rust 自签名证书

最新推荐文章于 2024-08-17 07:33:03 发布

摸鱼吧

最新推荐文章于 2024-08-17 07:33:03 发布

阅读量625

点赞数 1

分类专栏： rust 文章标签： rust

本文链接：https://blog.csdn.net/u010704579/article/details/130777940

版权

rust 专栏收录该内容

13 篇文章 0 订阅

订阅专栏

该文介绍了如何利用rcgen库在Rust编程环境中创建自签名的X.509证书，包括设置证书参数如Issuer、Subject和SubjectAlternativeName，以及保存和查看证书的方法。示例代码展示了证书有效期、公钥算法等关键步骤。

摘要由CSDN通过智能技术生成

1. rcgen 包介绍

Rust X.509 certificate generator

2.包应用案例

生成自签名证书

3. 生成自签名证书

3.1 证书生成

主要设置以下字段

Issuer : “rcgen self signed cert”
Subject: “rcgen self signed cert”
Subject Alternative Name 可设置 DNS 或 IPAddress

Cargo.toml 配置添加以下相关的包

[dependencies]
rcgen = "0.10.0"
rsa = "0.9.2"
rand = "0.8.5"
ring = "0.16.20"
pem = { version = "2.0.1" }
time = { version = "0.3", features = ["macros", "local-offset"] }

代码部分

mod x509m {
    use rand::rngs::OsRng;
    use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, SanType};
    use rcgen::{Certificate, KeyUsagePurpose};
    use rsa::{pkcs8::EncodePrivateKey, RsaPrivateKey};
    use std::net::{IpAddr, Ipv4Addr};
    use time::ext::NumericalDuration;
    use time::OffsetDateTime;
    pub fn generate_self_signed_cert_with_privkey(
    ) -> Result<(String, Vec<u8>, String, Vec<u8>), Box<dyn std::error::Error>> {
        let ip = Ipv4Addr::new(127, 0, 0, 1);
        let ip_san = SanType::IpAddress(IpAddr::V4(ip));
        let mut params = CertificateParams::default();
        // Add the SAN we want to test the parsing for
        params.subject_alt_names.push(ip_san.clone());		// "Subject Alternative Name"
        // Because we're using a function for CA certificates
        params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
        params.not_before = OffsetDateTime::now_local().unwrap();			// 当前时间
        params.not_after = params.not_before.checked_add(365.days()).unwrap();	// 当前时间 + 365 , 即有效期一年
        params.distinguished_name = DistinguishedName::new();
        // params
        //     .distinguished_name
        //     .push(DnType::OrganizationName, "Crab widgits SE"); // O = Crab widgits SE
        params
            .distinguished_name
            .push(DnType::CommonName, "rcgen self signed cert"); // CN = 127.0.0.1
        params.key_usages.push(KeyUsagePurpose::KeyCertSign);
        params.alg = &rcgen::PKCS_RSA_SHA256;
        let mut rng = OsRng;
        let bits = 2048;
        let private_key = RsaPrivateKey::new(&mut rng, bits)?;
        let private_key_der = private_key.to_pkcs8_der()?;
        let key_pair = rcgen::KeyPair::try_from(private_key_der.as_bytes()).unwrap();
        params.key_pair = Some(key_pair);
        let cert = Certificate::from_params(params)?;
        let pem_serialized = cert.serialize_pem()?;
        let pem = pem::parse(&pem_serialized)?;
        let der_serialized = pem.contents();
        Ok((
            pem_serialized,
            der_serialized.to_vec(),
            cert.serialize_private_key_pem(),
            cert.serialize_private_key_der(),
        ))
    }
}

3.2 保存自签名证书

let (cert_pem, cert_der, priv_pem, priv_der) =
        x509m::generate_self_signed_cert_with_privkey().unwrap();

    std::fs::create_dir_all("certs/")?;
    std::fs::write("certs/cert.pem", cert_pem.as_bytes())?;
    std::fs::write("certs/cert.der", &cert_der)?;
    std::fs::write("certs/key.pem", priv_pem.as_bytes())?;
    std::fs::write("certs/key.der", &priv_der)?;

3.3 查看生成的证书内容

u@u:~$ openssl x509 -in certs/cert.der -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8277049082790534457 (0x72ddfc498033dd39)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = rcgen self signed cert
        Validity
            Not Before: May 20 01:19:11 2023 GMT
            Not After : May 19 01:19:11 2024 GMT
        Subject: CN = rcgen self signed cert
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a5:d6:bd:27:60:3c:50:e5:b2:75:13:1e:9b:ea:
                    2c:c4:14:a8:02:ee:87:26:db:52:6a:0d:49:40:53:
                    30:17:10:bd:73:65:38:35:7d:d5:6b:fd:7d:98:eb:
                    1a:54:0e:84:e4:6c:60:a6:26:6a:19:a5:ff:b1:9b:
                    1f:cb:b1:05:55:55:a5:7b:b9:20:7e:78:7d:a2:73:
                    9e:cc:33:ef:5f:cf:50:96:78:f1:c6:44:74:f9:d9:
                    20:35:c1:0a:d4:e6:46:d9:49:b7:3f:27:63:67:af:
                    8c:9f:26:d4:11:24:39:9b:d0:38:ee:1e:93:f3:bd:
                    80:70:35:8d:ef:5b:ff:bc:cd:54:58:74:1d:fb:e4:
                    2c:17:c3:0a:40:4f:75:01:a3:98:e1:ed:77:c9:2f:
                    3a:34:ab:d5:f3:73:c5:17:41:c9:c4:18:6c:c8:2b:
                    ee:63:15:0c:b4:b9:5d:3a:fb:3f:a3:29:0e:05:a0:
                    98:70:53:24:e3:65:87:ba:92:d0:b8:ce:8b:58:df:
                    c7:45:66:45:89:2a:30:5a:55:d5:72:48:c8:f8:47:
                    91:5d:89:1b:d8:05:f5:f2:e5:af:08:9f:40:4a:91:
                    b9:93:89:e2:7b:d3:d3:15:95:aa:86:6e:39:30:17:
                    a0:62:3a:16:35:02:65:65:64:d1:5c:c0:e0:af:84:
                    0d:93
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                IP Address:127.0.0.1
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Subject Key Identifier: 
                39:DD:33:80:49:FC:DD:72:72:9D:AD:2B:CF:F6:2C:03:D8:B8:C5:B4
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        01:ee:1c:d5:4d:06:d6:ad:9d:58:59:9d:b4:be:85:e2:96:6b:
        5e:00:be:9a:3e:54:c6:93:ee:90:30:74:7e:ed:cd:44:cb:c0:
        f3:97:4c:45:17:17:e6:eb:3e:69:b7:77:62:8d:b5:8e:46:84:
        09:36:d5:44:bd:7d:f5:8a:f1:12:45:2f:40:ad:83:e8:84:8e:
        a4:fc:93:7b:8b:16:06:eb:30:0d:d6:b8:5a:dc:a8:f5:63:15:
        53:cd:be:81:9e:2a:fb:c7:70:66:f2:d3:5d:46:a6:be:cf:d9:
        49:0b:66:05:d5:b6:a2:08:76:41:06:69:87:cb:46:5c:d6:41:
        6e:f2:92:ae:69:e8:38:14:c1:82:80:b6:ae:8c:24:f7:d4:9d:
        7f:53:8b:18:79:06:21:ac:58:bf:bb:c5:01:44:2a:1f:e3:37:
        dd:da:76:36:71:60:31:69:d3:8b:a8:39:e3:32:80:eb:26:22:
        c9:a6:76:10:cb:11:9b:78:41:50:2d:c1:2e:78:8d:54:98:04:
        ac:88:1f:58:b2:fb:cc:32:9e:37:62:a8:a6:40:e8:c4:ac:b9:
        f8:19:24:4a:76:2e:69:88:6f:b9:1c:1c:17:45:7d:2c:c5:00:
        ab:a5:83:f4:54:79:aa:e8:68:1d:7a:a2:cb:25:89:47:1b:7b:
        48:cb:89:d4