go-grpc-2加入证书验证

安装openssl

如果系统有就不用安装了
下载http://slproweb.com/products/Win32OpenSSL.html

下载后双击安装

openssl version -a # 查看openssl版本信息

openssl
genrsa -des3 -out server.key 2048 # 回车后输入4位数字的密码，这里输入的1234

此时当前文件夹下就生成了私钥文件server.key
继续键入

req -new -key server.key -out server.csr # 回车后输入刚才的密码1234

输入国家cn
Common Name填 nan.com
email等不想填写的直接回车，此时就生成了server.csr

 rsa -in server.key -out server_no_passwd.key # 输入刚才的密码1234
 x509 -req -days 365 -in server.csr -signkey server_no_passwd.key -out server.crt # 此时就生成了server.crt

---

生成SAN证书，参考：https://www.cnblogs.com/jackluo/p/13841286.html
https://blog.csdn.net/u010950854/article/details/105667819/

随便找一个地方创建配置文件 example.com.conf

# example.com.conf
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
# 生成v3版本带扩展属性的证书
req_extensions = v3_req

# 设置默认域名
[ req_distinguished_name ]
# Minimum of 4 bytes are needed for common name
commonName         = www.example.com
commonName_default = *.example.com
commonName_max     = 64

# 设置两位国家代码
# ISO2 country code only
countryName         = China
countryName_default = CN

# 设置州 或者 省的名字
# State is optional, no minimum limit
stateOrProvinceName         = Province
stateOrProvinceName_default = Beijing

# 设置城市的名字
# City is required
localityName         = City
localityName_default = Beijing

# 设置公司或组织机构名称
# Organization is optional
organizationName         = Organization
organizationName_default = My Company

# 设置部门名称
# Organization Unit is optional
organizationalUnitName         = Department
organizationalUnitName_default = My Department

# 设置联系邮箱
# Email is optional
emailAddress         = Email
emailAddress_default = email@example.com

# 拓展信息配置
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

# 要配置的域名
[alt_names]
DNS.1 = www.example.com
DNS.2 = *.example.com

创建私钥生成证书

openssl 
genrsa -out example.com.key 2048  # 创建私钥
req -new -nodes -out example.com.csr -key example.com.key -config  example.com.conf  # 生成csr
x509 -req -days 3650 -in example.com.csr -signkey example.com.key -out example.com.cert -extensions v3_req -extfile example.com.conf  # 创建证书
x509 -text -noout -in example.com.cert # 查看证书信息

# 私钥/CSR/证书匹配校验，可以看到下面3条打印结果一样
x509 -noout -modulus -in example.com.cert
rsa -noout -modulus -in example.com.key
req -noout -modulus -in  example.com.csr  # 这一行执行校验，如果出现problem creating object tsa_policy1=1.2.3.4.1，则关闭当前窗口，再开个cmd 从创建私钥的下面req -new ...开始再执行一遍就可以了

把上面生成的证书和密钥放到grpc服务端的文件夹里

把生成的证书放到grpc客户端的文件夹里

package main

import (
	"fmt"
	"log"
	"net/http"
	"test/services"

	"google.golang.org/grpc"
	"google.golang.org/grpc/credentials"
)

func main() {
	creds, err := credentials.NewServerTLSFromFile("keys/example.com.cert", "keys/example.com.key")
	if err != nil {
		log.Fatal(err)
	}

	rpcServer := grpc.NewServer(grpc.Creds(creds))
	services.RegisterProductServiceServer(rpcServer, new(services.ProductService))

	// 方式一：tcp
	// lis, _ := net.Listen("tcp", ":8081")
	// rpcServer.Serve(lis)

	// 方式二：Http
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		fmt.Println("Proto: ", r.Proto) // 使用协议
		fmt.Println("Header:", r.Header)
		fmt.Println("request:", r)
		rpcServer.ServeHTTP(w, r)
	})
	httpServer := &http.Server{
		Addr:    ":8081",
		Handler: mux,
	}
	// httpServer.ListenAndServe() // 无证书方式 // http://localhost:8081/
	httpServer.ListenAndServeTLS("keys/example.com.cert", "keys/example.com.key") // 证书验证 // https://localhost:8081/
}