证书签发与自签名证书#

密钥生成#

1
一般是ssh/github/WireGuard使用，生成一对公私钥

1
ssh-keygen -t [rsa/ecdsa/ed25519] -f [path] -C "comment"

1
目前RSA不建议使用，又长还不安全，建议使用ed25519,

‍

证书生成#

几个概念和文件解释#

文件
1. .key: 证书对应的私钥文件
2. .crt: CA认证后的文件，即证书
3. .csr: 证书签名请求, 用私钥签名得到的文件
4. .crl: 证书吊销列表
5. .pem; 导出导入证书用的格式, .crt+.key, 使用base64存储
根证书和用户证书: 根证书是信任链顶级, 用户证书是根证书签发的

对于自签证书, 只要根证书是有效的(安装在电脑上), 则由它签发的用户证书就是可信的
.x509: 证书格式标准

生成证书有两种, 自签名和CA签发, 只有CA签发的才有https锁标志, 但是加密功能来说两者等效

自签名证书#

1
下面讲解如何生成自己的证书

根证书生成#

1
首先需要一个根证书，我们自己就是CA

1
mkdir -p ./myca/{certs,crl,newcerts,private}
2
cd myca
3
touch index.txt
4
echo 1000 > serial
5
chmod 700 private

1
目录应该是这样的

1
.
2
├── certs # 证书位置
3
├── crl # 吊销列表
4
├── index.txt # 证书目录
5
├── newcerts # 新证书
6
├── private # 私钥
7
└── serial # 自增的index

准备OpenSSL文件(openssl.cnf)

1
[ ca ]
2
default_ca = CA_default
3

4
[ CA_default ]
5
dir               = /home/nolan/code/myca  # CA 根目录
6
certs             = $dir/certs
7
new_certs_dir     = $dir/newcerts
8
database          = $dir/index.txt
9
serial            = $dir/serial
10
private_key       = $dir/private/ca.key.pem
11
certificate       = $dir/certs/ca.cert.pem
12
default_md        = sha256
13
policy            = policy_loose
14
default_days      = 3650
15
x509_extensions   = v3_ca
16

17
[ policy_loose ]
18
# policy设置
19
# optional指后面的CSR可以不写，supplied需要写
20
# match是必须写且值必须和CA的相同
21
countryName            = optional
22
stateOrProvinceName    = optional
23
organizationName       = optional
24
commonName             = supplied
25

26
[ req ]
27
prompt             = no # 设置为No直接使用下面的默认值，否则交互式询问
28
default_bits        = 4096 # RSA有效，ED25519是没用的
29
distinguished_name  = req_distinguished_name
30
string_mask         = utf8only
31

32
[ req_distinguished_name ]
33
# 证书主题默认值
34
C           = CN # Country Name
35
ST          = Hubei # State or Province Name
36
L           = WuHan # Locality Name
37
O           = Apeiria # Organization Name
38
CN          = Apeiria # Common Name
39

40
[ v3_ca ]
41
# CA:TRUE=CA标识，critical=客户端验证时，不认识就直接拒绝
42
basicConstraints = critical, CA:TRUE
43
# 用途，keyCertSign/cRLSign=签发下级证书/吊销列表，critical=拒绝其他用途
44
keyUsage         = critical, keyCertSign, cRLSign
45
# Subject Key Identifier 扩展，快速找到上级证书
46
subjectKeyIdentifier = hash

生成根CA私钥

1
# 签发证书
2
openssl genrsa -out private/ca.key.pem 4096
3
# 用ED25519，上面默认RSA
4
openssl genpkey -algorithm Ed25519 -out private/ca.key.pem
5
chmod 400 private/ca.key.pem

签发根 CA 证书

1
openssl req -config openssl.cnf \
2
  -key private/ca.key.pem \
3
  -new -x509 -days 3650 -sha256 \
4
  -extensions v3_ca \
5
  -out certs/ca.cert.pem
6
chmod 444 certs/ca.cert.pem

验证

1
openssl x509 -in certs/ca.cert.pem -noout -text

1
结果

1
Certificate:
2
    Data:
3
        Version: 3 (0x2)
4
        Serial Number:
5
            18:09:35:aa:82:e4:6a:e4:8d:d2:35:5d:f2:51:49:83:55:84:5e:e1
6
        Signature Algorithm: ED25519
7
        Issuer: C=CN, ST=Hubei, L=WuHan, O=Apeiria, CN=Apeiria
8
        Validity
9
            Not Before: Apr 19 08:41:35 2025 GMT
10
            Not After : Apr 17 08:41:35 2035 GMT
11
        Subject: C=CN, ST=Hubei, L=WuHan, O=Apeiria, CN=Apeiria
12
        Subject Public Key Info:
13
            Public Key Algorithm: ED25519
14
                ED25519 Public-Key:
15
                pub:
16
                    e5:ac:18:8f:81:7c:d9:e4:59:8d:a3:b0:79:8d:70:
17
                    fb:04:c2:4f:27:7b:34:3c:6b:a6:15:c0:a5:29:46:
18
                    ab:97
19
        X509v3 extensions:
20
            X509v3 Basic Constraints: critical
21
                CA:TRUE
22
            X509v3 Key Usage: critical
23
                Certificate Sign, CRL Sign
24
            X509v3 Subject Key Identifier:
25
                DE:05:5A:55:8B:F6:63:FD:C7:0F:EC:BE:70:7C:55:9E:8A:84:92:1E
26
    Signature Algorithm: ED25519
27
    Signature Value:
28
        57:ba:4b:ba:3d:ea:fa:0d:e1:cf:cc:74:e0:03:9b:f4:94:56:
29
        24:dc:f7:e5:d4:3e:47:21:b5:df:e4:8c:e1:c1:2f:84:46:fc:
30
        4a:90:60:e2:df:77:97:0f:e4:2c:c0:60:92:32:d6:69:0d:40:
31
        fb:14:cb:39:f9:81:7d:cd:aa:08

1
最终我们得到了

1
.
2
├── certs
3
│   └── ca.cert.pem # CA证书
4
├── crl
5
├── index.txt
6
├── newcerts
7
├── openssl.cnf
8
├── private
9
│   └── ca.key.pem # CA私钥
10
└── serial

‍

用户证书签发#

1
上面已经有了 CA 和私钥，下面讲解如何签发自己的证书
2

3
生成用户的私钥，其实和CA生成私钥是一样的，私钥并不分是否是CA
4

5
总之需要一个私钥

1
openssl genpkey -algorithm Ed25519 -out nolan.key.pem
2
chmod 400 nolan.key.pem

1
生成CSR，也就是提交给CA的证书签名请求，通过私钥获取到证书

1
openssl req -new -key nolan.key.pem -out nolan.csr.pem

1
这一步需要调整`openssl.cnf`,末尾添加 user_crt 相关配置

1
[ usr_cert ]
2
# 普通用户证书，非 CA
3
basicConstraints        = critical, CA:FALSE
4
# 标识这个证书用作客户端认证
5
keyUsage                = critical, digitalSignature, keyEncipherment
6
extendedKeyUsage        = clientAuth
7
subjectKeyIdentifier    = hash
8
authorityKeyIdentifier  = keyid,issuer

签发证书

1
# -extensions usr_cert 就指定了刚刚的配置
2
openssl ca -config openssl.cnf \
3
  -extensions usr_cert \
4
  -days 3650 \
5
  -notext \
6
  -md sha256 \
7
  -in nolan.csr.pem \
8
  -out certs/nolan.cert.pem

验证

1
openssl x509 -in certs/nolan.cert.pem -noout -text

1
结果

1
Certificate:
2
    Data:
3
        Version: 3 (0x2)
4
        Serial Number: 4096 (0x1000)
5
        Signature Algorithm: ED25519
6
        Issuer: C=CN, ST=Hubei, L=WuHan, O=Apeiria, CN=Apeiria
7
        Validity
8
            Not Before: Apr 19 09:01:42 2025 GMT
9
            Not After : Apr 17 09:01:42 2035 GMT
10
        Subject: C=CN, ST=Hubei, O=Apeiria, CN=Apeiria
11
        Subject Public Key Info:
12
            Public Key Algorithm: ED25519
13
                ED25519 Public-Key:
14
                pub:
15
                    03:cb:ee:2b:b6:62:0d:4f:86:6b:37:45:f1:c0:ad:
16
                    c8:af:1a:0c:01:5e:6b:ab:c7:a1:ee:5a:46:87:38:
17
                    6b:dc
18
        X509v3 extensions:
19
            X509v3 Basic Constraints: critical
20
                CA:FALSE
21
            X509v3 Key Usage: critical
22
                Digital Signature, Key Encipherment
23
            X509v3 Extended Key Usage:
24
                TLS Web Client Authentication
25
            X509v3 Subject Key Identifier:
26
                DD:0B:04:82:65:DA:6E:76:7A:50:39:AC:C5:E9:9B:9B:35:3F:CC:84
27
            X509v3 Authority Key Identifier:
28
                DE:05:5A:55:8B:F6:63:FD:C7:0F:EC:BE:70:7C:55:9E:8A:84:92:1E
29
    Signature Algorithm: ED25519
30
    Signature Value:
31
        af:6b:79:2b:a4:fb:c3:84:33:9d:9a:3a:02:1a:df:c4:70:ac:
32
        8d:7b:42:bf:e3:b3:63:98:f7:12:db:83:89:b2:0c:3b:c8:7e:
33
        ad:e3:e5:25:00:e3:c7:fb:af:1b:67:70:0c:af:47:3e:39:13:
34
        6e:66:5e:11:c3:6b:3a:c8:95:05

‍

Let’s Encrypt 申请#

certbot方法#

1
# 安装certbot ACME
2
sudo apt-get install certbot
3

4
# 验证域名所有权, 并获取证书, 不过需要确保80和443没有占用
5
sudo certbot certonly --standalone

Let’s Encrypt证书有效期一般只有90天, 需要续订

certbot一般会自动设置定时任务自动续订证书, 也可以用下面的命令测试

1
sudo certbot renew --dry-run # 查看续订（dry-run）

‍

OpenSSL常用命令#

解析 pem 证书

1
openssl x509 -in cert.pem -noout -text

验证证书链

1
openssl verify -CAfile ca-chain.pem cert.pem

检查服务器证书

1
openssl s_client -connect axi.moe:443 \
2
  -servername axi.moe -showcerts </dev/null \
3
  2>/dev/null | openssl x509 -noout -text

DEBUG 用，Serve AS TLS

1
openssl s_server -key key.pem -cert cert.pem -accept 8443

音乐

证书签发与自签名证书

证书签发与自签名证书#

密钥生成#

证书生成#

几个概念和文件解释#

自签名证书#

根证书生成#

用户证书签发#

Let’s Encrypt 申请#

certbot方法#

OpenSSL常用命令#

目录