openssl命令

openssl
组件：
libcrypto, libssl主要开发者使用；
openssl: 多用途命令行工具；

 openssl: 从多子命令 分为三类： 标准命令： 消息摘要命令（dgst子命令） 加密命令（enc子命令）

---

 对称加密： 工具：openssl enc 支持的算法：3des,aes,blowfish,towfish 加密命令 enc命令： 实例： 加密~]# openssl enc -e -des3 -a -salt -in fstab -out fstab.ciphertext 解密~]# openssl enc -d -des3 -a -salt -out fstab -in fstab.ciphertext

---

 单向加密： 工具：openssl dgst, md5sum, sha1sum, sha224sum,.... dgst命令： ~]# openssl dgst -md5 fstab MD5(fstab)= f24b68951add3236d19dff63f0c92206

---

 生成用户密码： 工具： passwd, openssl passwd ~]#openssl passwd -1 -salt 随机数（123456789） 实例： [root@localhost ~]# openssl passwd -1 -salt $(openssl rand -hex 10) Password: $1$9727a8fa$Ir21xFr8gVZJFK1trPohf. 生成随机数： 工具：openssl rand 实例： [root@localhost ~]# openssl rand -hex 10 8a7f0ab5316d5c0f2aba [root@localhost ~]# openssl rand -base64 10 G8mVfr06RCHmhQ==

---

 公钥加密： 加密解密： 算法：RSA, ELGamal 工具：openssl rsautl, gpg 数字签名： 算法：RSA, DSA，ELGamal 密钥交换： 算法：DH 生成密钥： 生成私钥： ~]# (umask 077; openssl genrsa -out /tmp/mykey.private 2048) 提出公钥：~]# openssl rsa -in /tmp/mykey.private -pubout linux系统上的随机数生成器： /dev/random:仅从熵池返回随机数；随机数用尽，阻塞； /dev/urandom:从熵池返回随机数；随机数用尽，会利用软件生成伪随机数，非阻塞； 伪随机数不安全； 熵池中随机数的来源； 硬盘IO中断时间间隔； 键盘IO中断时间间隔；

---

---

 CA: 公共信任的CA,私用CA; openssl 命令: 配置文件：~]# cat /etc/pki/tls/openssl.cnf 

---

---

 `**构建私有CA:` 在确定配置为CA的服务上生成一个自签证书，并为CA提供所需要的目录及文件即可； 步骤： 1.生成私钥： ~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096) 2.生成自签证书： -new:生成新证书签署请求； -x509:生成自签格式证书，专用于创建私有CA时； -key:生成请求时用到的私有文件路径； -out:生成的请求文件路径；如果自签操作将直接生成签署过的证书； -days:证书的有效时长，单位是day; ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:guangdong Locality Name (eg, city) [Default City]:shenzhen Organization Name (eg, company) [Default Company Ltd]:itxuezhe Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server's hostname) []:ca.itxuezhe.com Email Address []:caadmin@itxuezhe.com [root@localhost ~]# ls /etc/pki/CA/ caert.pem certs crl newcerts private 3.为CA提供所需的目录及文件； ~]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts} ~]# touch /etc/pki/CA/{serial,index.txt} ~]# echo 01 > /etc/pki/CA/serial ** 

---

要用到证书进行通信的服务器，需要向CA请求签署证书：

 步骤：（以httpd主机为例） 1.用到证书的主机生成证书签署请求； ~]# mkdir /etc/httpd/ssl ~]# cd /etc/httpd/ssl ssl]# (umask 077; openssl genrsa -out httpd.key 2048) 3.2.生成证书签署请求 [root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr -days 365 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:guangdong Locality Name (eg, city) [Default City]:shenzhen Organization Name (eg, company) [Default Company Ltd]:itxuezhe Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server's hostname) []:www.itxuezhe.com Email Address []:web@itxuezhe.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@localhost ssl]# ll 总用量 8 -rw-r--r--. 1 root root 1078 12月 10 11:24 httpd.csr -rw-------. 1 root root 1679 12月 10 11:20 httpd.key 3.将请求通过可靠方式发送给CA主机； ssl]# scp httpd.csr root@192.168.80.16:/tmp/ root@192.168.80.16's password: httpd.csr 4.在CA主机上签署证书； [root@localhost ~]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Dec 10 03:29:20 2019 GMT Not After : Dec 9 03:29:20 2020 GMT Subject: countryName = CN stateOrProvinceName = guangdong organizationName = itxuezhe organizationalUnitName = ops commonName = www.itxuezhe.com emailAddress = web@itxuezhe.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: D9:B4:2D:FB:4C:5B:EC:8D:5E:90:9F:1B:C6:61:65:0C:FB:94:59:8C X509v3 Authority Key Identifier: keyid:44:C1:C1:A7:B5:5F:15:15:06:8B:3B:7C:15:CB:5E:B4:A6:19:FD:5E Certificate is to be certified until Dec 9 03:29:20 2020 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated 证书签署成功 ~]# cd /etc/pki/CA/ CA]# cat index.txt V 201209032920Z 01 unknown/C=CN/ST=guangdong/O=itxuezhe/OU=www.itxuezhe.com/CN=www.itxuezhe.com/emailAddress=web@itxuezhe.com 将签署成功的证书发送给申请证书的主机 CA]# scp certs/httpd.crt root@192.168.80.17:/etc/httpd/ssl/ The authenticity of host '192.168.80.17 (192.168.80.17)' can't be established. ECDSA key fingerprint is SHA256:iyMPO9k4t5oUNnOcDCOkJTLBLOSBKKPRuR9AugKmftM. ECDSA key fingerprint is MD5:73:2e:7e:37:b4:48:b9:45:3e:96:f1:ec:6a:9a:59:fd. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.80.17' (ECDSA) to the list of known hosts. root@192.168.80.17's password: httpd.crt 查看证书中的信息： [root@localhost ssl]# openssl x509 -in httpd.crt -noout -serial -subject serial=01 subject= /C=CN/ST=guangdong/O=itxuezhe/OU=www.itxuezhe.com/CN=www.itxuezhe.com/emailAddress=web@itxuezhe.com 吊销证书： 步骤： 1.客户端获取要吊销的证书的serial (在使用证书的主机执行)； [root@localhost ssl]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -seral -subject 2.CA主机吊销证书 先根据客户端提交的serial和subject信息，对比其与本机数据库index.txt中存储的是否一致； 吊销： [root@localhost CA]# openssl ca -revoke /etc/pki/CA/newcerts/SERIAL.pem [root@localhost CA]# openssl ca -revoke /etc/pki/CA/newcerts/01.pem 其中的SERIAL要换成证书真正的序列号; 3.生成吊销证书的吊销编号（第一次吊销证书时执行） CA]# echo 01 > /etc/pki/CA/crlnumber 4.更新证书吊销列表 CA]# openssl ca -gencrl -out thisca.crl 查看crl文件： ]# openssl crl -in /PATH/FROM/CRL_FILE.crl -noout -text