"openssl编程简介".文章.过期的证书 [英] "an introduction to openssl programming." article. expired certificates

问题描述

我是openSSL库和PKI中的新手. 我对openSSL专家有一个简单的问题.

I am newbie in openSSL library and PKI . I have simple question for openSSL experts.

有人知道如何为本文的代码示例创建证书吗? Eric Rescorla的"OpenSSL编程简介(第I/II部分)"

Does anybody know how to create certificates for code samples in this article "An Introduction to OpenSSL programming (Part I/II)" by Eric Rescorla

www.rtfm.com/openssl-examples/part1.pdf

www.rtfm.com/openssl-examples/part1.pdf

www.rtfm.com/openssl-examples/part2.pdf

www.rtfm.com/openssl-examples/part2.pdf

我已经从 http://www.rtfm.com/openssl-examples 问题在于证书已过期，我不知道如何创建新的根证书.

I have downloaded source code from http://www.rtfm.com/openssl-examples The problem is that certificates are expired and I don't know how to create new root certificate.

如何创建根证书?如何为客户端和服务器应用程序创建证书?我应该使用Wich加密算法吗? 据我了解，我应该执行以下操作:

How to create root certificate? How to create certificates for client and server app? Wich ciphering algorithm should I use? As far as i understand i shuld do the following:

• 创建密钥对.秘密和公共密钥.
• 创建证书申请(p10格式).
• 创建自签名根证书(x509格式).

文章中的细节不清楚.

Details is not clear from the article.

这是我尝试创建证书的方式:

This is how I am trying to create certificates:

1)创建CA私钥和证书请求: openssl req -newkey rsa -keyout ./ca_key.pem out.pem -out ./ca_req.pem -days 1095 -passin pass:"password" -subj有关CA的某些信息"-扩展名v3_ca

1) Creating CA private key and certificate request: openssl req -newkey rsa -keyout ./ca_key.pem out.pem -out ./ca_req.pem -days 1095 -passin pass:"password" -subj "some information about CA" -extensions v3_ca

2)创建自签名的CA证书 openssl ca -create_serial -in ca_req.pem -out root.pem -days 1095 -passin pass:"password" -selfsign -extension v3_ca

2) Create self signed CA certificate openssl ca -create_serial -in ca_req.pem -out root.pem -days 1095 -passin pass:"password" -selfsign -extension v3_ca

3)生成服务器私钥并请求证书 openssl req -newkey rsa -keyout server_key.pem out server_req.pem -days 1095 -passin pass:"password" -subj有关服务器的一些信息"

3)generate server private key and request for certificate openssl req -newkey rsa -keyout server_key.pem out server_req.pem -days 1095 -passin pass:"password" -subj "some information about server"

4)创建服务器证书(此证书不是自签名的.此证书由CA私钥签名) openssl ca -in server_req.pem -out server.pem -passin pass:密码"

4)create server certifiate (this certificate is not self signed. This certificate signed by CA private key) openssl ca -in server_req.pem -out server.pem -passin pass:"password"

5)生成用户私钥并请求证书 openssl req -newkey rsa -keyout user_key.pem out user_req.pem -days 1095 -passin pass:"password" -subj有关客户端的一些信息"

5)generate user private key and request for certificate openssl req -newkey rsa -keyout user_key.pem out user_req.pem -days 1095 -passin pass:"password" -subj "some information about client"

6)创建用户证书(此证书不是自签名的.此证书由CA私钥签名) openssl ca -in user_req.pem -out client.pem -passin pass:密码"

6)create user certifiate (this certificate is not self signed. This certificate signed by CA private key) openssl ca -in user_req.pem -out client.pem -passin pass:"password"

我不确定这里的"rsa"算法.可能是我shuold使用其他算法.

I am not sure about "rsa" algorithm here. May be I shuold use other algorthm.

所以我有root.pem，server.pem，client.pem 我把客户端密钥和证书放到client.pem 对于server.pem也是如此. (与文章样本证书中的方法相同.)

So i have root.pem, server.pem, client.pem I put client key and certificate to client.pem And the same thing for server.pem. ( The same way as in the articles sample certificates.)

但是当我尝试使用这些新生成的证书启动服务器时，出现错误: 无法打开DH文件."

But when i try to start server with these new generated certificates i have an error: "Couldn't open DH file."

当我将旧的DH文件放入当前文件夹并且服务器启动时. (dh1024.pem是什么?)

When I put old DH file to current folder and server starts. (dh1024.pem What is it?)

下一步.我启动客户端，然后收到另一条错误消息:证书不验证."

The next step. I start client and I got another error message: "Cetrificate doesn't verify."

错误代码为20.x509_vfy.h中代码20的描述为无法在本地获取颁发者证书"

The error code is 20. Desciption for code 20 in x509_vfy.h is "unable to get issuer certificate locally"

所有这些都意味着我创建的证书不正确. 我不知道该怎么做.

All of this means that I have created certificates incorrectly. I don't know how to do it correctly.

有人有主意吗?

推荐答案

这是解决方案. 可能它不是最佳方法，但它可以工作.问题解决方案的唯一区别是选项:-des3 1024"

This is the solution. May be it is not optimal but it works. The only difference with question solution is option: "-des3 1024"

#!/bin/sh

alg="rsa"

ossl="openssl"

passwd="password"

#certificate autority folder
caFolder="./demoCA"

#delete old certificates, CA folder and keys 
rm -rf *.pem

rm -rf $caFolder

#create folder structure
mkdir $caFolder
mkdir "$caFolder/private"
mkdir "$caFolder/newcerts"

#generate RSA private key for CA
$ossl genrsa -out ca_key.pem 1024

#Creating certificate request:
$ossl req -new -key ca_key.pem -out ./ca_req.pem -days 1095 -passin pass:$passwd  -passout pass:$passwd \
-subj /C=RU/ST=Moscow/L=Moscow/O=company/OU=TestCAs/CN=TestCA/emailAddress=[e-mail] -extensions v3_ca

cp ca_key.pem "$caFolder/private/cakey.pem" 

touch "$caFolder/index.txt"

#Create self signed CA certificate 
$ossl ca -create_serial -in ca_req.pem -out ca_cert.pem -days 1095 -passin pass:$passwd -selfsign -extensions v3_ca -notext
cp ca_cert.pem "$caFolder/cacert.pem"


#generate SERVER private key and request for certificate 
$ossl genrsa -out server_key.pem -passout pass:$passwd -des3 1024

$ossl req -new -key server_key.pem  -passin pass:$passwd \
-passout pass:$passwd -out server_req.pem -days 1095 \
-subj /C=RU/ST=Moscow/L=Moscow/O=company/OU=SSLServers/CN=localhost/emailAddress=[e-mail]  

#create SERVER certifiate (this certificate is not self signed. This certificate signed by CA private key)
$ossl ca -in server_req.pem -out server_cert.pem -passin pass:$passwd -notext


#generate RSA private key for client
$ossl genrsa -out user_key.pem -passout pass:$passwd -des3 1024

#generate request certificate for client
$ossl req -new -key user_key.pem -out user_req.pem -days 1095 \
-passin pass:$passwd -passout pass:$passwd \
-subj /C=RU/ST=Moscow/L=Moscow/O=company/OU=Clients/CN=Client/emailAddress=[e-mail] 

#create user certifiate (this certificate is not self signed. This certificate signed by CA private key) 
$ossl ca -in user_req.pem -out user_cert.pem -passin pass:$passwd -notext

#generate  DH   param
$ossl dhparam -out dh1024.pem 1024

cat ./user_key.pem ./user_cert.pem > client.pem  

cat ./server_key.pem  ./server_cert.pem  > server.pem

cp ./ca_cert.pem root.pem

这篇关于"openssl编程简介".文章.过期的证书的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！