使用 openssl 获取服务器证书

读取服务器的 CA 证书

Root cert for howsmyssl.com, taken from howsmyssl_com_root_cert.pem

   The PEM file was extracted from the output of this command:
   openssl s_client -showcerts -connect www.howsmyssl.com:443 </dev/null

The CA root cert is the last cert given in the chain of certs.

 openssl s_client -showcerts -connect www.howsmyssl.com:443 </dev/null
CONNECTED(00000005)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.howsmyssl.com
verify return:1
---
Certificate chain
 0 s:CN = www.howsmyssl.com
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
-----BEGIN CERTIFICATE-----
MIIEwTCCA6mgAwIBAgISA0uZFchVNWh0j/Cy7O8TVATWMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0yMDA2MjcwMzIxMzZaFw0y
MDA5MjUwMzIxMzZaMBwxGjAYBgNVBAMTEXd3dy5ob3dzbXlzc2wuY29tMFkwEwYH
KoZIzj0CAQYIKoZIzj0DAQcDQgAEVjhvXj25IMD7uobAP3c0XCi0EN541TdfuhS/
bH4Yrbg/5PHJZPse1HWVvt2VJDI3n+KHJ5eplB45/J4AGY9LqKOCApgwggKUMA4G
A1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYD
VR0TAQH/BAIwADAdBgNVHQ4EFgQUYLj5pJ56RBytnS3XgggtQrMmmEowHwYDVR0j
BBgwFoAUqEpqYwR93brm0Tm3pkVl7/Oo7KEwbwYIKwYBBQUHAQEEYzBhMC4GCCsG
AQUFBzABhiJodHRwOi8vb2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3JnMC8GCCsG
AQUFBzAChiNodHRwOi8vY2VydC5pbnQteDMubGV0c2VuY3J5cHQub3JnLzBNBgNV
HREERjBEgg1ob3dzbXlzc2wuY29tgg1ob3dzbXl0bHMuY29tghF3d3cuaG93c215
c3NsLmNvbYIRd3d3Lmhvd3NteXRscy5jb20wTAYDVR0gBEUwQzAIBgZngQwBAgEw
NwYLKwYBBAGC3xMBAQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5j
cnlwdC5vcmcwggEFBgorBgEEAdZ5AgQCBIH2BIHzAPEAdwBep3P531bA57U2SH3Q
SeAyepGaDIShEhKEGHWWgXFFWAAAAXL0AmJgAAAEAwBIMEYCIQDF/5XTxq2nQG/O
wNJP8LRdvQkEFaLPIEL0jME45UlhqgIhAP5+lBYmhKN0S3i3o3NB+aYSWtTn08vm
hw7hiKi818l7AHYAB7dcG+V9aP/xsMYdIxXHuuZXfFeUt2ruvGE6GmnTohwAAAFy
9AJihgAABAMARzBFAiAvzSjYhgfDrHuRj2uUdc237MSidssgVa4/unOiAW3GGwIh
AJ3d28dedkCbOr003zF8/HrOYTmHZYeMh4zW45cGOT1mMA0GCSqGSIb3DQEBCwUA
A4IBAQBI9PhJD86TQSM2TiUxAMU8Z90DwmtK6ueyZlgyD64h1zTeT7+dZmfzMT5M
+LmUHf3U6G7e6sfvCcxLu0WQm1RFWNfJVxgGPQAMra+jN6D/eiNjcE6B04znR63N
TfAisf+lrXRJXXp/mG56H26b4EuOsgxYOoV6TCr80Im6M4z/twB21NSY4HPNbHgI
Y9pLpJUu/GCPwj+hQQqY2Eh76K1Hw+qZeG3+GDws0cCQPD4LaTNi6WAlnoN9TcLs
hd02zaOFZweuNMiwGEvh5M5sK+fjsiiqoDXI5570cKe99kOu67vq4Ns6dzZKyHff
AKtny+dcACCnydggTe59n1mnxuwT
-----END CERTIFICATE-----
 1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----
---
Server certificate
subject=CN = www.howsmyssl.com

issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2778 bytes and written 404 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-ECDSA-CHACHA20-POLY1305
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-CHACHA20-POLY1305
    Session-ID: 4AEF15852D49C449CCF347918244AD5E0C97C0104E3BE169D2E3A63067BAC05A
    Session-ID-ctx: 
    Master-Key: 216456EE994F2BD13405A5BB9303739D558681F751063410D657BFA5EFE2CBD7404502E18B9C8035CD7B6619F1651F5A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket:
    0000 - b2 a4 5c f2 7b cd ea 1a-4f 72 95 de da 76 3d bf   ..\.{...Or...v=.
    0010 - 2e 2e d7 b1 da 62 c9 b2-9d 46 3f 0c e9 0a 32 dc   .....b...F?...2.
    0020 - db 11 86 83 7a c3 68 27-12 a6 e6 08 3d 16 cd 1f   ....z.h'....=...
    0030 - a3 82 be 01 54 62 3d 07-07 d3 e0 2f 38 e2 34 c3   ....Tb=..../8.4.
    0040 - 39 02 1e a2 7c 97 e8 5e-0e e2 33 0c a1 35 bf 97   9...|..^..3..5..
    0050 - ef 30 71 04 9a 9d 3f 33-2e 74 6e 5b 15 1e 59 ba   .0q...?3.tn[..Y.
    0060 - 3d ba 8f b5 8c 45 b3 84-68 5c ca 48 fe b9 6b 79   =....E..h\.H..ky
    0070 - 94 d5 3a 9b fe b8 bf 14-                          ..:.....

    Start Time: 1594612004
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
DONE

生成服务器的 CA 证书

参考 mqtt_ssl_demo
参考 https_request_demo

# 生成服务器的 CA 证书
 openssl s_client -showcerts -connect www.howsmyssl.com:443 | sed -n "1,/Root/d; /BEGIN/,/END/p" | openssl x509 -outform PEM >howsmyssl_com_root_cert.pem

esp_tls_conn_http_new