openresty集成ssl验签功能

renkaige5

已于 2023-11-13 16:20:46 修改

阅读量507

点赞数

分类专栏： docker lua openresty 文章标签： openresty ssl linux lua

于 2023-11-13 16:18:29 首次发布

本文链接：https://blog.youkuaiyun.com/chenguihua5/article/details/134379791

版权

博客围绕CentOS测试和构建SSL验签镜像展开。在CentOS测试中，介绍使用阿里云yum repo、更新yum组件、安装所需组件、生成证书及验证签名等操作。构建SSL验签镜像时，涉及基础镜像制作、启动容器、安装依赖、打开nginx日志开关、修改配置文件及创建lua脚本等内容。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

centos测试

使用阿里云的yum repo

mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d.bak/CentOS-Base.repo
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
yum clean all
yum makecache
yum repolist

需要更新yum组件，否则安装openssl-devel提示冲突

yum update

安装所需yum组件

#luaossl的依赖项
yum install epel-release
yum install openssl-devel
#lua包管理器
yum install luarocks
yum install lua-devel

安装所需lua组件

#ssl组件
luarocks install luaossl
#base64组件,openresty镜像中不用执行该命令,如执行会提示Error: No results matching query were found.
luarocks install mime

生成证书命令

openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.pem
openssl rsa -in private.key -outform der -out private.der

验证签名lua脚本

local pkey = require("openssl.pkey")
local digest = require("openssl.digest")
local mime = require("mime")

-- 读取pem格式公钥证书文件
local pk_cert_data = assert(io.open("/root/public.pem", "rb")):read("*a")

local pkey =pkey.new()

pkey:setPubinsiglicKey(pk_cert_data)

-- 原始数据
local data = "Hello, World!"

-- 创建SHA256摘要对象
local digest_data = digest.new("sha256")
print(digest_data)
-- 更新摘要
digest_data:update(data)
--使用java项目中签名方法生成的签名
local signatures ="fwOupXYu/6bl8RqMJWztrU6trsKkGXSh2nyQyHHmiuqlyCXWm5sE3zCzqoYVB5ppYIwzYGWYmhEH9jRzmB6R7oZXDLKnom/BaRnUMmrHjmgaI5AL9jAAyLKckNlOl1ptS35a7A3PyFDTBkOxq6gEZjJhMHxJVe4W98JJMpZqzZ5nM5nOVDKRsUrziSO0M7u/nDt03IoxB8wN34ljkjhXbT8v6my85QYTH3e0Pj9dcBiUV9Sv04GOCEr+eE9HznWirb169+MsulGERi2ILZAf+kTWJ/I5TYrGvbviowhtvRU4j1zJvnVRE1rjOEZpvxmBUAoSXpWOSUcqlVKAwsLbaQ=="
local signature =mime.unb64(signatures)
-- 打印签名
print("Signature:", signature)

-- 验证签名
local verify_result = pkey:verify(signature, digest_data)

-- 判断验签结果
if verify_result == true then
  print("Signature is valid.")
elseif verify_result == false then
  print("Signature is invalid.")
else
  print("Verification failed.")
end

输出

userdata: 0x21973e8
Signature:      ��v.�����%l��N��¤t��|��q���%֛��0����i`�3`e���4s���W
                                                                  ���o�i�2jǎh#�
                                                                               �0
Signature is valid.

生成签名的方法（AuthUtil）

    public static void main(String[] args) {
        String json2String = "Hello, World!";
        String sign = RsaUtil.standardSign(RsaUtil.getPrivateKeyFromDer("/opt/private.der"), json2String);
        System.out.println(sign);
        PublicKey publicKey = RsaUtil.getPublicKeyFromPem("/opt/public.pem");
        AuthUtil authUtil = new AuthUtil();
        boolean b = authUtil.standardVerifyMsgByPemPubKey(sign, json2String, publicKey);
        System.out.println(b);

    }
    /**
 * 获取私钥
 *
 * @param filename 私钥路径
 * @return 私钥
 */
@SneakyThrows
public static PrivateKey getPrivateKeyFromDer(String filename) {
    Security.addProvider(new BouncyCastleProvider());

    byte[] keyBytes = Files.readAllBytes(Paths.get(filename));
    PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
    KeyFactory kf = KeyFactory.getInstance(KEY_ALGORITHM);
    return kf.generatePrivate(spec);
}
 /**
 * 生成签名
 */
public static String standardSign(PrivateKey priKey, String tobeSigned) {
    try {
        Signature sign = Signature.getInstance(SIGNATURE_ALGORITHM);
        sign.initSign(priKey);
        sign.update(tobeSigned.getBytes(StandardCharsets.UTF_8));
        byte[] si

最低0.47元/天解锁文章