SSL/TLS 区别与应用 CA证书

SSL/TLS

HTTP协议与TCP之间的一个可选层，用于数据安全传输。

SSL

TLS

CA证书

服务端/客户端证书

基础信息

基础概念

认证方式

OpenSSL

生成证书

生成pfx证书

https://blog.youkuaiyun.com/yiquan_yang/article/details/113250364

生成Nginx证书

生成后需要将Nginx证书目录/etc/cert映射到证书目录，或则将证书拷贝到该目录，在访问HTTPS时需要将证书加入可信任机构，将ca.pem改名为ca.crt后双击安装。PostgreSQL开启SSL也可用这个生成私钥、公钥。以下为生成脚本：

#!/bin/bash

#输出当前执行脚本所在shell进程ID
echo "command_shell_pid=$$"

#HOST="主机地址/名称"  #建议用域名或者字符串，用IP好像不能成功
#PASSWORD="密码"
#COUNTRY="CN"
#STATE="省"
#CITY="市"
#ORGANIZATION="公司名称"
#ORGANIZATIONAL_UNIT="Dev"
#COMMON_NAME="$HOST"
#EMAIL="电子邮件地址"

#Docker需要使用的文件
#Server:  ca.pem  server-cert.pem  server-key.pem
#Client:  ca.pem client-cert.pem client-key.pem

#获取本地机器IP
machine_physics_net=$(ls /sys/class/net/ | grep -v "`ls /sys/devices/virtual/net/`");
local_ip=$(ip addr | grep "$machine_physics_net" | awk '/^[0-9]+: / {}; /inet.*global/ {print gensub(/(.*)\/(.*)/, "\\1", "g", $2)}' | head -1);

HOST="XXX"
PASSWORD="123456"
COUNTRY="CN"
STATE="GuangDong"
CITY="ShenZhen"
ORGANIZATION="YYY"
ORGANIZATIONAL_UNIT="PST"
COMMON_NAME="ZZZ"
EMAIL="xxx@xxx.com"

# Generate CA key
openssl genrsa -aes256 -passout "pass:$PASSWORD" -out "ca-key.pem" 4096
# Generate CA
openssl req -new -x509 -days 3650 -key "ca-key.pem" -sha256 -out "ca.pem" -passin "pass:$PASSWORD" -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$COMMON_NAME/emailAddress=$EMAIL"
# Generate Server key
openssl genrsa -out "server-key.pem" 4096

# Generate Server Certs.
openssl req -subj "/CN=$COMMON_NAME" -sha256 -new -key "server-key.pem" -out server.csr

#echo "subjectAltName = DNS:$HOST,IP:121.36.100.195,IP:192.168.1.215,IP:127.0.0.1" > extfile.cnf

#只给IP签名
echo "subjectAltName = IP:$local_ip,IP:127.0.0.1" > extfile.cnf
echo "extendedKeyUsage = serverAuth" >> extfile.cnf

openssl x509 -req -days 3650 -sha256 -in server.csr -passin "pass:$PASSWORD" -CA "ca.pem" -CAkey "ca-key.pem" -CAcreateserial -out "server-cert.pem" -extfile extfile.cnf


# Generate Client Certs.
rm -f extfile.cnf

openssl genrsa -out "client-key.pem" 4096
openssl req -subj '/CN=client' -new -key "client-key.pem" -out client.csr
echo extendedKeyUsage = clientAuth >> extfile.cnf
openssl x509 -req -days 3650 -sha256 -in client.csr -passin "pass:$PASSWORD" -CA "ca.pem" -CAkey "ca-key.pem" -CAcreateserial -out "client-cert.pem" -extfile extfile.cnf

#rm -vf client.csr server.csr 

#chmod -v 0400 "ca-key.pem" "key.pem" "server-key.pem"
#chmod -v 0444 "ca.pem" "server-cert.pem" "cert.pem"