SSL/TLS
HTTP协议与TCP之间的一个可选层,用于数据安全传输。
SSL
TLS
CA证书
服务端/客户端证书
基础信息
基础概念
认证方式![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/a48b72832b741014c05730c7c4bf3d7f.png)
OpenSSL
生成证书
生成pfx证书
https://blog.csdn.net/yiquan_yang/article/details/113250364
生成Nginx证书
生成后需要将Nginx证书目录/etc/cert
映射到证书目录,或则将证书拷贝到该目录,在访问HTTPS时需要将证书加入可信任机构,将ca.pem
改名为ca.crt
后双击安装。PostgreSQL开启SSL也可用这个生成私钥、公钥。以下为生成脚本:
#!/bin/bash
#输出当前执行脚本所在shell进程ID
echo "command_shell_pid=$$"
#HOST="主机地址/名称" #建议用域名或者字符串,用IP好像不能成功
#PASSWORD="密码"
#COUNTRY="CN"
#STATE="省"
#CITY="市"
#ORGANIZATION="公司名称"
#ORGANIZATIONAL_UNIT="Dev"
#COMMON_NAME="$HOST"
#EMAIL="电子邮件地址"
#Docker需要使用的文件
#Server: ca.pem server-cert.pem server-key.pem
#Client: ca.pem client-cert.pem client-key.pem
#获取本地机器IP
machine_physics_net=$(ls /sys/class/net/ | grep -v "`ls /sys/devices/virtual/net/`");
local_ip=$(ip addr | grep "$machine_physics_net" | awk '/^[0-9]+: / {}; /inet.*global/ {print gensub(/(.*)\/(.*)/, "\\1", "g", $2)}' | head -1);
HOST="XXX"
PASSWORD="123456"
COUNTRY="CN"
STATE="GuangDong"
CITY="ShenZhen"
ORGANIZATION="YYY"
ORGANIZATIONAL_UNIT="PST"
COMMON_NAME="ZZZ"
EMAIL="xxx@xxx.com"
# Generate CA key
openssl genrsa -aes256 -passout "pass:$PASSWORD" -out "ca-key.pem" 4096
# Generate CA
openssl req -new -x509 -days 3650 -key "ca-key.pem" -sha256 -out "ca.pem" -passin "pass:$PASSWORD" -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$COMMON_NAME/emailAddress=$EMAIL"
# Generate Server key
openssl genrsa -out "server-key.pem" 4096
# Generate Server Certs.
openssl req -subj "/CN=$COMMON_NAME" -sha256 -new -key "server-key.pem" -out server.csr
#echo "subjectAltName = DNS:$HOST,IP:121.36.100.195,IP:192.168.1.215,IP:127.0.0.1" > extfile.cnf
#只给IP签名
echo "subjectAltName = IP:$local_ip,IP:127.0.0.1" > extfile.cnf
echo "extendedKeyUsage = serverAuth" >> extfile.cnf
openssl x509 -req -days 3650 -sha256 -in server.csr -passin "pass:$PASSWORD" -CA "ca.pem" -CAkey "ca-key.pem" -CAcreateserial -out "server-cert.pem" -extfile extfile.cnf
# Generate Client Certs.
rm -f extfile.cnf
openssl genrsa -out "client-key.pem" 4096
openssl req -subj '/CN=client' -new -key "client-key.pem" -out client.csr
echo extendedKeyUsage = clientAuth >> extfile.cnf
openssl x509 -req -days 3650 -sha256 -in client.csr -passin "pass:$PASSWORD" -CA "ca.pem" -CAkey "ca-key.pem" -CAcreateserial -out "client-cert.pem" -extfile extfile.cnf
#rm -vf client.csr server.csr
#chmod -v 0400 "ca-key.pem" "key.pem" "server-key.pem"
#chmod -v 0444 "ca.pem" "server-cert.pem" "cert.pem"