openssl基本原理及生成证书
1. 基本原理
参考：http://www.cnblogs.com/phpinfo/archive/2013/08/09/3246376.html
https://blog.csdn.net/oldmtn/article/details/52208747
OpenSSL初接触的人恐怕最难的在于先理解各种概念
公钥/私钥/签名/验证签名/加密/解密/非对称加密
我们一般的加密是用一个密码加密文件,然后解密也用同样的密码.这很好理解,这个是对称加密.而有些加密时,加密用的一个密码,而解密用另外一组密码,这个叫非对称加密,意思就是加密解密的密码不一样.初次接触的人恐怕无论如何都理解不了.其实这是数学上的一个素数积求因子的原理的应用,如果你一定要搞懂,百度有大把大把的资料可以看,其结果就是用这一组密钥中的一个来加密数据,可以用另一个解开.是的没错,公钥和私钥都可以用来加密数据,相反用另一个解开,公钥加密数据,然后私钥解密的情况被称为加密解密,私钥加密数据,公钥解密一般被称为签名和验证签名.
因为公钥加密的数据只有它相对应的私钥可以解开,所以你可以把公钥给人和人,让他加密他想要传送给你的数据,这个数据只有到了有私钥的你这里,才可以解开成有用的数据,其他人就是得到了,也看懂内容.同理,如果你用你的私钥对数据进行签名,那这个数据就只有配对的公钥可以解开,有这个私钥的只有你,所以如果配对的公钥解开了数据,就说明这数据是你发的,相反,则不是.这个被称为签名.
实际应用中,一般都是和对方交换公钥,然后你要发给对方的数据,用他的公钥加密,他得到后用他的私钥解密,他要发给你的数据,用你的公钥加密,你得到后用你的私钥解密,这样最大程度保证了安全性.
RSA/DSA/SHA/MD5
非对称加密的算法有很多,比较著名的有RSA/DSA ,不同的是RSA可以用于加/解密,也可以用于签名验签,DSA则只能用于签名.至于SHA则是一种和md5相同的算法,它不是用于加密解密或者签名的,它被称为摘要算法.就是通过一种算法,依据数据内容生成一种固定长度的摘要,这串摘要值与原数据存在对应关系,就是原数据会生成这个摘要,但是,这个摘要是不能还原成原数据的,嗯….,正常情况下是这样的,这个算法起的作用就是,如果你把原数据修改一点点,那么生成的摘要都会不同,传输过程中把原数据给你再给你一个摘要,你把得到的原数据同样做一次摘要算法,与给你的摘要相比较就可以知道这个数据有没有在传输过程中被修改了.
实际应用过程中,因为需要加密的数据可能会很大,进行加密费时费力,所以一般都会把原数据先进行摘要,然后对这个摘要值进行加密,将原数据的明文和加密后的摘要值一起传给你.这样你解开加密后的摘要值,再和你得到的数据进行的摘要值对应一下就可以知道数据有没有被修改了,而且,因为私钥只有你有,只有你能解密摘要值,所以别人就算把原数据做了修改,然后生成一个假的摘要给你也是不行的,你这边用密钥也根本解不开.
CA/PEM/DER/X509/PKCS
一般的公钥不会用明文传输给别人的,正常情况下都会生成一个文件,这个文件就是公钥文件,然后这个文件可以交给其他人用于加密,但是传输过程中如果有人恶意破坏,将你的公钥换成了他的公钥,然后得到公钥的一方加密数据,不是他就可以用他自己的密钥解密看到数据了吗,为了解决这个问题,需要一个公证方来做这个事,任何人都可以找它来确认公钥是谁发的.这就是CA,CA确认公钥的原理也很简单,它将它自己的公钥发布给所有人,然后一个想要发布自己公钥的人可以将自己的公钥和一些身份信息发给CA,CA用自己的密钥进行加密,这里也可以称为签名.然后这个包含了你的公钥和你的信息的文件就可以称为证书文件了.这样一来所有得到一些公钥文件的人,通过CA的公钥解密了文件,如果正常解密那么机密后里面的信息一定是真的,因为加密方只可能是CA,其他人没它的密钥啊.这样你解开公钥文件,看看里面的信息就知道这个是不是那个你需要用来加密的公钥了.
实际应用中,一般人都不会找CA去签名,因为那是收钱的,所以可以自己做一个自签名的证书文件,就是自己生成一对密钥,然后再用自己生成的另外一对密钥对这对密钥进行签名,这个只用于真正需要签名证书的人,普通的加密解密数据,直接用公钥和私钥来做就可以了.
密钥文件的格式用OpenSSL生成的就只有PEM和DER两种格式,PEM的是将密钥用base64编码表示出来的,直接打开你能看到一串的英文字母,DER格式是二进制的密钥文件,直接打开,你可以看到……..你什么也看不懂!.X509是通用的证书文件格式定义.pkcs的一系列标准是指定的存放密钥的文件标准,你只要知道PEM DER X509 PKCS这几种格式是可以互相转化的.
如下图所示：
2. 生成证书
参考：http://zctya.blog.163.com/blog/static/1209178201251310292958/
一、生成CA证书
一般我们都不会使用第三方权威机构的CA来认证，自己充当CA的角色。（就我知道的阿里云服务器可以提供免费的证书，申请一个CA证书很贵）
这里的前提是先安装好了openssl，这里就不多说了，根据自己的操作系统选择对应的安装方式即可。以下我以我的Ubuntu 16.04为例：
1.创建私钥
openssl genrsa -out ca/ca-key.pem 1024
loon@loon-virtual-machine:~/work/test_openssl$ mkdir ca
loon@loon-virtual-machine:~/work/test_openssl$ openssl genrsa -out ca/ca-key.pem 1024
Generating RSA private key, 1024 bit long modulus
.....................++++++
.........++++++
e is 65537 (0x10001)2.创建证书请求
openssl req -new -out ca/ca-req.csr -key ca/ca-key.pem
loon@loon-virtual-machine:~/work/test_openssl$ openssl req -new -out ca/ca-req.csr -key ca/ca-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:123
Organizational Unit Name (eg, section) []:wss
Common Name (e.g. server FQDN or YOUR name) []:loon
Email Address []:2453419889@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1993
An optional company name []:1233.自签署证书
openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -days 3650
loon@loon-virtual-machine:~/work/test_openssl$ openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -days 3650
Signature ok
subject=/C=cn/ST=shanghai/L=shanghai/O=123/OU=wss/CN=loon/emailAddress=2453419889@qq.com
Getting Private key4.将证书导出成浏览器支持的.p12格式
openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12
loon@loon-virtual-machine:~/work/test_openssl$ openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12
Enter Export Password:
Verifying - Enter Export Password:二、生成server证书。
1.创建私钥
openssl genrsa -out server/server-key.pem 1024
loon@loon-virtual-machine:~/work/test_openssl$ mkdir server
loon@loon-virtual-machine:~/work/test_openssl$ openssl genrsa -out server/server-key.pem 1024
Generating RSA private key, 1024 bit long modulus
.++++++
.++++++
e is 65537 (0x10001)2.创建证书请求
openssl req -new -out server/server-req.csr -key server/server-key.pem
注意：Common Name (e.g. server FQDN or YOUR name) []:127.0.0.1 这里一定要填服务器的ip地址，否则ssl验证客户端连接的服务器host与这里不一致时就会报错match不通过。
loon@loon-virtual-machine:~/work/test_openssl$ openssl req -new -out server/server-req.csr -key server/server-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:123
Organizational Unit Name (eg, section) []:wss
Common Name (e.g. server FQDN or YOUR name) []:127.0.0.1
Email Address []:2453419889@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1993
An optional company name []:1233.自签署证书
openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -signkey server/server-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
loon@loon-virtual-machine:~/work/test_openssl$ openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -signkey server/server-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
Signature ok
subject=/C=cn/ST=shanghai/L=shanghai/O=123/OU=wss/CN=127.0.0.1/emailAddress=2453419889@qq.com
Getting Private key
Getting CA Private Key4.将证书导出成浏览器支持的.p12格式
openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12
loon@loon-virtual-machine:~/work/test_openssl$ openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12
Enter Export Password:
Verifying - Enter Export Password:三、生成client证书。
1.创建私钥
openssl genrsa -out client/client-key.pem 1024
loon@loon-virtual-machine:~/work/test_openssl$ mkdir client
loon@loon-virtual-machine:~/work/test_openssl$ ls
ca client server
loon@loon-virtual-machine:~/work/test_openssl$ openssl genrsa -out client/client-key.pem 1024
Generating RSA private key, 1024 bit long modulus
..++++++
.................++++++
e is 65537 (0x10001)2.创建证书请求
openssl req -new -out client/client-req.csr -key client/client-key.pem
loon@loon-virtual-machine:~/work/test_openssl$ openssl req -new -out client/client-req.csr -key client/client-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:123
Organizational Unit Name (eg, section) []:wss
Common Name (e.g. server FQDN or YOUR name) []:loon
Email Address []:2453419889@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1993
An optional company name []:1233.自签署证书
openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -signkey client/client-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
loon@loon-virtual-machine:~/work/test_openssl$ openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -signkey client/client-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
Signature ok
subject=/C=cn/ST=shanghai/L=shanghai/O=123/OU=wss/CN=loon/emailAddress=2453419889@qq.com
Getting Private key
Getting CA Private Key4.将证书导出成浏览器支持的.p12格式
openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12
loon@loon-virtual-machine:~/work/test_openssl$ openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12
Enter Export Password:
Verifying - Enter Export Password:请一定严格根据里面的步骤，之后我们主要在程序中会使用以下的文件：
/ca/ca-cert.pem
/server/server-cert.pem
/server/server-key.pem
/client/client-cert.pem
/client/client-key.pem3.wss使用结果
我使用wss程序测试，文件结构：
loon@loon-virtual-machine:~/work/lws_wss_demo/demo$ tree
.
├── ca
│ ├── ca-cert.pem
│ ├── ca-cert.srl
│ ├── ca-key.pem
│ ├── ca.p12
│ └── ca-req.csr
├── client
│ ├── client
│ ├── client.c
│ ├── client-cert.pem
│ ├── client-key.pem
│ ├── client.p12
│ ├── client-req.csr
│ └── compile.sh
└── server
├── compile.sh
├── server
├── server.c
├── server-cert.pem
├── server-key.pem
├── server.p12
└── server-req.csr
3 directories, 19 filesserver：
loon@loon-virtual-machine:~/work/lws_wss_demo/demo/server$ ./server
[2018/09/11 20:44:47:0557] NOTICE: Creating Vhost 'default' port 8000, 1 protocols, IPv6 off
[2018/09/11 20:44:47:0571] NOTICE: Using SSL mode
[2018/09/11 20:44:47:0595] NOTICE: SSL ECDH curve 'prime256v1'
[2018/09/11 20:44:47:0613] NOTICE: lws_tls_client_create_vhost_context: doing cert filepath ./server-cert.pem
[2018/09/11 20:44:47:0625] NOTICE: Loaded client cert ./server-cert.pem
[2018/09/11 20:44:47:0634] NOTICE: lws_tls_client_create_vhost_context: doing private key filepath
[2018/09/11 20:44:47:0644] NOTICE: Loaded client cert private key ./server-key.pem
[2018/09/11 20:44:47:0649] NOTICE: created client ssl context for default
[2018/09/11 20:44:47:0650] NOTICE: vhost default: cert expiry: 3648d
Client connect!
recvied message:你好 1ANJKErMMOeAl0=
recvied message:你好 2ANJKErMMOeAl0=
recvied message:你好 3ANJKErMMOeAl0=client:
loon@loon-virtual-machine:~/work/lws_wss_demo/demo/client$ ./client
[2018/09/11 20:46:21:7389] NOTICE: Creating Vhost 'default' (serving disabled), 1 protocols, IPv6 off
[2018/09/11 20:46:21:7399] NOTICE: lws_tls_client_create_vhost_context: doing cert filepath ./client-cert.pem
[2018/09/11 20:46:21:7407] NOTICE: Loaded client cert ./client-cert.pem
[2018/09/11 20:46:21:7412] NOTICE: lws_tls_client_create_vhost_context: doing private key filepath
[2018/09/11 20:46:21:7419] NOTICE: Loaded client cert private key ./client-key.pem
[2018/09/11 20:46:21:7427] NOTICE: created client ssl context for default
[2018/09/11 20:46:21:7476] NOTICE: Connected to server ok!
[2018/09/11 20:46:21:7483] NOTICE: Tx: 你好 1
[2018/09/11 20:46:21:7494] NOTICE: Tx: 你好 2
[2018/09/11 20:46:21:7502] NOTICE: Rx: 你好 1
[2018/09/11 20:46:21:7506] NOTICE: Tx: 你好 3
[2018/09/11 20:46:21:7513] NOTICE: Rx: 你好 2
[2018/09/11 20:46:21:7513] NOTICE: Rx: 你好 3
2471
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
