GmSSL证书生成及验证C/S通信双向认证

1.https://github.com/guanzhi/GmSSL下载源码，解压后到源码目录下执行以下命令：
./config
make
make install //必须安装，否则后续执行gmssl会因为打开openssl.cnf出错。gmssl内部处理问题
2.证书生成准备：
cd apps/demoCA/
mkdir certs crl newcerts private
touch index.txt
echo "01" > serial
3.生成根证书：
gmssl ecparam -genkey -name sm2p256v1 -text -out Root.key #生成私钥
gmssl req -new -key Root.key -out Root.req #证书请求
gmssl x509 -req -days 3650 -sm3 -in Root.req -signkey Root.key -out RootCA.crt #生成根证书
4.生成服务端证书
gmssl ecparam -genkey -name sm2p256v1 -text -out Server.key #生成私钥
gmssl req -new -key Server.key -out Server.req #证书请求
gmssl x509 -req -sm3 -days 3650 -CA RootCA.crt -CAkey Root.key -CAcreateserial -in Server.req -out ServerCA.crt #签发证书
gmssl verify -CAfile RootCA.crt ServerCA.crt #证书验证
gmssl x509 -in ServerCA.crt -text -noout #查看证书
5.生成客户端证书
gmssl ecparam -genkey -name sm2p256v1 -text -out Client.key #生成私钥
gmssl req -new -key Client.key -out Client.req #证书请求
gmssl x509 -req -sm3 -days 3650 -CA RootCA.crt -CAkey Root.key -CAcreateserial -in Client.req -out ClientCA.crt #签发证书
gmssl verify -CAfile RootCA.crt ClientCA.crt #证书验证
gmssl x509 -in ClientCA.crt -text -noout #查看证书
6.客户端/服务端通信验证
gmssl s_server -accept 443 -key Server.key -cert ServerCA.crt -dkey Server.key -dcert ServerCA.crt -CAfile RootCA.crt -msg -debug -gmtls #服务端
gmssl s_client -connect 127.0.0.1:443 -key Client.key -cert ClientCA.crt -CAfile RootCA.crt -msg -debug -gmtls#客户端

注：由于使用gmtls时，gmssl内部要求服务指定双证书(签名证书和加密证书)，此处使用同一个证书ServerCA.crt

证书生成脚本：

#!/bin/sh
#Generate GM certificate files
#Author : xiejianjun
#Date : 2020-07-28
CurPath=`dirname $(readlink -f $0)`GmsslRootPath=/projects/GmSSL
GmsslBin=${GmsslRootPath}/apps/gmssl
DemoCaDir=${GmsslRootPath}/apps/demoCA/
CertDir=${DemoCaDir}/certs/
KeyDir=${CertDir}
CrlDir=${DemoCaDir}/crl/
ReqDir=${DemoCaDir}/reqs/CertDays=1500CACertFile=CA.cert.pem
CAKeyFile=CA.key.pem
CA_DN_STRING="/C=CN/ST=SiChuan/L=ChengDu/O=ChengDu XXX Technology LTD./OU=XXX/CN=CA (GM)"
CAReqFile=CA.reqSSCertFile=SS.cert.pem
SSKeyFile=SS.key.pem
SS_DN_STRING="/C=CN/ST=SiChuan/L=ChengDu/O=ChengDu XXX Technology LTD./OU=XXX/CN=Server Sign (GM)"
SSReqFile=SS.reqSECertFile=SE.cert.pem
SEKeyFile=SE.key.pem
SE_DN_STRING="/C=CN/ST=SiChuan/L=ChengDu/O=ChengDu XXX Technology LTD./OU=XXX/CN=Server Encrypt (GM)"
SEReqFile=SE.reqCSCertFile=CS.cert.pem
CSKeyFile=CS.key.pem
CS_DN_STRING="/C=CN/ST=SiChuan/L=ChengDu/O=ChengDu XXX Technology LTD./OU=XXX/CN=Client Sign (GM)"
CSReqFile=CS.reqCECertFile=CE.cert.pem
CEKeyFile=CE.key.pem
CE_DN_STRING="/C=CN/ST=SiChuan/L=ChengDu/O=ChengDu XXX Technology LTD./OU=XXX/CN=Client Encrypt (GM)"
CEReqFile=CE.reqif [ ! -d "${GmsslRootPath}" ];thenecho "GmSSL path DONOT exist!"exit 2
fiexport LD_LIBRARY_PATH=${GmsslRootPath}rm -rf "${GmsslRootPath}/apps/demoCA/"
mkdir -p "${CertDir}"
mkdir -p "${KeyDir}"
mkdir -p "${CrlDir}"
mkdir -p "${ReqDir}"echo "#######################################################################################################"
echo "Generate CA certificate file..."
${GmsslBin} ecparam -name sm2p256v1 -out "${DemoCaDir}/SM2.pem"
${GmsslBin} req -config "${GmsslRootPath}/apps/openssl.cnf" -nodes -subj "${CA_DN_STRING}" \-keyout "${KeyDir}/${CAKeyFile}" -newkey "ec:${DemoCaDir}/SM2.pem" \-new -out "${ReqDir}/${CAReqFile}"#Sign CA certificate with CAKeyFile
${GmsslBin} x509 -sm3 -req -days ${CertDays} -in "${ReqDir}/${CAReqFile}" \-extfile "${GmsslRootPath}/apps/openssl.cnf" -extensions v3_ca -signkey "${KeyDir}/${CAKeyFile}" \-CAcreateserial -out "${CertDir}/${CACertFile}"#Print CA certificate file
${GmsslBin} x509 -in "${CertDir}/${CACertFile}" -noout -textecho "#######################################################################################################"
echo "Generate Server sign certificate file..."
${GmsslBin} req -config "${GmsslRootPath}/apps/openssl.cnf" -nodes -subj "${SS_DN_STRING}" \-keyout "${KeyDir}/${SSKeyFile}" -newkey "ec:${DemoCaDir}/SM2.pem" \-new -out "${ReqDir}/${SSReqFile}"#Sign SS certificate with CAKeyFile
${GmsslBin} x509 -sm3 -req -days ${CertDays} -in "${ReqDir}/${SSReqFile}" \-CA "${CertDir}/${CACertFile}" -CAkey "${KeyDir}/${CAKeyFile}" \-extfile "${GmsslRootPath}/apps/openssl.cnf" -extensions v3_req \-CAcreateserial -out "${CertDir}/${SSCertFile}"#Print SS certificate file
${GmsslBin} x509 -in "${CertDir}/${SSCertFile}" -noout -textecho "#######################################################################################################"
echo "Generate Server encrypt certificate file..."
${GmsslBin} req -config "${GmsslRootPath}/apps/openssl.cnf" -nodes -subj "${SE_DN_STRING}" \-keyout "${KeyDir}/${SEKeyFile}" -newkey "ec:${DemoCaDir}/SM2.pem" \-new -out "${ReqDir}/${SEReqFile}"#Sign SE certificate with CAKeyFile
${GmsslBin} x509 -sm3 -req -days ${CertDays} -in "${ReqDir}/${SEReqFile}" \-CA "${CertDir}/${CACertFile}" -CAkey "${KeyDir}/${CAKeyFile}" \-extfile "${GmsslRootPath}/apps/openssl.cnf" -extensions v3_req\-CAcreateserial -out "${CertDir}/${SECertFile}"#Print SE certificate file
${GmsslBin} x509 -in "${CertDir}/${SECertFile}" -noout -textecho "#######################################################################################################"
echo "Generate Client sign certificate file..."
${GmsslBin} req -config "${GmsslRootPath}/apps/openssl.cnf" -nodes -subj "${CS_DN_STRING}" \-keyout "${KeyDir}/${CSKeyFile}" -newkey "ec:${DemoCaDir}/SM2.pem" \-new -out "${ReqDir}/${CSReqFile}"#Sign CS certificate with CAKeyFile
${GmsslBin} x509 -sm3 -req -days ${CertDays} -in "${ReqDir}/${CSReqFile}" \-CA "${CertDir}/${CACertFile}" -CAkey "${KeyDir}/${CAKeyFile}" \-extfile "${GmsslRootPath}/apps/openssl.cnf" -extensions v3_req \-CAcreateserial -out "${CertDir}/${CSCertFile}"#Print CS certificate file
${GmsslBin} x509 -in "${CertDir}/${CSCertFile}" -noout -textecho "#######################################################################################################"
echo "Generate Client encrypt certificate file..."
${GmsslBin} req -config "${GmsslRootPath}/apps/openssl.cnf" -nodes -subj "${CE_DN_STRING}" \-keyout "${KeyDir}/${CEKeyFile}" -newkey "ec:${DemoCaDir}/SM2.pem" \-new -out "${ReqDir}/${CEReqFile}"#Sign CE certificate with CAKeyFile
${GmsslBin} x509 -sm3 -req -days ${CertDays} -in "${ReqDir}/${CEReqFile}" \-CA "${CertDir}/${CACertFile}" -CAkey "${KeyDir}/${CAKeyFile}" \-extfile "${GmsslRootPath}/apps/openssl.cnf" -extensions v3_req\-CAcreateserial -out "${CertDir}/${CECertFile}"#Print CE certificate file
${GmsslBin} x509 -in "${CertDir}/${CECertFile}" -noout -text

GmSSL证书生成及验证C/S通信双向认证相关推荐

APNS推送证书生成与验证
要进行推送服务的第一件事就是获取推送证书.它用来对你通过SSL与APNS通讯进行识别. 一.在Mac上生成 Apple推送通知SSL证书: 1.1.登录到 iPhone Developer Conne ...
TLS/HTTPS 证书生成与验证
https://www.cnblogs.com/kyrios/p/tls-and-certificates.html 最近在研究基于ssl的传输加密,涉及到了key和证书相关的话题,走了不少弯路,现在 ...
https ssl单项认证和双向认证以及证书生成
HTTP(HyperText Transfer Protocol,超文本传输协议)被用于在Web浏览器和网站服务器之间传递信息,在TCP/IP中处于应用层.这里提一下TCP/IP的分层共分为四层:应用 ...
【SSL】ssl证书简介、ssl证书生成工具与ssl证书生成步骤
ssl证书简介.ssl证书生成工具与ssl证书生成步骤一.ssl证书是什么? 二.ssl证书生成工具有哪些? 2.1.工具一:CFSSL 2.2.工具二:OpenSSL 2.3.工具三:XCA 三. ...
TLS双向认证之生成双端证书信息
目录 TLS双向认证需要的认证文件制作根证书第三方机构的根证书自签根证书(基于openssl) 根证书签发证书服务端证书客户端证书最终需要使用的文件 TLS双向认证需要的认证文件服务端: ...
[免费专栏] Android安全之绕过直连、HOST校验、系统证书校验、代理检测、双向认证抓HTTPS数据
也许每个人出生的时候都以为这世界都是为他一个人而存在的,当他发现自己错的时候,他便开始长大少走了弯路,也就错过了风景,无论如何,感谢经历 Android安全付费专栏长期更新,本篇最新内容请前往: [ ...
ssl证书CA双向认证完整实现步骤（附java客户端代码）（好文章！）
一.基础概念注:以下概念除专业名词外,均为个人理解,不具备权威性. 1.什么是系统安全管理置于公网的系统,通常都需要一定的安全管理,据我个人理解,这里的安全管理主要分三个方面: 一是应用内的权限控 ...
firefox+linux+nginx搭建server与client通过证书双向认证环境
项目中需要搭建一个server和client基于证书的双向认证环境.由我来做,我也不会. 经过一晚上的研究,基本摸清了(知其然不知其所以然).做下笔记. 基本环境: 1.安装nginx. 2.安装op ...
yum https ssl双向认证证书申请
本文将着重介绍从ssl证书申请到搭建yum使用https双向认证完成rpm包安装的流程,具体https双向认证的原理在这不做详细的描述,认证的详细描述的原理可以参考: https://blog.csd ...

GmSSL证书生成及验证C/S通信双向认证

GmSSL证书生成及验证C/S通信双向认证相关推荐

最新文章

热门文章