之前在Windows上有用Perl編譯過OpenSSL供鸠,不過只是要用它的兩個靜態(tài)庫戳玫,這次搭一個https server還要用它來生成自簽名證書,其中我的配置文件在openssl/apps/openssl.cnf,編譯后openssl.exe在openssl/out32/openssl.exe,編譯過程可以去網(wǎng)上查篇梭,資料還是挺多的。
OpenSSL默認(rèn)加載配置文件路徑是/usr/local/ssl/openssl.cnf
酝枢,因此在開始前需要先設(shè)定一下'OPENSSL_CONF'環(huán)境變量:
D:\Code\openssl\apps>set OPENSSL_CONF=D:\Code\openssl\apps\openssl.cnf
之后就可以根據(jù)自己的需求來生成密鑰和證書了恬偷,關(guān)于SSL/TLS原理此處也不多贅述,其中包含了多種非對稱加密帘睦、對稱加密算法袍患,下面將羅列生成CA、server竣付、client三方證書的步驟协怒,但對于只做單向鑒定的情況下client證書是不必要的。
CA:
D:\Code\openssl\apps>openssl genrsa -out ies/ca-key.pem 1024
Generating RSA private key, 1024 bit long modulus
.............++++++
.....................++++++
e is 65537 (0x10001)
D:\Code\openssl\apps>openssl req -new -out ies/ca-req.csr -key ies/ca-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shan-Dong
Locality Name (eg, city) []:jinan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:iESLab
Organizational Unit Name (eg, section) []:SK
Common Name (e.g. server FQDN or YOUR name) []:www.iessk.com
Email Address []:sorata_kasugano@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.
D:\Code\openssl\apps>openssl x509 -req -in ies/ca-req.csr -out ies/ca-cert.pem -signkey ies/ca-key.pem -days 3650
Signature ok
subject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.com
Getting Private key
D:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/ca-cert.pem -inkey ies/ca-key.pem -out ies/ca.p12
Enter Export Password:
Verifying - Enter Export Password:
Server:
D:\Code\openssl\apps>openssl genrsa -out ies/server-key.pem 1024
Generating RSA private key, 1024 bit long modulus
......++++++
.++++++
e is 65537 (0x10001)
D:\Code\openssl\apps>openssl req -new -out ies/server-req.csr -key ies/server-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shan-Dong
Locality Name (eg, city) []:jinan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:iESLab
Organizational Unit Name (eg, section) []:SK
Common Name (e.g. server FQDN or YOUR name) []:www.iessk.com
Email Address []:sorata_kasugano@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.
D:\Code\openssl\apps>openssl x509 -req -in ies/server-req.csr -out ies/server-cert.pem -signkey ies/server-key.pem -CA ies/ca-cert.pem -CAkey ies/ca-key.pem -CAcreateserial -days 3650
Signature ok
subject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.com
Getting Private key
Getting CA Private Key
D:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/server-cert.pem -inkey ies/server-key.pem -out ies/server.p12
Enter Export Password:
Verifying - Enter Export Password:
Client:
D:\Code\openssl\apps>openssl genrsa -out ies/client-key.pem 1024
Generating RSA private key, 1024 bit long modulus
......................++++++
...............++++++
e is 65537 (0x10001)
D:\Code\openssl\apps>openssl req -new -out ies/client-req.csr -key ies/client-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shan-Dong
Locality Name (eg, city) []:jinan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:iESLab
Organizational Unit Name (eg, section) []:SK
Common Name (e.g. server FQDN or YOUR name) []:www.iessk.com
Email Address []:sorata_kasugano@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.
D:\Code\openssl\apps>openssl x509 -req -in ies/client-req.csr -out ies/client-cert.pem -signkey ies/client-key.pem -CA ies/ca-cert.pem -CAkey ies/ca-key.pem -CAcreateserial -days 3650
Signature ok
subject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.com
Getting Private key
Getting CA Private Key
D:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/client-cert.pem -inkey ies/client-key.pem -out ies/client.p12
Enter Export Password:
Verifying - Enter Export Password:
過程都是相同的卑笨,先生成1024位的RSA私鑰,然后生成證書請求文件(.csr)仑撞,csr文件經(jīng)CA私鑰簽名后生成公鑰(即X.509證書)赤兴,如果需要的話還可以再把它導(dǎo)出為其他格式比如PKCS#12證書(.p12)。