OpenSSL生成HTTPS自簽名證書

之前在Windows上有用Perl編譯過OpenSSL供鸠,不過只是要用它的兩個靜態(tài)庫戳玫,這次搭一個https server還要用它來生成自簽名證書,其中我的配置文件在openssl/apps/openssl.cnf,編譯后openssl.exe在openssl/out32/openssl.exe,編譯過程可以去網(wǎng)上查篇梭,資料還是挺多的。
OpenSSL默認(rèn)加載配置文件路徑是/usr/local/ssl/openssl.cnf酝枢,因此在開始前需要先設(shè)定一下'OPENSSL_CONF'環(huán)境變量:

D:\Code\openssl\apps>set OPENSSL_CONF=D:\Code\openssl\apps\openssl.cnf

之后就可以根據(jù)自己的需求來生成密鑰和證書了恬偷,關(guān)于SSL/TLS原理此處也不多贅述,其中包含了多種非對稱加密帘睦、對稱加密算法袍患,下面將羅列生成CA、server竣付、client三方證書的步驟协怒,但對于只做單向鑒定的情況下client證書是不必要的。

CA:

D:\Code\openssl\apps>openssl genrsa -out ies/ca-key.pem 1024
Generating RSA private key, 1024 bit long modulus
.............++++++
.....................++++++
e is 65537 (0x10001)

D:\Code\openssl\apps>openssl req -new -out ies/ca-req.csr -key ies/ca-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shan-Dong
Locality Name (eg, city) []:jinan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:iESLab
Organizational Unit Name (eg, section) []:SK
Common Name (e.g. server FQDN or YOUR name) []:www.iessk.com
Email Address []:sorata_kasugano@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.

D:\Code\openssl\apps>openssl x509 -req -in ies/ca-req.csr -out ies/ca-cert.pem -signkey ies/ca-key.pem -days 3650
Signature ok
subject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.com
Getting Private key

D:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/ca-cert.pem -inkey ies/ca-key.pem -out ies/ca.p12
Enter Export Password:
Verifying - Enter Export Password:

Server:

D:\Code\openssl\apps>openssl genrsa -out ies/server-key.pem 1024
Generating RSA private key, 1024 bit long modulus
......++++++
.++++++
e is 65537 (0x10001)

D:\Code\openssl\apps>openssl req -new -out ies/server-req.csr -key ies/server-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shan-Dong
Locality Name (eg, city) []:jinan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:iESLab
Organizational Unit Name (eg, section) []:SK
Common Name (e.g. server FQDN or YOUR name) []:www.iessk.com
Email Address []:sorata_kasugano@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.

D:\Code\openssl\apps>openssl x509 -req -in ies/server-req.csr -out ies/server-cert.pem -signkey ies/server-key.pem -CA ies/ca-cert.pem -CAkey ies/ca-key.pem -CAcreateserial -days 3650
Signature ok
subject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.com
Getting Private key
Getting CA Private Key

D:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/server-cert.pem -inkey ies/server-key.pem -out ies/server.p12
Enter Export Password:
Verifying - Enter Export Password:

Client:

D:\Code\openssl\apps>openssl genrsa -out ies/client-key.pem 1024
Generating RSA private key, 1024 bit long modulus
......................++++++
...............++++++
e is 65537 (0x10001)

D:\Code\openssl\apps>openssl req -new -out ies/client-req.csr -key ies/client-key.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shan-Dong
Locality Name (eg, city) []:jinan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:iESLab
Organizational Unit Name (eg, section) []:SK
Common Name (e.g. server FQDN or YOUR name) []:www.iessk.com
Email Address []:sorata_kasugano@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.

D:\Code\openssl\apps>openssl x509 -req -in ies/client-req.csr -out ies/client-cert.pem -signkey ies/client-key.pem -CA ies/ca-cert.pem -CAkey ies/ca-key.pem -CAcreateserial -days 3650
Signature ok
subject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.com
Getting Private key
Getting CA Private Key

D:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/client-cert.pem -inkey ies/client-key.pem -out ies/client.p12
Enter Export Password:
Verifying - Enter Export Password:

過程都是相同的卑笨,先生成1024位的RSA私鑰,然后生成證書請求文件(.csr)仑撞,csr文件經(jīng)CA私鑰簽名后生成公鑰(即X.509證書)赤兴,如果需要的話還可以再把它導(dǎo)出為其他格式比如PKCS#12證書(.p12)。

最后編輯于
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
  • 序言:七十年代末隧哮,一起剝皮案震驚了整個濱河市桶良,隨后出現(xiàn)的幾起案子,更是在濱河造成了極大的恐慌沮翔,老刑警劉巖陨帆,帶你破解...
    沈念sama閱讀 216,372評論 6 498
  • 序言:濱河連續(xù)發(fā)生了三起死亡事件,死亡現(xiàn)場離奇詭異采蚀,居然都是意外死亡疲牵,警方通過查閱死者的電腦和手機,發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 92,368評論 3 392
  • 文/潘曉璐 我一進店門榆鼠,熙熙樓的掌柜王于貴愁眉苦臉地迎上來纲爸,“玉大人,你說我怎么就攤上這事妆够∈独玻” “怎么了负蚊?”我有些...
    開封第一講書人閱讀 162,415評論 0 353
  • 文/不壞的土叔 我叫張陵,是天一觀的道長颓哮。 經(jīng)常有香客問我家妆,道長,這世上最難降的妖魔是什么冕茅? 我笑而不...
    開封第一講書人閱讀 58,157評論 1 292
  • 正文 為了忘掉前任伤极,我火速辦了婚禮,結(jié)果婚禮上嵌赠,老公的妹妹穿的比我還像新娘塑荒。我一直安慰自己,他們只是感情好姜挺,可當(dāng)我...
    茶點故事閱讀 67,171評論 6 388
  • 文/花漫 我一把揭開白布齿税。 她就那樣靜靜地躺著,像睡著了一般炊豪。 火紅的嫁衣襯著肌膚如雪凌箕。 梳的紋絲不亂的頭發(fā)上,一...
    開封第一講書人閱讀 51,125評論 1 297
  • 那天词渤,我揣著相機與錄音牵舱,去河邊找鬼。 笑死缺虐,一個胖子當(dāng)著我的面吹牛芜壁,可吹牛的內(nèi)容都是我干的。 我是一名探鬼主播高氮,決...
    沈念sama閱讀 40,028評論 3 417
  • 文/蒼蘭香墨 我猛地睜開眼慧妄,長吁一口氣:“原來是場噩夢啊……” “哼!你這毒婦竟也來了剪芍?” 一聲冷哼從身側(cè)響起塞淹,我...
    開封第一講書人閱讀 38,887評論 0 274
  • 序言:老撾萬榮一對情侶失蹤,失蹤者是張志新(化名)和其女友劉穎罪裹,沒想到半個月后饱普,有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體,經(jīng)...
    沈念sama閱讀 45,310評論 1 310
  • 正文 獨居荒郊野嶺守林人離奇死亡状共,尸身上長有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點故事閱讀 37,533評論 2 332
  • 正文 我和宋清朗相戀三年套耕,在試婚紗的時候發(fā)現(xiàn)自己被綠了。 大學(xué)時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片峡继。...
    茶點故事閱讀 39,690評論 1 348
  • 序言:一個原本活蹦亂跳的男人離奇死亡箍铲,死狀恐怖,靈堂內(nèi)的尸體忽然破棺而出鬓椭,到底是詐尸還是另有隱情颠猴,我是刑警寧澤关划,帶...
    沈念sama閱讀 35,411評論 5 343
  • 正文 年R本政府宣布,位于F島的核電站翘瓮,受9級特大地震影響贮折,放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜资盅,卻給世界環(huán)境...
    茶點故事閱讀 41,004評論 3 325
  • 文/蒙蒙 一调榄、第九天 我趴在偏房一處隱蔽的房頂上張望。 院中可真熱鬧呵扛,春花似錦每庆、人聲如沸。這莊子的主人今日做“春日...
    開封第一講書人閱讀 31,659評論 0 22
  • 文/蒼蘭香墨 我抬頭看了看天上的太陽。三九已至蓝晒,卻和暖如春腮出,著一層夾襖步出監(jiān)牢的瞬間,已是汗流浹背芝薇。 一陣腳步聲響...
    開封第一講書人閱讀 32,812評論 1 268
  • 我被黑心中介騙來泰國打工胚嘲, 沒想到剛下飛機就差點兒被人妖公主榨干…… 1. 我叫王不留,地道東北人洛二。 一個月前我還...
    沈念sama閱讀 47,693評論 2 368
  • 正文 我出身青樓馋劈,卻偏偏與公主長得像,于是被迫代替她去往敵國和親晾嘶。 傳聞我的和親對象是個殘疾皇子侣滩,可洞房花燭夜當(dāng)晚...
    茶點故事閱讀 44,577評論 2 353