SSL客户端双向加密配置

最新推荐文章于 2024-12-02 16:55:36 发布

原创最新推荐文章于 2024-12-02 16:55:36 发布 · 1.3k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#ssl #加密 #tomcat #server #服务器 #apache

转载请注明出处.谢谢 http://blog.youkuaiyun.com/mrshelly and http://www.mrshelly.com

===CA 部分===

*私钥

openssl genrsa -des3 -out ca/ca-key.pem 1024

*req证书

openssl req -new -out ca/ca-req.csr -key ca/ca-key.pem -config ./openssl.cnf

*x509证书

openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -days 3650

*吊销证书

openssl ca -revoke client/client-cert.crt -config ./openssl.cnf

openssl ca -gencrl -out ca/ca-cert.crl -config ./openssl.cnf

===Server证书部分===

*私钥

openssl genrsa -des3 -out server/server-key.pem 1024

*Windows(32)私钥支持

openssl rsa -in server/server-key.pem -out server/server-key-w32.pem

*req证书

openssl req -new -key server/server-key.pem -out server/server-req.csr -config ./openssl.cnf

*服务器证书

openssl ca -policy policy_anything -in server/server-req.csr -cert ca/ca-cert.pem -keyfile ca/ca-key.pem -out server/server-cert.pem -days 3650 -config ./openssl.cnf

====Apache SSL====

*需要文件

**server-cert.pem

**server-key-w32.pem

**ca-cert.pem

*配置部分

**SSLCertificateFile 服务器证书路径

**SSLCertificateKeyFile 服务器私钥(Windows32)

**SSLCertificateChainFile CA 证书路径.

**SSLVerifyClient require 是否双向认证

**SSLRequire ( ... ) 客户端证书过滤

*运行部分

Apache -D SSL

====Tomcat SSL====

*需要文件

**server_keystore

keytool -genkey -alias ERP -validity 3650 -keyalg RSA -keysize 1024 -keypass changeit -storepass changeit -dname "Subject" -keystore server/server_keystore

keytool -certreq -alias ERP -sigalg MD5withRSA -file server/server-req.csr -keypass changeit -keystore server/server_keystore -storepass changeit

**cacerts

keytool -import -v -trustcacerts -storepass Helloechange1301 -alias CA -file ca/ca-cert.pem -keystore server/cacerts

*配置部分

**server_keystore文件配置到 Tomcat conf/server.xml Connector节keystoreFile属性及keystorePass

**cacerts文件配置到%JRE_HOME%/lib/security路径下

**server.xml 相关 SSL 其它章节

*运行部分

Tomcat 重启生效

===Client证书部分===

*私钥

openssl genrsa -des3 -out client/client-key.pem 1024

*req证书

openssl req -new -key client/client-key.pem -out client/client-req.csr -config ./openssl.cnf

*个人证书

openssl x509 -req -in client/client-req.csr -signkey client/client-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650 -out client/client-cert.crt

*个人证书(p12格式)

openssl pkcs12 -export -clcerts -in client/client-cert.crt -inkey client/client-key.pem -out client/client-p12.p12

转载请注明出处.谢谢 http://blog.youkuaiyun.com/mrshelly and http://www.mrshelly.com