跳到主要内容

certs

certs 利用​

使用cfssl套件产生证书/密钥​

首先利用cfssl print-defaults产生config/csr基础配置​

cfssl print-defaults csr > csr.json
cfssl print-defaults config > config.json

此时可以实际情况修改json配置项，也可以不改，后面命令行覆盖，通常将config.json中expiry项改大​

生成ca端的相关文件，目前有用的是ca.pem,ca-key.pem​

cfssl gencert -initca -cn "web-sites" csr.json|cfssljson -bare ca
# gencert有其它项，但对-initca不起作用，后面会用到，此时产生了ca.csr,ca-key.pem,ca.pem

cfssl-certinfo -cert ca.pem

生成server端的相关文件，需要用到前一步的ca文件​

cfssl gencert -ca ca.pem -ca-key ca-key.pem -cn "web-01" \
-hostname "localhost,127.0.0.1,web-01.local,www.web-01.local" \
-config=config.json -profile=www csr.json | cfssljson -bare web-01
# 产生了web-01.csr,web-01.pem,web-01-key.pem

cfssl-certinfo -cert web-01.pem

openssl查看验证证书​

openssl x509 -in ca.pem -text -noout
openssl x509 -in web-01.pem -text -noout
openssl verify -CAfile ca.pem web-01.pem

server端拿到ca.pem/web-01.pem/web-01-key.pem配置到程序tls/ssl处，启动程序，使用curl验证server端https​

**********************!!!PROTECTION POLICY!!!**********************
Waiting For The Next Deployment, Maybe It Would Be Displayed After That.

使用cfssl selfsign产生自签证书​

自签证书特点: ca与server的共用证书/私钥，方便临时简单使用​

# 参照cfssl print-defaults csr内容,此时需要修改csr文件，因为测试发现selfsign HOSTNAME不起作用
cat > selfsign-csr.json <<EOF
{
    "CN": "web-sites",
    "hosts": [
        "localhost",
        "127.0.0.1",
        "web-01.local",
        "www.web-01.local"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "CN",
            "ST": "CQ",
            "L": "CQ"
        }
    ]
}
EOF
cfssl selfsign -config=config.json -profile=www 'whatever' selfsign-csr.json | cfssljson -bare selfsigned

cfssl-certinfo -cert selfsigned.pem
openssl x509 -in selfsigned.pem -text -noout
openssl verify -CAfile selfsigned.pem selfsigned.pem