学习笔记

主题

签名证书 ​

更新: 2/10/2025 字数: 0 字 时长: 0 分钟

证书格式 ​

格式常见后缀编码方式文件格式使用用途
PEM.pem, .crtBase64编码文本格式常见的HTTPS、TLS等SSL证书
DER.cer, .crt二进制格式二进制格式通常用于Java应用，Windows系统中较常见
PFX/PKCS#12.pfx, .p12二进制格式二进制格式用于包含私钥和证书链的证书文件，Windows证书存储

证书生成 ​

OpenSSL ​

OpenSSL官方文档: https://www.openssl.org/docs/manpages.html GitHub仓库: https://github.com/openssl/openssl/releases

shell
###### 生成CA证书
openssl genrsa -aes256 -passout pass:admin@123 -out ca_private.key 2048
openssl rsa -in ca_private.key -passin pass:admin@123 -pubout -out ca_public.key
openssl req -new -sha256 -key ca_private.key -passin pass:admin@123 -out ca.csr -subj "/C=CN/ST=BJ/L=BJ/O=navi/OU=develop/CN=*.haijunit.top/emailAddress=zhanghaijun_java@163.com"
openssl x509 -req -sha256 -extensions v3_ca -signkey ca_private.key -passin pass:admin@123 -in ca.csr -days 365 -out ca.pem
openssl pkcs12 -export -passin pass:admin@123 -in ca.pem -inkey ca_private.key -passout pass:admin@123 -out ca.p12
openssl x509 -in ca.pem -outform DER -out ca.cer

###### 使用CA证书签署server端证书
openssl genrsa -aes256 -passout pass:admin@123 -out server_private.key 2048
openssl req -new -sha256 -key server_private.key -passin pass:admin@123 -out server.csr -subj "/C=CN/ST=BJ/L=BJ/O=navi/OU=develop/CN=SERVER/emailAddress=zhanghaijun_java@163.com"
openssl x509 -req -sha256 -extensions v3_req -CA ca.pem -CAkey ca_private.key -CAcreateserial -passin pass:admin@123 -in server.csr -days 365 -out server.pem
openssl pkcs12 -export -passin pass:admin@123 -in server.pem -inkey server_private.key -passout pass:admin@123 -out server.p12
openssl x509 -in server.pem -outform DER -out server.cer
## 使用CA证书验证server端证书
openssl verify -CAfile ca.pem  server.pem

###### 使用CA证书验证client端证书
openssl genrsa -aes256 -passout pass:admin@123 -out client_private.key 2048
openssl req -new -sha256 -key client_private.key -passin pass:admin@123 -out client.csr -subj "/C=CN/ST=BJ/L=BJ/O=navi/OU=develop/CN=CLIENT/emailAddress=zhanghaijun_java@163.com"
openssl x509 -req -sha256 -extensions v3_req -CA ca.pem -CAkey ca_private.key -CAcreateserial -passin pass:admin@123 -in client.csr -days 365 -out client.pem
openssl pkcs12 -export -passin pass:admin@123 -in client.pem -inkey client_private.key -passout pass:admin@123 -out client.p12
openssl x509 -in client.pem -outform DER -out client.cer
## 使用CA证书验证server端证书
openssl verify -CAfile ca.pem  client.pem
shell
######（四）测试
### 单向认证命令行：
#服务器：
openssl s_server -CAfile ca.pem -cert server.cer -key server_private.key -accept 22580
#客户端：
openssl s_client -CAfile ca.pem -cert client.cer -key client_private.key -connect 127.0.0.1 -port 22580
### 双向认证：
#服务器：
openssl s_server -CAfile ca.pem -cert server.cer -key server_private.key -accept 22580 -Verify 1
#客户端：
openssl s_client -CAfile ca.pem -cert server.cer -key server_private.key -cert client.cer -key client_private.key -connect 127.0.0.1 -port 22580
shell
## 已有证书 web.p12
openssl pkcs12 -in web.p12 -nocerts -out web_private.pem -passin pass:admin@123 -passout pass:admin@123
openssl rsa -in web_private.pem -pubout -out web_public.pem -passin pass:admin@123
openssl pkcs12 -in web.p12 -clcerts -nokeys -out web.pem -passin pass:admin@123
openssl x509 -in web.pem -outform DER -out web.der
## 提取 CA 证书（如果有）
openssl pkcs12 -in web.p12 -cacerts -nokeys -out ca.pem -passin pass:admin@123
openssl x509 -in ca.pem -outform DER -out ca.der
shell
#生成RSA私钥(无加密)
openssl genrsa -out rsa_private.key 2048
#生成RSA公钥
openssl rsa -in rsa_private.key -pubout -out rsa_public.key

#生成RSA私钥(使用aes256加密)
openssl genrsa -aes256 -passout pass:admin@123 -out rsa_aes_private.key 2048
#此时若生成公钥，需要提供密码
openssl rsa -in rsa_aes_private.key -passin pass:admin@123 -pubout -out rsa_public.key

## 转换命令 | 私钥转非加密
openssl rsa -in rsa_aes_private.key -passin pass:admin@123 -out rsa_private.key
## 转换命令 | 私钥转加密
openssl rsa -in rsa_private.key -aes256 -passout pass:admin@123 -out rsa_aes_private.key
## 转换命令 | 私钥PEM转DER
openssl rsa -in rsa_private.key -outform der-out rsa_aes_private.der
## 转换命令 | 查看私钥明细
openssl rsa -in rsa_private.key -noout -text
## 转换命令 | 私钥PKCS#1转PKCS#8
openssl pkcs8 -topk8 -in rsa_private.key -passout pass:admin@123 -out pkcs8_private.key

JDK keytool ​

可视化工具：https://keystore-explorer.org/index.html

shell
keytool -genkeypair -v -keyalg RSA -keysize 2048 -validity 365 -alias nginx -keystore keystore.jks -storepass admin@123 -keypass admin@123 -dname "emailAddress=zhanghaijun_java@163.com, CN=*.haijunit.top, O=navi, OU=develop, L=Beijing, ST=Beijing, C=CN" -ext "SAN=DNS:localhost,DNS:*.haijunit.com,ip:127.0.0.1"
keytool -exportcert -alias nginx -keystore keystore.jks -rfc -file nginx.pem -storepass admin@123
keytool -exportcert -alias nginx -keystore keystore.jks -file nginx.cer -storepass admin@123
keytool -importkeystore -srckeystore keystore.jks -destkeystore nginx.p12 -deststoretype PKCS12 -srcstorepass admin@123 -deststorepass admin@123

## keytool无法导出私钥，需要借助openssl

国密证书 ​

GMSSL国密试验室网站生成: https://www.gmssl.cn/gmssl/index.jsp