之前整理的流程有问题,重新查阅资料整理了一份,主要参考一下两篇:

https://blog.51cto.com/davidbj/1613780 (Nginx + openssl 搭建https服务)

https://blog.csdn.net/zssai2015/article/details/85049905(主要参考解决域名问题)

 
 
一、openssl.cnf 配置
# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: reproducible build, date unspecified
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic

  

# vim /etc/pki/tls/openssl.cnf

# 找到v3_req

[ v3_req ] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [ alt_names ] DNS.1 = *.fxk.site DNS.2 = *.myframe.site [ v3_ca ]
 
 
二、生成私钥和证书
 

1.首先要生成服务器的私钥:

# openssl genrsa -des3 -out server.key 2048
Enter pass phrase for ng.key:       输入口令
Verifying - Enter pass phrase for ng.key:   确认口令

 

 执行这个命令之后,再启动nginx时,就无需输入密码

# openssl rsa -in server.key -out server.key
 
 
2、用server.key生成一个证书
# openssl req -new -key server.key -out server.csr 

 

Enter pass phrase for ng.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:国家 如cn
State or Province Name (full name) [Some-State]:州或省的名称 如Beijing
Locality Name (eg, city) []:什么地方级别,是城市还是乡镇
Organization Name (eg, company) [Internet Widgits Pty Ltd]:什么组织,如:company
Organizational Unit Name (eg, section) []:组织单位名称 如:eelly
Common Name (eg, YOUR name) []:名字 一级域名,如:*.eelly.dev(这里的域名需要在openssl.cnf里面配置配置)
Email Address []:邮件地址  域名邮箱,如:admin@eelly.dev
 
Please enter the following 'extra' attributes 额外信息
to be sent with your certificate request
A challenge password []: 复杂密码  如:aaa12312sdfsd@
An optional company name []:如:eelly
 

3、对客户端也做同样的命令生成key及csr文件(配置流程和server.csr一样,但是Common Name需要区分开)

# openssl genrsa -des3 -out client.key 2048

# openssl req -new -key client.key -out client.csr 

  

4、生成CSR证书文件必须有CA 机构的签名才可以形成证书。这里制作自己的CA生成一个key文件CA.key和一个根证书ca.crt

# openssl req -new -x509 -keyout ca.key -out ca.crt -config /etc/pki/tls/openssl.cnf -extensions v3_req

 

5、创建openssl.conf 生成的配置文件

#根据openssl.cnf生成配置文件
touch /etc/pki/CA/{index.txt,serial}

#设置副本名称开始内容
echo 01 > /etc/pki/CA/serial
 
#设置副本证书存放目录
mkdir /etc/pki/CA/newcerts

  

6、 用CA的证书为刚才生成的server.csr 和 client.csr进行文件签名

# openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key  -config /etc/pki/tls/openssl.cnf -extensions v3_req

# openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config /etc/pki/tls/openssl.cnf -extensions v3_req

 

  7、配置Nginx SSL 

        listen          443 ssl;

        ssl on;
        ssl_certificate         /etc/nginx/conf.d/server.crt;
        ssl_certificate_key     /etc/nginx/conf.d/server.key;
        ssl_client_certificate  /etc/nginx/conf.d/ca.crt;
 
        ssl_verify_client       off;
        ssl_session_timeout     5m;
        ssl_protocols   SSLv2 SSLv3 TLSv1;
        ssl_ciphers     HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers   on;    

  

 8、客户端导入证书

   证书安装及使用把刚才生成的证书: 根证书ca.crt和客户端client.crt(client.pfx)安装到客户端,ca.crt 安装到信任的机构,client.crt直接在windows 安装或安装到个人证书位置。(如果是IE浏览器,需要安装client.pfx证书,在导入的时候需要输入证书签发的密码)

 

 

-------------------------------------------------------------------  额外的命令  -------------------------------------------------------

证书格式转换:

#IE浏览器需要p12证书,所以需要签发p12证书,用于IE签发:
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

#IOS 证书签发格式
openssl x509 -in client.crt -out client.cer

#Android 证书签发格式
openssl pkcs12 -export -in client.crt -inkey client.key -out  client.pfx

#pem格式证书
openssl pkcs12 -export -in ddmdd_a.pfx -out client.pem
 

 删除私钥密码:

#删除私钥密码
openssl rsa -in client.key -out client_open.key
 

 证书撤销:

echo 01 >  crlnumber
openssl ca -keyfile ca.key -cert ca.crt -revoke  client.crt  #从CA中撤销证书client.crt
openssl ca -gencrl -keyfile ca.key -cert ca.crt -out client.crl  #生成或更新撤销列表

 

 查看证书信息:

openssl x509 -in client.pem -noout -text