圆月山庄资源网 Design By www.vgjia.com
生成证书链
用脚本生成一个根证书, 一个中间证书(intermediate), 三个客户端证书.
中间证书的域名为 localhost.
#!/bin/bash -x set -e for C in `echo root-ca intermediate`; do mkdir $C cd $C mkdir certs crl newcerts private cd .. echo 1000 > $C/serial touch $C/index.txt $C/index.txt.attr echo ' [ ca ] default_ca = CA_default [ CA_default ] dir = '$C' # Where everything is kept certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. new_certs_dir = $dir/newcerts # default place for new certs. certificate = $dir/cacert.pem # The CA certificate serial = $dir/serial # The current serial number crl = $dir/crl.pem # The current CRL private_key = $dir/private/ca.key.pem # The private key RANDFILE = $dir/.rnd # private random number file nameopt = default_ca certopt = default_ca policy = policy_match default_days = 365 default_md = sha256 [ policy_match ] countryName = optional stateOrProvinceName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [req] req_extensions = v3_req distinguished_name = req_distinguished_name [req_distinguished_name] [v3_req] basicConstraints = CA:TRUE ' > $C/openssl.conf done openssl genrsa -out root-ca/private/ca.key 2048 openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca' openssl genrsa -out intermediate/private/intermediate.key 2048 openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=localhost.' openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt mkdir out for I in `seq 1 3` ; do openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048 openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request done
服务器
nginx 配置
worker_processes 1; events { worker_connections 1024; } stream{ upstream backend{ server 127.0.0.1:8080; } server { listen 8888 ssl; proxy_pass backend; ssl_certificate intermediate.crt; ssl_certificate_key intermediate.key; ssl_verify_depth 2; ssl_client_certificate root.crt; ssl_verify_client optional_no_ca; } }
客户端
curl -I -vv -x https://localhost:8888/ --proxy-cert client1.crt --proxy-key client1.key --proxy-cacert ca.crt https://www.baidu.com/
总结
以上就是这篇文章的全部内容了,希望本文的内容对大家的学习或者工作具有一定的参考学习价值,谢谢大家对的支持。如果你想了解更多相关内容请查看下面相关链接
圆月山庄资源网 Design By www.vgjia.com
广告合作:本站广告合作请联系QQ:858582 申请时备注:广告合作(否则不回)
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件! 如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件! 如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
圆月山庄资源网 Design By www.vgjia.com
暂无评论...
更新日志
2024年07月03日
2024年07月03日
- 群星.2009-重温意难忘5CD【新丽声】【WAV+CUE】
- 群星.1991-CINEPOWER【新艺宝】【WAV+CUE】
- 原画壁纸及美图第265期,无水印可自取
- 原画壁纸及美图第266期,无水印可自取
- 钟离烟霞蔽芾怎么做?烟霞蔽芾饮品配方
- 半吨兄弟《迷人烟嗓》[320K/MP3][123.13MB]
- 半吨兄弟《迷人烟嗓》开盘母带1:1直刻[FLAC/分轨][369.68MB]
- 亦非《浮生(Explicit)》[320K/MP3][124.62MB]
- 三国谋定天下军需补给怎么获得方法介绍
- 吟游战记炼狱使者伊戈尔技能属性效果详解
- 墨剑江湖平民武学怎么搭配 零氪搭配推荐
- 绝区零丽娜关键天赋是什么 丽娜天赋效果解析
- 绝区零丽娜音擎武器怎么选择 丽娜音擎选择推荐
- 绝区零丽娜驱动盘怎么搭配 丽娜驱动及词条选择推荐
- 《艾尔登法环》DLC 帅气Cos武器推荐,强不强另说