证书生成
openssl生成证书主要有以下步骤:
1. 生成CA证书
2. 生成Server证书
-
生成CA证书
生成CA私钥
openssl genrsa -out ca.key 2048
生成CA自签名证书
openssl req -new -x509 -days 36500 -key ca.key -out ca.crt
-
生成Server证书
生成server端的私钥key:
openssl genrsa -out server.key 2048
生成server端的req文件(这一步生成的req文件,包含公钥证书,外加身份信息,例如国家,省份,公司等。用它提交给ca,让ca来对它做签名 ):
openssl req -new -key server.key -out server.csr
用CA的私钥对server的req文件做签名,得到server的证书:
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt
nodeos启动
需要配置:
--https-certificate-chain-file /ssl/server.crt \
--https-private-key-file /ssl/server.key \
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 36500 -key ca.key -out ca.crt
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt
nodeos --producer-name eosio \
--signature-provider EOS6MRyAjQq8ud7hVNYcfnVPJqcVpscN5So8BhtHuGYqET5GDW5CV=KEY:5KQwrPbwdL6PhXujxW37FSSQZ1JiwsST4cqQzDeyXtP79zkvFD3 \
--enable-stale-production \
--plugin eosio::chain_api_plugin \
--plugin eosio::producer_api_plugin \
--https-server-address 0.0.0.0:443 \
--https-certificate-chain-file /ssl/server.crt \
--https-private-key-file /ssl/server.key \
--http-server-address 0.0.0.0:8888
curl https://127.0.0.1:443/v1/chain/get_info --insecure
cleos --no-verify -u https://127.0.0.1:443 get info
curl 使用选项--cacert ca.crt --capath /root/ssl 指定CA证书。
curl https://127.0.0.1:443/v1/chain/get_info --cacert ca.crt --capath /root/ssl -vvv
* Trying 127.0.0.1:443...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: ca.crt
CApath: /root/ssl
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=nd; ST=nd; L=nd; O=nd; OU=nd; CN=127.0.0.1; emailAddress=nd
* start date: Feb 21 09:45:27 2023 GMT
* expire date: Feb 18 09:45:27 2033 GMT
* common name: 127.0.0.1 (matched)
* issuer: C=ca; ST=ca; L=ca; O=ca; OU=ca; CN=ca; emailAddress=ca
* SSL certificate verify ok.
> GET /v1/chain/get_info HTTP/1.1
> Host: 127.0.0.1
> User-Agent: curl/7.68.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Connection: close
< Content-Length: 636
< Content-type: application/json
< Server: WebSocket++/0.7.0
<
* Closing connection 0
* TLSv1.3 (OUT), TLS alert, close notify (256):
{"server_version":"02a237a8","chain_id":"cf057bbfb72640471fd910bcb67639c22df9f92470936cddc1ade0e2f2e7dc4f","head_block_num":445,"last_irreversible_block_num":444,"last_irreversible_block_id":"000001bcb249e0c288339eb1407a694f17f5bdb2bf6f78f439222bfc7bc3caea","head_block_id":"000001bdd45c8807b846438005dbbef8f35cf936d1505bebef906d0ef1bd4b2e","head_block_time":"2023-02-21T09:51:10.000","head_block_producer":"eosio","current_view":0,"target_view":1,"last_stable_checkpoint_block_num":0,"virtual_block_cpu_limit":311576,"virtual_block_net_limit":1634747,"block_cpu_limit":199900,"block_net_limit":1048576,"server_version_string":"v3.0.9"}