsKZ+cvJypm5EuY1IvpNZe6+N8M/L3CTqzyXSog0HTWmc
PXMUxyEQTC+cD1wjjnl57w/jHEZQt+74rNhmAKd4fP+e8RxmrQlLoIgEEOA1rPPY
nwy4HpKRq0twcZ8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAas/ISwdDeoAjCrB4
df83Av9s6A2LCqJ0CHskQ2WzAoprPu9ush5Yb4pnJYKbbS7Cu9aPacHoC0dWwmRt
4NJbLv4W7GnkiLZR9c/ozKLL4utzuMbMIyv8qqhHwKiCJcVRmracjcka4lvBCDjt
JnRnPzyT8cPFzXVqLO4KH9Zc35Sraord5aZxaOZY22yML1D3o07Psb8DWNWqdd+S
pvWTyV1+VfrBvg7LgL8QwVJzPa1qblpFWRBEayHzIa0kJ6szvv3Yz5wDUxvsRUEk
aPf2bvOo/mx8rnrXTyUilXhODDHPFO8fwBwo6JS60LbZOYjXVW9FCOAOTCuHi/C7
XF66IQ==
-----END CERTIFICATE-----