🐼 MYPANDA 2024-11-13T16:44:55.501Z http://mypanda.github.io/ mypanda Hexo 如何创建自签https证书 http://mypanda.github.io/2024/11/13/how-to-create-a-self-signed-https-certificate/ 2024-11-13T15:08:29.000Z 2024-11-13T16:44:55.501Z 从创建根证书开始，并使用根证书签名证书，适用于需要https加密的场景,Nginx,K8s等。下面将会使用Cloudflare的开源PKI和TLS工具cfssl创建

概览

  • .crt和.cer:多为PEM或DER编码的证书,仅包含公钥部分
  • .pem: Base64格式文本文件，能包含公钥，私钥，证书链等信息，灵活性强
  • .pfx(.p12):二进制格式，包含公钥，私钥，证书链，适用于Windows系统和私钥传输
  • .der:二进制格式，同城包含证书的公钥，适合Java环境

下载软件

1
2
3
4
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl_1.5.0_linux_amd64 -o cfssl
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssljson_1.5.0_linux_amd64 -o cfssljson
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl-certinfo_1.5.0_linux_amd64 -o cfssl-certinfo
chmod +x cfssl cfssljson cfssl-certinfo

根证书

生成默认根证书配置文件config.json和根证书申请文件csr.json

1
2
./cfssl print-defaults config > config.json
./cfssl print-defaults csr > csr.json

创建根证书配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
cat > ca-config.json << EOF
{
  "signing": {
    "default": {
      "expiry": "876000h"
    },
    "profiles": {
      "www": {
        "expiry": "876000h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ]
      }
    }
  }
}
EOF

创建根证书申请文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
cat > ca-csr.json << EOF
{
  "CN": "MyCert Root CA",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Shanghai",
      "L": "Shanghai",
      "O": "MyCert Inc",
      "OU": "MyCert Inf"
    }
  ],
  "ca": {
    "expiry": "876000h"
  }
}
EOF

生成根证书ca.pem和私钥ca-key.pem

1
./cfssl gencert -initca ca-csr.json | ./cfssljson -bare ca

查看根证书

1
./cfssl certinfo -cert ca.pem

证书

创建证书申请文件server-csr.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
cat > server-csr.json << EOF
{
  "CN": "Mypanda.com",
  "hosts": [
    "123.123.123.123",
    "Mypanda.com"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Shanghai",
      "ST": "Shanghai",
      "O": "Mypanda Co., Ltd",
      "OU": "Mypanda Inf"
    }
  ]
}
EOF

生成证书server.pem和私钥server-key.pem

1
./cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | ./cfssljson -bare server

查看证书

1
./cfssl certinfo -cert ca.pem

OpenSSL创建根证书和证书

创建根证书和证书有下面几种方式,区别为多条命令还是单条命令，亦或无需输入信息一条命令

创建根自签证书

下面以创建根证书为例

  1. 第一种方式,创建根证书私钥,创建根证书请求文件，然后生成证书

    1
    2
    3
    4
    5
    6
    7
    8
    # 创建根证书私钥
    openssl genpkey -algorithm RSA -out ca.key [-pkeyopt rsa_keygen_bits:2048]
    # 创建根证书请求文件
    openssl req -new -key ca.key -out ca.csr
    # 创建自签名证书
    openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
    # 查看根证书
    openssl x509 -in ca.crt -text -noout

  2. 第二种方式,一条命令生成根证书私钥和根证书

1
openssl req -newkey rsa:2048 -nodes -keyout ca.key -x509 -days 365 -out ca.crt
  1. 第三种方式，不需要手动输入信息，一条命令生成根证书私钥和根证书
1
openssl req -newkey rsa:2048 -nodes -keyout ca.key -x509 -days 365 -out ca.crt -subj "//C=CN/ST=Shanghai/L=Shanghai/O=Organization/OU=OrganizationUnit/CN=Domain"

使用上一步创建的根证书签名证书

1
2
3
4
5
6
7
8
# 证书私钥
openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
# 证书签名请求
openssl req -new -key server.key -out server.csr
# 签发证书
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -sha256
# 查看证书
openssl x509 -in server.crt -text -noout

参数说明

1
2
3
4
5
6
7
8
9
10
11
12
13
14
-newkey rsa:2024 生成2024位RSA密钥
-nodes           生成不加密的私钥文件
-keyout ca.key   指定私钥文件名
-x509            生成自签名证书
-days 365        证书有效期365天
-out ca.crt      指定证书名
-subj "/C=CN/ST=Shanghai/L=Shanghai/O=Organization/OU=OrganizationUnit/CN=Domain" 指定证书的主题信息,避免手动输入

C   国家代码，如中国CN
ST  州/省名称
L   城市名称
O   组织名称，如公司名称
OU  组织单位名称，如部门名称
CN  通用名称，通常是域名或服务器名称

服务器配置证书

Nginx

Nginx可以直接使用server.pem证书，配置如下

1
2
3
4
5
6
7
8
9
10
server {
    listen 443 ssl;
    server_name <YourDomain>; # 证书绑定的域名,IP则注释
    ssl_certificate cert/server.pem; # 相对于配置文件的路径
    ssl_certificate_key cert/server-key.pem;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; # 密码套件
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
}

Kestrel/IIS

  1. window server 2019的kestrel服务，需要使用openssl 1.1.x转换的pfx证书，原理暂未确定，见参考
  2. 需要把pem证书转换为pfx证书，才可以使用

pem证书转pfx证书

1
2
3
4
5
6
7
8
# 生成密码
openssl rand -base64 10
# 使用密码，转换证书
openssl pkcs12 -export -out server.pfx -inkey server-key.pem -in server.pem
# 查看pfx证书
openssl pkcs12 -in server.pfx -info
# openssl pkcs12 -clcerts -nokeys -in server.pfx
# openssl pkcs12 -in server.pfx -nocerts -nodes

Window PC配置根证书,使浏览器信任自签证书

首先把根证书从pem转成pfx,然后添加到受信任的根证书颁发机构位置即可

1
openssl pkcs12 -export -out ca.pfx -inkey ca-key.pem -in ca.pem

参考

https://blog.csdn.net/robin_cai/article/details/120758214

https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/certificates/

https://www.howtouselinux.com/post/converting-cer-crt-der-pem-pfx-certificate#Convert_PEM_to_DER

https://blog.csdn.net/u010358168/article/details/83508851

https://blog.csdn.net/u014163312/article/details/105744177

]]> <p>从创建根证书开始，并使用根证书签名证书，适用于需要https加密的场景,Nginx,K8s等。下面将会使用<code>Cloudflare</code>的开源<code>PKI</code>和<code>TLS</code>工具<code>cfssl</code>创建</p> Hello World http://mypanda.github.io/2017/12/31/hello-world/ 2017-12-31T08:04:40.000Z 2024-11-14T05:55:15.205Z Welcome to Hexo! This is your very first post. Check documentation for more info. If you get any problems when using Hexo, you can find the answer in troubleshooting or you can ask me on GitHub.

Quick Start

Create a new post

1
$ hexo new "My New Post"

More info: Writing

Run server

1
$ hexo server

More info: Server

Generate static files

1
$ hexo generate

More info: Generating

Deploy to remote sites

1
$ hexo deploy

More info: Deployment

]]> <p>Welcome to <a href="https://hexo.io/" target="_blank" rel="noopener">Hexo</a>! This is your very first post. Check <a href="https://hexo.io/docs/" target="_blank" rel="noopener">documentation</a> for more info. If you get any problems when using Hexo, you can find the answer in <a href="https://hexo.io/docs/troubleshooting.html" target="_blank" rel="noopener">troubleshooting</a> or you can ask me on <a href="https://github.com/hexojs/hexo/issues" target="_blank" rel="noopener">GitHub</a>.<br>