国密docker容器实战

网上大部分国密教程都是基于国密SSL实验室（www.gmssl.cn）提供的国密版OpenSSL，可以与Nginx集成。

但是其声明了 https://gmssl.cn/gmssl/index.jsp 每年年底会自动退出，因此采用Tengine+BabaSSl（https://www.babassl.cn/2022/01/11/BabaSSL-plus-Tengine.html），阿里系来构建国密应用，均为开源，没有限制。（Tengine是阿里维护的nginx，完全兼容nginx语法）

限制
1. 免费版本每年年底失效，程序会自动退出，需更新库，重新链接。请勿用于正式/生产环境，后果自负。
2. 需要正式版本请与我们联系。

• 软件版本,可实现国密/RSA自适应

debian 11.3

tengine:2.3.3

babassl8.3.1

arm64 架构

构建镜像

拉取debian镜像

root@arm-64:~# docker pull debian:11.3

准备容器

root@arm-64:~# docker run -itd --name tengine -p 81:80 -p 442:443 debian:11.3
# 利用腾讯的debian源，把准备好的list移入容器内替换
root@arm-64:~# docker cp /root/sources.list tengine:/etc/apt

sources.list 内容(debian 11)

deb http://mirrors.cloud.tencent.com/debian bullseye main contrib non-free
deb http://mirrors.cloud.tencent.com/debian bullseye-updates main contrib non-free
deb http://mirrors.cloud.tencent.com/debian-security bullseye-security main contrib non-free
deb http://mirrors.cloud.tencent.com/debian bullseye-backports main contrib non-free
deb http://mirrors.cloud.tencent.com/debian bullseye-proposed-updates main contrib non-free

进入容器后，下载编译依赖、下载Tengine、BabaSSL

root@arm-64:~# docker exec -it tengine bash
root@5ad877a818c2:/# cd
root@5ad877a818c2:~# apt update
root@5ad877a818c2:~# apt upgrade -y
# vim 是为了方便
root@5ad877a818c2:~# apt -y install wget gcc make libpcre3 libpcre3-dev zlib1g-dev git vim

# 下载tengine
root@5ad877a818c2:~# git clone https://github.com/alibaba/tengine.git

# 下载babassl https://github.com/BabaSSL/BabaSSL/releases
root@5ad877a818c2:~# wget https://github.com/BabaSSL/BabaSSL/archive/refs/tags/8.3.1.tar.gz
root@5ad877a818c2:~# tar xf 8.3.1.tar.gz

编译Tengine

root@5ad877a818c2:~# cd tengine/

# 注意调整babassl位置，就是之前解压缩的地方
root@5ad877a818c2:~/tengine# ./configure --add-module=modules/ngx_openssl_ntls \
    --with-openssl=/root/BabaSSL-8.3.1 \
    --with-openssl-opt="--strict-warnings enable-ntls" \
    --with-http_ssl_module --with-stream \
    --with-stream_ssl_module --with-stream_sni
    
root@5ad877a818c2:~/tengine# make
root@5ad877a818c2:~/tengine# make install

添加软连接

root@5ad877a818c2:~/tengine# ln -s /usr/local/nginx/sbin/nginx /usr/sbin/

创建证书和子配置文件目录

root@5ad877a818c2:~/tengine# cd /usr/local/nginx/conf/
root@5ad877a818c2:~/tengine# vim nginx.conf
# include /usr/local/nginx/conf/conf.d/*.conf;  #将此条添加到http里

root@5ad877a818c2:/usr/local/nginx/conf# mkdir cert #证书目录
root@5ad877a818c2:/usr/local/nginx/conf# mkdir conf.d #子配置文件目录
root@5ad877a818c2:/usr/local/nginx/conf# exit

制作镜像

#编译好的容器，打包成镜像
root@arm-64:~# docker commit tengine tengine_babassl:2.3.3_8.3.1
#sha256:53951802fa9de8e0c92721d84e1a7040d8504f439d65d12f36552db5e4cdc53c

#编写Dockerfile
root@arm-64:~# cd /opt
root@arm-64:/opt# mkdir tenginefile
root@arm-64:/opt# cd tenginefile/
root@arm-64:/opt/tenginefile# vim Dockerfile

FROM tengine_babassl:2.3.3_8.3.1
EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"]

#制作镜像
root@arm-64:/opt/tenginefile# docker build -t "tengine_babassl:2.3.3_8.3.1_v1" .

#随便启动一次，把数据卷的配置弄出来
root@arm-64:/opt/tenginefile# docker run --name temp -itd -v tengine:/usr/local/nginx tengine_babassl:2.3.3_8.3.1_v1
root@arm-64:/opt/tenginefile# docker rm -f temp 

配置ssl和放入证书

root@arm-64:/opt/tenginefile# cd /var/lib/docker/volumes/
root@arm-64:/var/lib/docker/volumes# cd tengine/_data/conf/cert/
#把以下文件拷入
rsa.dk.crt.pem  rsa.dk.key.pem  sm2.dk.enc.crt.pem  sm2.dk.enc.key.pem  sm2.dk.sig.crt.pem  sm2.dk.sig.key.pem

root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/cert# cd ../conf.d/
root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/conf.d# vim default.conf

#按以下编辑
 server
    {
        listen 443 ssl;
        server_name localhost;
        enable_ntls on;


        ssl_certificate /usr/local/nginx/conf/cert/rsa.dk.crt.pem;
        ssl_certificate_key /usr/local/nginx/conf/cert/rsa.dk.key.pem;

        ssl_sign_certificate /usr/local/nginx/conf/cert/sm2.dk.sig.crt.pem;
        ssl_sign_certificate_key /usr/local/nginx/conf/cert/sm2.dk.sig.key.pem;

        ssl_enc_certificate /usr/local/nginx/conf/cert/sm2.dk.enc.crt.pem;
        ssl_enc_certificate_key /usr/local/nginx/conf/cert/sm2.dk.enc.key.pem;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }

启动最终容器

root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/conf.d# docker run --name tengine_sm --restart=always -itd -p 81:80 -p 442:443 -v tengine:/usr/local/nginx tengine_babassl:2.3.3_8.3.1_v1 

由于我的80 和 443 被占用了，所以换了端口

• 此时，如果用支持国密的浏览器访问https，则显示国密支持
  

• 如果是使用chrome浏览器，则是rsa加密

资源地址

国密双证书生成：

https://www.gmssl.cn/gmssl/index.jsp?go=CA

奇安信国密浏览器下载：

https://www.gmssl.cn/gmssl/Tool_Down?File=qaxbrowser_1.1.32574.52_gmssl.exe