这是时间的定义:
START=`date -d "-2 day" "+%d.%m.%y %T"`
SH_END=`date -d "-1 day" "+%d.%m.%y %T"` # 1 day
CA_END=`date -d "+3651 day" "+%d.%m.%y %T"` # 10 years
IM_END=`date -d "+3286 day" "+%d.%m.%y %T"` # 9 years
EE_END=`date -d "+2920 day" "+%d.%m.%y %T"` # 8 years
SH_EXP=`date -d "-1 day" "+%y%m%d%H%M%SZ"` # 1 day
IM_EXP=`date -d "+3286 day" "+%y%m%d%H%M%SZ"` # 9 years
EE_EXP=`date -d "+2920 day" "+%y%m%d%H%M%SZ"` # 8 years
NOW=`date "+%y%m%d%H%M%SZ"`
#生成CA的秘钥及自签名的根证书
pki --gen --type rsa --size 3072 --outform pem > strongswanKey.pem
pki --self --type rsa --in strongswanKey.pem --not-before "${START}" --not-after "${CA_END}" \
--ca --pathlen 1 --dn "C=CH, O=strongSwan Project, CN=strongSwan Root CA" \
--outform pem > strongswanCert.pem
#证书格式装换pem转der
openssl x509 -in strongswanCert.pem -outform der -out strongswanCert.der
#生成RSA的秘钥
pki --gen --type rsa --size 3072 --outform pem > moonKey.pem
#将秘钥格式由pem转der
openssl rsa -in moonKey.pem -outform der -out moonKey.der \
2> /dev/null
# 将moon私钥转换为未加密的pkcs8格式
openssl pkcs8 -in moonKey.pem -nocrypt -topk8 -out moonKey.pem
# 转换moon私钥到v1.5 DES加密PKCS8格式
openssl pkcs8 -in moonKey.pem -nocrypt -topk8 -v1 PBE-MD5-DES \
-passout "pass:nH5ZQEWtku0RJEZ6" -out moonKey.pem
# 将dave私钥转换为v2.0 AES-128加密PKCS#8格式
openssl pkcs8 -in moonKey.pem -nocrypt -topk8 -v2 aes128 \
-passout "pass:OJlNZBx+80dLh4wC6fw5LmBd" -out moonKey.pem
#导出公钥
pki --pub --type rsa --in moonKey.pem --outform pem > moonPub.pem
#为各个主机制作证书
# Generate host certificates
issue_cert 01 carol carol@strongswan.org Research
issue_cert 02 dave dave@strongswan.org Accounting
issue_cert 03 moon moon.strongswan.org
issue_cert 04 sun sun.strongswan.org
issue_cert 05 alice alice@strongswan.org Sales
issue_cert 06 venus venus.strongswan.org
issue_cert 07 bob bob@strongswan.org Research
if [ -z "${4}" ]
then
OU=""
else
OU=" OU=${4},"
fi
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san ${3} \
--serial ${1} --dn "C=CH, O=${PROJECT},${OU} CN=${3}" \
--outform pem > ${HOST_CERT}
#示例:网关路由器
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl http://crl.strongswan.org/strongswan.crl --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
--serial 03 --dn "C=CH, O=strongSwan Project, CN=moon.strongswan.org" \
--outform pem > moonCert.pem
#示例:主机
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl http://crl.strongswan.org/strongswan.crl --type rsa \
--in carolKey.pem --not-before "${START}" --not-after "${EE_END}" --san carol@strongswan.org \
--serial 03 --dn "C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org" \
--outform pem > carolCert.pem
# 为moon创建PKCS12文件
openssl pkcs12 -export -inkey moonKey.pem -in moonCert.pem -name "moon" \
-certfile strongswanCert.pem -caname "strongSwan Root CA" \
-aes128 -passout "pass:kUqd8O7mzbjXNJKQ" > moonCert.p12 2> /dev/null
# 加密 carolKey.pem
openssl rsa -in carolKey.pem -aes128 --passout pass:nH5ZQEWtku0RJEZ6 -out carolKey.pem \
2> /dev/null
openssl rsa -in carolKey.pem -aes192 --passout pass:ITP/H4lSHqGpUGmCpgNDklbzTNV+swjA -out carolKey.pem \
2> /dev/null
openssl rsa -in carolKey.pem -aes256 --passout pass:MeFnDN7VUbj+qU/bkgRIFvbCketIk2wrrs5Ii8297N2v -out carolKey.pem \
2> /dev/null
#撤销证书
pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem --reason "key-compromise" \
--serial 08 > http://crl.strongswan.org/strongswan.crl
# 生成AES-128加密的moon密钥和SHA-224哈希证书
pki --gen --type rsa --size 3072 --outform pem > moonKey.pem
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, OU=SHA-224, CN=moon.strongswan.org" \
--digest sha224 --outform pem > moonCert.pem
# 生成AES-192加密的carol密钥和SHA-384哈希证书
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, OU=SHA-384, CN=moon.strongswan.org" \
--digest sha384 --outform pem > moonCert.pem
# 生成AES-256加密的dave密钥和SHA-512哈希证书
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, OU=SHA-512, CN=moon.strongswan.org" \
--digest sha512 --outform pem > moonCert.pem
# 使用OCSP URI生成另一个carol证书
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san carol@strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, OU=OCSP, CN=carol@strongswan.org" \
--ocsp http://ocsp.strongswan.org:8880 --outform pem > moonCert.pem
# 为strongSwan根CA生成OCSP签名证书
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in ocspKey.pem --not-before "${START}" --not-after "${EE_END}" --san ocsp.strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, OU=OCSP Signing Authority, CN=ocsp.strongswan.org" \
--flag ocspSigning --outform pem > ocspCert.pem
# 生成自签名OCSP签名证书
pki --gen --type rsa --size 3072 --outform pem > ocspKey.pem
pki --self --type rsa --in ocspKey.pem --flag ocspSigning \
--not-before "${START}" --not-after "${CA_END}" --san ocsp.strongswan.org \
--dn "C=CH, O=strongSwan Project, OU=OCSP Self-Signed Authority, CN=ocsp.strongswan.org" \
--outform pem > ocspCert.pem
# 生成winnetou服务器证书
pki --gen --type rsa --size 3072 --outform pem > ${HOST_KEY}
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in winnetouKey.pem --not-before "${START}" --not-after "${EE_END}" --san winnetou.strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, CN=winnetou.strongswan.org" \
--flag serverAuth --outform pem > winnetouCert.pem
# Generate strongSwan EC Root CA
#生成strongSwan EC根CA
pki --gen --type ecdsa --size 521 --outform pem > strongswanKey.pem
pki --self --type ecdsa --in strongswanKey.pem \
--not-before "${START}" --not-after "${CA_END}" --ca \
--dn "C=CH, O=strongSwan Project, CN=strongSwan EC Root CA" \
--outform pem > strongswanCert.pem
#生成dave ECDSA 384位证书
pki --gen --type ecdsa --size 384 --outform pem > daveKey.pem
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --type ecdsa \
--in daveKey.pem --not-before "${START}" --not-after "${EE_END}" --san dave@strongswan.org \
--serial 01 --dn "C=CH, O=strongSwan Project, OU=ECDSA 384 bit, CN=dave@strongswan.org" \
--crl ${ECDSA_CDP} --outform pem > daveCert.pem
PKI秘钥及证书生成管理
最新推荐文章于 2024-06-22 17:24:13 发布
![](https://img-home.csdnimg.cn/images/20240711042549.png)