我是安全和OpenSSL的初学者.我的目标是以编程方式生成证书,通过Chrome所做的“过时”羞辱.我用来生成使用RSA的AES_128_GCM的证书,即使我尝试将密码列表设置为kEECDH:kEDH:!ADH:AES256-SHA256,服务器上下文使用SSL_CTX_new(TLSv1_2_server_method());.
基于the documentation的示例,我尝试了以下方法:
X509 *x = NULL;
EVP_PKEY *pk = NULL;
EVP_PKEY_CTX *ctx = NULL;
EVP_PKEY *params = NULL;
if(NULL == (params = EVP_PKEY_new()))
goto err;
if(1 != EVP_PKEY_set1_DH(params, DH_get_2048_256()))
goto err;
if(!(ctx = EVP_PKEY_CTX_new(params, NULL)))
goto err;
if(!EVP_PKEY_keygen_init(ctx))
goto err;
if(!EVP_PKEY_keygen(ctx, &pk))
goto err;
if ((x=X509_new()) == NULL)
goto err;
X509_set_version(x,2);
X509_set_pubkey(x,pk);
//... (setting the issuer, subject, etc)
//Here is where it fails