EOS节点启用RPC的https

 证书生成

openssl生成证书主要有以下步骤：

1. 生成CA证书

2. 生成Server证书

• 生成CA证书

生成CA私钥

openssl genrsa -out ca.key 2048

生成CA自签名证书

openssl req -new -x509 -days 36500 -key ca.key -out ca.crt

• 生成Server证书

生成server端的私钥key：

openssl genrsa -out server.key 2048

生成server端的req文件（这一步生成的req文件，包含公钥证书，外加身份信息，例如国家，省份，公司等。用它提交给ca，让ca来对它做签名 ）：

openssl req -new -key server.key -out server.csr

用CA的私钥对server的req文件做签名，得到server的证书：

openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

 nodeos启动

需要配置：

       --https-certificate-chain-file  /ssl/server.crt \
       --https-private-key-file /ssl/server.key \

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 36500 -key ca.key -out ca.crt
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

nodeos --producer-name eosio \
       --signature-provider EOS6MRyAjQq8ud7hVNYcfnVPJqcVpscN5So8BhtHuGYqET5GDW5CV=KEY:5KQwrPbwdL6PhXujxW37FSSQZ1JiwsST4cqQzDeyXtP79zkvFD3 \
	   --enable-stale-production \
       --plugin eosio::chain_api_plugin \
       --plugin eosio::producer_api_plugin \
	   --https-server-address 0.0.0.0:443 \
	   --https-certificate-chain-file  /ssl/server.crt \
	   --https-private-key-file /ssl/server.key \
       --http-server-address 0.0.0.0:8888
       
curl https://127.0.0.1:443/v1/chain/get_info --insecure
cleos --no-verify  -u https://127.0.0.1:443 get info

curl 使用选项--cacert ca.crt  --capath /root/ssl 指定CA证书。

curl https://127.0.0.1:443/v1/chain/get_info --cacert ca.crt  --capath /root/ssl -vvv
*   Trying 127.0.0.1:443...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: ca.crt
  CApath: /root/ssl
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: C=nd; ST=nd; L=nd; O=nd; OU=nd; CN=127.0.0.1; emailAddress=nd
*  start date: Feb 21 09:45:27 2023 GMT
*  expire date: Feb 18 09:45:27 2033 GMT
*  common name: 127.0.0.1 (matched)
*  issuer: C=ca; ST=ca; L=ca; O=ca; OU=ca; CN=ca; emailAddress=ca
*  SSL certificate verify ok.
> GET /v1/chain/get_info HTTP/1.1
> Host: 127.0.0.1
> User-Agent: curl/7.68.0
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Connection: close
< Content-Length: 636
< Content-type: application/json
< Server: WebSocket++/0.7.0
< 
* Closing connection 0
* TLSv1.3 (OUT), TLS alert, close notify (256):
{"server_version":"02a237a8","chain_id":"cf057bbfb72640471fd910bcb67639c22df9f92470936cddc1ade0e2f2e7dc4f","head_block_num":445,"last_irreversible_block_num":444,"last_irreversible_block_id":"000001bcb249e0c288339eb1407a694f17f5bdb2bf6f78f439222bfc7bc3caea","head_block_id":"000001bdd45c8807b846438005dbbef8f35cf936d1505bebef906d0ef1bd4b2e","head_block_time":"2023-02-21T09:51:10.000","head_block_producer":"eosio","current_view":0,"target_view":1,"last_stable_checkpoint_block_num":0,"virtual_block_cpu_limit":311576,"virtual_block_net_limit":1634747,"block_cpu_limit":199900,"block_net_limit":1048576,"server_version_string":"v3.0.9"}