openssl nodejs https+客户端证书+usbkey
mac sslconfig 文件路径
/System/Library/OpenSSL/openssl.cnf
一生成CA
openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf
cdpmacdeMBP:mkssl3 cdpmac$ openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf Generating a 1024 bit RSA private key .++++++ ......................++++++ writing new private key to 'ca.key' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Dongcheng Organization Name (eg, company) [Internet Widgits Pty Ltd]:Go Organizational Unit Name (eg, section) []:Audit Common Name (e.g. server FQDN or YOUR name) []:CA Email Address []:
二生成 客户端和服务器端的私钥(key文件):
openssl genrsa -des3 -out server.key 1024
openssl genrsa -des3 -out client.key 1024
三生成的csr文件
服务端
cdpmacdeMBP:mkssl3 cdpmac$ openssl req -new -key server.key -out server.csr -config openssl.cnf Enter pass phrase for server.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Dongcheng Organization Name (eg, company) [Internet Widgits Pty Ltd]:Go Organizational Unit Name (eg, section) []:Audit Common Name (e.g. server FQDN or YOUR name) []www.httpsserver.com ^ Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
客户端
cdpmacdeMBP:mkssl3 cdpmac$ openssl req -new -key client.key -out client.csr -config openssl.cnf Enter pass phrase for client.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Dongcheng Organization Name (eg, company) [Internet Widgits Pty Ltd]:Go Organizational Unit Name (eg, section) []:Audit Common Name (e.g. server FQDN or YOUR name) []:www.httpsclient.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
签名
cdpmacdeMBP:mkssl3 cdpmac$ Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf Using configuration from openssl.cnf Enter pass phrase for ca.key: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Jul 8 06:53:06 2015 GMT Not After : Jul 7 06:53:06 2016 GMT Subject: countryName = CN stateOrProvinceName = Beijing organizationName = Go organizationalUnitName = Audit commonName = www.httpsserver.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 7F:77:31:A8:3F:83:B8:21:2F:0D:B4:96:F2:71:5F:E5:1E:98:5E:89 X509v3 Authority Key Identifier: keyid:B6:D8:38:A3:C2:84:D1:66:8F:86:69:C4:75:FA:69:C4:C4:1A:DA:43 Certificate is to be certified until Jul 7 06:53:06 2016 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
cdpmacdeMBP:mkssl3 cdpmac$ Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf Using configuration from openssl.cnf Enter pass phrase for ca.key: 42576:error:28069065:lib(40):UI_set_result:result too small:/SourceCache/OpenSSL098/OpenSSL098-52.20.2/src/crypto/ui/ui_lib.c:850:You must type in 4 to 1023 characters Enter pass phrase for ca.key: 42576:error:28069065:lib(40):UI_set_result:result too small:/SourceCache/OpenSSL098/OpenSSL098-52.20.2/src/crypto/ui/ui_lib.c:850:You must type in 4 to 1023 characters Enter pass phrase for ca.key: Enter pass phrase for ca.key: Enter pass phrase for ca.key: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Jul 8 06:54:05 2015 GMT Not After : Jul 7 06:54:05 2016 GMT Subject: countryName = CN stateOrProvinceName = Beijing organizationName = Go organizationalUnitName = Audit commonName = www.httpsclient.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: F3:B9:6E:AB:58:29:FE:0D:E2:62:3D:3B:DD:7C:CC:03:16:7B:48:7F X509v3 Authority Key Identifier: keyid:B6:D8:38:A3:C2:84:D1:66:8F:86:69:C4:75:FA:69:C4:C4:1A:DA:43 Certificate is to be certified until Jul 7 06:54:05 2016 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
注意
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Go 必须相同
需要为
Common Name (e.g. server FQDN or YOUR name) []www.httpsserver.com 配置host
1.首先要生成服务器端的私钥(key文件):
openssl genrsa -des3 -out server.key 1024
运行时会提示输入密码,此密码用于加密key文件(参数des3便是指加密算法,当然也可以选用其他你认为安全的算法.),以后每当需读取此文件(通过openssl提供的命令或API)都需输入口令.如果觉得不方便,也可以去除这个口令,但一定要采取其他的保护措施!
去除key文件口令的命令:
openssl rsa -in server.key -out server.key
2.openssl req -new -key server.key -out server.csr -config openssl.cnf
生成Certificate Signing Request（CSR）,生成的csr文件交给CA签名后形成服务端自己的证书.屏幕上将有提示,依照其指示一步一步输入要求的个人信息即可.
3.对客户端也作同样的命令生成key及csr文件:
openssl genrsa -des3 -out client.key 1024
openssl req -new -key client.key -out client.csr -config openssl.cnf
4.CSR文件必须有CA的签名才可形成证书.可将此文件发送到verisign等地方由它验证,要交一大笔钱,何不自己做CA呢.
openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf
5.用生成的CA的证书为刚才生成的server.csr,client.csr文件签名:
Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
这两步会报错因为没有文件
mkdir ./demoCA
654 mkdir demoCA/newcerts
655 touch demoCA/index.txt
656 vi demoCA/serial
输入01 退出
Openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
再生成
Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
时出错
cdpmacdeMBP:mkssl3 cdpmac$ openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
Using configuration from openssl.cnf
Enter pass phrase for ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 4 (0x4)
Validity
Not Before: Jul 8 06:14:48 2015 GMT
Not After : Jul 7 06:14:48 2016 GMT
Subject:
countryName = CN
stateOrProvinceName = Beijing
organizationName = Goyoo
organizationalUnitName = Audit
commonName = Cuidapeng
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
7E:A5:DA:92:0C:06:7B:2F:84:3C:C6:63:39:5C:B6:47:69:C6:76:3C
X509v3 Authority Key Identifier:
keyid:F0:62:47:E3:7C:56:E0:83:28:EE:D3:D1:F0:C5:46:54:39:39:47:75
Certificate is to be certified until Jul 7 06:14:48 2016 GMT (365 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
查问题知
http://zeldor.biz/2013/11/txt_db-error-number-2-failed-to-update-database/
Because you have generated your own self signed certificate with the same CN (Common Name) information that the CA certificate that you’ve generated before.
之前生成csr时输也的Common Name 是相同的，重新生成一个。
再来
成功