微服务grpc证书-TLS 证书认证（二）

最新推荐文章于 2025-04-12 21:31:43 发布

若尘拂风

最新推荐文章于 2025-04-12 21:31:43 发布

阅读量1.6k

点赞数

分类专栏： go lang 文章标签： golang 微服务

本文链接：https://blog.youkuaiyun.com/shachao888/article/details/110850501

版权

go lang 专栏收录该内容

26 篇文章

订阅专栏

本文介绍了如何通过openssl为gRPC微服务创建并配置TLS证书，以增强服务的安全性。首先，详细说明了openssl的安装及证书生成步骤，包括生成私钥和证书请求。接着展示了在服务端和客户端代码中应用这些证书的修改过程。在遇到'x509:证书依赖于遗留的CommonName字段'错误时，提供了通过设置GODEBUG环境变量解决的方法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

grpc微服务，为了增加其安全性，使用tls证书

一：使用openssl生成证书

1、安装openssl

2、生成证书

openssl genrsa -out server.key 2048 //生成私钥

openssl req -new -x509 -sha256 -key server.key  -out server.pem -days 36500 //生成私钥

openssl req -new -key server.key  -out server.crt -days 36500 //生成私钥


You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
填写生成私钥需要的信息，直接回车
-----
Country Name (2 letter code) []:    
State or Province Name (full name) []:
Locality Name (eg, city) []:
Organization Name (eg, company) []:go deveper
Organizational Unit Name (eg, section) []:international
Common Name (eg, fully qualified host name) []:go-grpc
Email Address []:********@qq.com

3:服务端代码修改

creds, errs := credentials.NewServerTLSFromFile("cert/server.crt", "cert/server_no.key")
	if errs != nil {
		log.Fatalf("failed to use tsl: %v", err)
	}

	s := grpc.NewServer(grpc.Creds(creds))

4:客户端代码修改

creds, errs := credentials.NewClientTLSFromFile("../cert/server.crt", "go-grpc")
	if errs != nil {
		log.Fatalf("NewClientTLSFromFile: %v", errs)
	}
	log.Println("可开始请求------1")
	conn, err := grpc.Dial(address, grpc.WithTimeout(3*time.Second), grpc.WithTransportCredentials(creds))

5:运行出现错误解决办法

出现错误：

2020/12/08 16:41:22 could not greet: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0"
Process exiting with code: 1 signal: false

解决办法：GODEBUG=x509ignoreCN=0 go run client.go