时间:2021-05-19
生成证书链
用脚本生成一个根证书, 一个中间证书(intermediate), 三个客户端证书.
中间证书的域名为 localhost.
#!/bin/bash -xset -efor C in `echo root-ca intermediate`; do mkdir $C cd $C mkdir certs crl newcerts private cd .. echo 1000 > $C/serial touch $C/index.txt $C/index.txt.attr echo '[ ca ]default_ca = CA_default[ CA_default ]dir = '$C' # Where everything is keptcerts = $dir/certs # Where the issued certs are keptcrl_dir = $dir/crl # Where the issued crl are keptdatabase = $dir/index.txt # database index file.new_certs_dir = $dir/newcerts # default place for new certs.certificate = $dir/cacert.pem # The CA certificateserial = $dir/serial # The current serial numbercrl = $dir/crl.pem # The current CRLprivate_key = $dir/private/ca.key.pem # The private keyRANDFILE = $dir/.rnd # private random number filenameopt = default_cacertopt = default_capolicy = policy_matchdefault_days = 365default_md = sha256[ policy_match ]countryName = optionalstateOrProvinceName = optionalorganizationName = optionalorganizationalUnitName = optionalcommonName = suppliedemailAddress = optional[req]req_extensions = v3_reqdistinguished_name = req_distinguished_name[req_distinguished_name][v3_req]basicConstraints = CA:TRUE' > $C/openssl.confdoneopenssl genrsa -out root-ca/private/ca.key 2048openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'openssl genrsa -out intermediate/private/intermediate.key 2048openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=localhost.'openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crtmkdir outfor I in `seq 1 3` ; do openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048 openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.requestdone服务器
nginx 配置
worker_processes 1;events { worker_connections 1024;}stream{ upstream backend{ server 127.0.0.1:8080; } server { listen 8888 ssl; proxy_pass backend; ssl_certificate intermediate.crt; ssl_certificate_key intermediate.key; ssl_verify_depth 2; ssl_client_certificate root.crt; ssl_verify_client optional_no_ca; }}客户端
curl \ -I \ -vv \ -x https://localhost:8888/ \ --proxy-cert client1.crt \ --proxy-key client1.key \ --proxy-cacert ca.crt \ https:///总结
以上就是这篇文章的全部内容了,希望本文的内容对大家的学习或者工作具有一定的参考学习价值,谢谢大家对的支持。如果你想了解更多相关内容请查看下面相关链接
声明:本页内容来源网络,仅供用户参考;我单位不保证亦不表示资料全面及准确无误,也不保证亦不表示这些资料为最新信息,如因任何原因,本网内容或者用户因倚赖本网内容造成任何损失或损害,我单位将不会负任何法律责任。如涉及版权问题,请提交至online#300.cn邮箱联系删除。
生成证书链用脚本生成一个根证书,一个中间证书(intermediate),三个客户端证书.脚本来源于(有修改)https://stackoverflow.com
NginxNginx简单介绍一款轻量级的Web服务器/反向代理服务器及电子邮件(IMAP/POP3)代理服务器Nginx命令参数nginx-t测试配置是否正确n
Nginx是一个免费、开源、高性能、可伸缩、可靠、功能全面且流行的HTTP和反向代理服务器,一个邮件代理服务器,以及通用的TCP/UDP代理服务器。Nginx的
nginx不仅可以是http代理服务器,也可以轻松搭建成tcp代理服务器。首先我们看下最新开发版的搭建方法1.安装>wgethttp://nginx.org/d
Nginx(engine-x)是一个开源的高性能HTTP服务器、反向代理和IMAP/POP3代理服务器。nginx杰出的功能有:稳定、丰富的功能集、简单的配置和