openssl3.2/test/certs - 074 - CT entry

openssl3.2/test/certs - 074 - CT entry

概述

openssl3.2 - 官方demo学习 - test - certs

笔记

setup074.sh

#! /bin/bash

# \file setup074.sh

# openssl3.2/test/certs - 074 - CT entry

# sc1
openssl -v
./mkcert.sh genct server.example embeddedSCTs1-key embeddedSCTs1 embeddedSCTs1_issuer-key embeddedSCTs1_issuer ct-server-key

# sc2
openssl -v
OPENSSL_SIGALG= OPENSSL_KEYALG=ed448 ./mkcert.sh genroot "Root Ed448" root-ed448-key root-ed448-cert

# sc3
openssl -v
OPENSSL_SIGALG=ED448 OPENSSL_KEYALG=ed448 ./mkcert.sh genee ed448 server-ed448-key server-ed448-cert root-ed448-key root-ed448-cert

官方脚本报错, 分为3个小脚本做实验

setup074_sc1.sh

/*!
* \file D:\my_dev\my_local_git_prj\study\openSSL\test_certs\074\my_openssl_linux_doc_074_sc1.txt
* \note 
*/

// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
#! /bin/bash

# \file setup074.sh

# openssl3.2/test/certs - 074 - CT entry

# sc1
openssl -v
./mkcert.sh genct server.example embeddedSCTs1-key embeddedSCTs1 embeddedSCTs1_issuer-key embeddedSCTs1_issuer ct-server-key


// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------
// cmd 1
// cfg_exp074_sc1_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key embeddedSCTs1-key.pem -config cfg_exp074_sc1_cmd1.txt -out req_exp074_sc1_cmd1.pem

// cmd 2
// cfg_exp074_sc1_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.3 = critical,ASN1:NULL
subjectAltName = @alts
[alts]
DNS=server.example

// ok
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile cfg_exp074_sc1_cmd2.txt -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525 -in req_exp074_sc1_cmd1.pem

// cmd 3
// cfg_exp074_sc1_cmd3.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.2 = ASN1:FORMAT:HEX,OCT:00780076subjectAltName = @alts
DNS=server.example
[alts]

// err
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile cfg_exp074_sc1_cmd3.txt -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525 -in req_exp074_sc1_cmd1.pem

报错如下:
Error checking extension section default
88140400:error:07800066:common libcrypto routines:hexstr2buf_sep:illegal hex digit:crypto\o_str.c:158:
88140400:error:068000B2:asn1 encoding routines:asn1_str2type:illegal hex:crypto\asn1\asn1_gen.c:696:string=00780076subjectAltName = @alts
88140400:error:11000074:X509 V3 routines:v3_generic_extension:extension value error:crypto\x509\v3_conf.c:260:value=FORMAT:HEX,OCT:00780076subjectAltName = @alts

原因 [alts]节中是空的, 没写内容

// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------

openssl -v 
openssl req -new -sha256 -key embeddedSCTs1-key.pem -config /dev/fd/63 

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt



string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile /dev/fd/63 -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525 

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt



subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.3 = critical,ASN1:NULL
subjectAltName = @alts
[alts]
DNS=server.example
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile /dev/fd/63 -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525 

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt



subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.2 = ASN1:FORMAT:HEX,OCT:00780076subjectAltName = @alts
DNS=server.example
[alts]

setup074_sc2.sh

/*!
* \file D:\my_dev\my_local_git_prj\study\openSSL\test_certs\074\my_openssl_linux_doc_074_sc2.txt
* \note 
*/

// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
#! /bin/bash

# \file setup074.sh

# openssl3.2/test/certs - 074 - CT entry

# sc2
openssl -v
OPENSSL_SIGALG= OPENSSL_KEYALG=ed448 ./mkcert.sh genroot "Root Ed448" root-ed448-key root-ed448-cert


// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------
// cmd 1
openssl genpkey -algorithm ed448 -out root-ed448-key.pem 

// cmd 2
// cfg_exp074_sc2_cmd2.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Root Ed448

openssl req -new -sha256 -key root-ed448-key.pem -config cfg_exp074_sc2_cmd2.txt -out req_exp074_sc2_cmd2.pem

// cmd 3
// cfg_exp074_sc2_cmd3.txt
basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid

openssl x509 -req -sha256 -out root-ed448-cert.pem -extfile cfg_exp074_sc2_cmd3.txt -signkey root-ed448-key.pem -set_serial 1 -days 36525 -in req_exp074_sc2_cmd2.pem

// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------
openssl genpkey -algorithm ed448 -out root-ed448-key.pem 
openssl req -new -sha256 -key root-ed448-key.pem -config /dev/fd/63 

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt



string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Root Ed448
openssl x509 -req -sha256 -out root-ed448-cert.pem -extfile /dev/fd/63 -signkey root-ed448-key.pem -set_serial 1 -days 36525 

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt



basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid

setup074_sc3.sh

/*!
* \file D:\my_dev\my_local_git_prj\study\openSSL\test_certs\074\my_openssl_linux_doc_074_sc3.txt
* \note 
*/

// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
#! /bin/bash

# \file setup074.sh

# openssl3.2/test/certs - 074 - CT entry

# sc3
openssl -v
OPENSSL_SIGALG=ED448 OPENSSL_KEYALG=ed448 ./mkcert.sh genee ed448 server-ed448-key server-ed448-cert root-ed448-key root-ed448-cert

// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------
// cmd 1
openssl genpkey -algorithm ed448 -out server-ed448-key.pem 

// cmd 2
// cfg_exp074_sc3_cmd2.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = ed448

// 这里只生成了一个证书请求, 这是干啥?
openssl req -new -ED448 -key server-ed448-key.pem -config cfg_exp074_sc3_cmd2.txt

// 报错 : req: Unknown option or message digest: ED448
// 官方脚本单独运行, 是看不到任何报错信息的.

// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------
openssl genpkey -algorithm ed448 -out server-ed448-key.pem 
openssl req -new -ED448 -key server-ed448-key.pem -config /dev/fd/63 

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt



string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = ed448

END