HTTPS 原理与证书实践

[root@web01 ~]# cat /etc/redhat-release 
CentOS release 6.9 (Final)
[root@web01 ~]# uname -r
2.6.32-696.el6.x86_64
[root@web01 ~]# sestatus 
SELinux status:                 disabled
[root@web01 ~]# /etc/init.d/iptables status
iptables: Firewall is not running.

[root@web01 ~]# rpm -qa openssl
openssl-1.0.1e-57.el6.x86_64

[root@web01 ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

/etc/pki/tls/openssl.cnf  # 主配置文件位置

openssl enc -des3 -salt -a -in inittab -out initab.des3 # 输入密码后BP加密成功
openssl enc -des3 -d -salt -a -in initab.des3 -out inittab    # 输入钥后即解密成功 

md5sum inittab 
shalsum inittab
openssl dgst -shal inittab      # 利用openssl 生成文件特征码
                                # dgst---表示指定使用摘要命令 
                                # -shal---表示指定摘要命令选用shal算法

openssl  passwd -1  # 采用md5加密用户密码串

openssl rand -base 64 45 # 给出一个任意数字，就会生产任意的随机数

openssl genrsa 1024 >server.key    # 创建私钥信息，并指定私钥的长度为2048，并将生成的私钥信息保存在一个文件中
openssl genrsa -out server.key 1024 # 将私钥信息直接进行保存，加密长度一定要放在输出文件后面
 (umask 077;openssl genrsa -out server1024.key 1024) # 利用小括号，实现子shell功能，临时修改umask，使之创建的私钥文件权限为600

说明：密钥文件也可以进行加密的，并且支持后期手工加密，但不建议加密，每次使用私钥文件还要进行解密，比较麻烦
openssl rsa -in server1024.key -pubout     #读取私钥文件命令

[root@web01 ~]# openssl req -new -x509 -key server1024.key -out server.crt -days 365
参数说明
req         # 用于创建新的证书
new         # 表示创建的是新的证书
x509        # 表示定义证书的格式为标准格式
key         # 表示调用的私钥文件信息
out         # 表示输出证书文件信息
days        # 表示证书的有效期

[root@web01 key]# openssl req -new -x509 -key server1024.key -out server.crt -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN  # 定义生成证书的国家
State or Province Name (full name) []:BJ  # 定义生成证书的省份
Locality Name (eg, city) [Default City]:BJ  # 定义生成证书的城市
Organization Name (eg, company) [Default Company Ltd]:nmtui.com  # 生成证书的组织
Organizational Unit Name (eg, section) []:ops     # 生成证书的职能部门
Common Name (eg, your name or your server's hostname) []:blog.nmtui.com # 主机名称
Email Address []:admin@nmtui.com  # 邮件地址
# 说明：此输出信息非常重要，客户端在获取证书前，会利用主机名与相应服务器之间建立连接，然后获得证书。

[root@web01 key]# openssl x509 -text -in server.crt 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9747921528343358470 (0x874792fbbb49ec06)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=CN, ST=BJ, L=BJ, O=nmtui.com, OU=ops, CN=blog.nmtui.com/emailAddress=admin@nmtui.com

cd /etc/pki/CA/private/         # 进入到私钥保存目录中
(umask 077;openssl genrsa -out ./cakey.pem 2048)  #  创建一个 ca 私钥文件
cd /etc/pki/CA                     # 进入到CA目签发保存目录中
openssl req -new -x509 -key private/cakey.pem -out cacert.pem # 生成自签发证书
# 说明：由于下面配置文件中定义了一些证书信息,所以默认即可。

/etc/pki/tls/openssl.cnf 

# 第一步创建私钥文件：
 (umask 077;openssl genrsa -out httpd.key 1024)        # 模拟客户端，创建web服务的私钥
# 第二步创建证书请求文件
openssl req -new -key httpd.key -out httpd.csr        # 创建向CA申请证书的请求证书
# 第三步将请求文件发送给证书颁发机构

[root@web01 key]# mkdir -p cd /application/nginx/conf/key/
[root@web01 ~]# cd /application/nginx/conf/key/
[root@web01 key]# ll 
total 8
-rw-r--r-- 1 www www 3307 Jan 18 10:48 1_blog.nmtui.com_bundle.crt
-rw-r--r-- 1 www www 1700 Jan 18 10:48 2_blog.nmtui.com.key

[root@web01 ~]# cat /application/nginx/conf/nginx.conf
worker_processes  1;
events {
    worker_connections  1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    client_max_body_size 1000M;
    client_body_buffer_size 10M;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    include extra/blog.conf;
}

[root@web01 ~]# cat /application/nginx/conf/extra/blog.conf 
    server{
        listen       80;
        server_name  blog.nmtui.com;
        rewrite ^(.*) https://$host$1 permanent;
    }
    server {
        listen       443;
        server_name  blog.nmtui.com;
        ssl on;
        ssl_certificate /application/nginx/conf/key/1_blog.nmtui.com_bundle.crt;
        ssl_certificate_key /application/nginx/conf/key/2_blog.nmtui.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        location / {
            root   html/blog;
            try_files $uri $uri/ /index.php?$args;
            index  index.php index.html index.htm;
    }
       rewrite /wp-admin$ $scheme://$host$uri/ permanent;     
       location ~* .*\.(php|php5)?$ {
                    root html/blog;
                    fastcgi_pass  127.0.0.1:9000;
                    fastcgi_index index.php;
                    include fastcgi.conf;
        }
        access_log  logs/access_blog.log  main;
    } 

[root@web01 ~]# cat >> /application/nginx/html/blog/clsn.html <<EOF
web01
https://blog.nmtui.com
EOF

server {
    listen  80;
    server_name blog.nmtui.com;
    rewrite ^(.*)$  https://$host$1 permanent;
}
# 说明：在https配置server基础上再添加http跳转server

server {
        listen       443;
        listen       80;
        server_name  blog.nmtui.com;
        ssl on;
        ssl_certificate /application/nginx/conf/key/1_blog.nmtui.com_bundle.crt;
        ssl_certificate_key /application/nginx/conf/key/2_blog.nmtui.com.key;
        location / {
            root   html/www;
            index  index.html index.htm;
        }
       error_page 497  https://$host$uri;
}

    upstream www_server_pools {
                server 10.0.0.8:443;
    }

    server {
        listen 443;
        server_name blog.nmtui.com;
        ssl on;
        ssl_certificate /application/nginx/conf/key/1_blog.nmtui.com_bundle.crt;
        ssl_certificate_key /application/nginx/conf/key/2_blog.nmtui.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        location / {
            proxy_pass https://server_pools;
        }
    }

    server {
        listen       80;
        server_name  blog.nmtui.com;
        rewrite ^(.*)$  https://$host$1 permanent;
    }

worker_processes auto;

http {

    ...

    server {
        listen              443 ssl;
        keepalive_timeout   70;

        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
        ssl_certificate     /usr/local/nginx/conf/cert.pem;
        ssl_certificate_key /usr/local/nginx/conf/cert.key;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;

        ...
    } 

Syntax:    ssl on | off;
Default:    ssl off;
Context:    http, server

Syntax:    ssl_buffer_size size;
Default:    ssl_buffer_size 16k;
Context:    http, server
# This directive appeared in version 1.5.9.

ssl_buffer_size 4k; 

Syntax:    ssl_certificate file;
Default:    —
Context:    http, server

server {
    listen              443 ssl;
    server_name         example.com;

    ssl_certificate     example.com.rsa.crt;
    ssl_certificate_key example.com.rsa.key;

    ssl_certificate     example.com.ecdsa.crt;
    ssl_certificate_key example.com.ecdsa.key;

    ...
}

Syntax:    ssl_certificate_key file;
Default:    —
Context:    http, server

Syntax:    ssl_ciphers ciphers;
Default:    ssl_ciphers HIGH:!aNULL:!MD5;
Context:    http, server

ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

Syntax:    ssl_client_certificate file;
Default:    —
Context:    http, server

Syntax:    ssl_crl file;
Default:    —
Context:    http, server
# This directive appeared in version 0.8.7.

Syntax:    ssl_dhparam file;
Default:    —
Context:    http, server
# This directive appeared in version 0.7.2.

Syntax:    ssl_ecdh_curve curve;
Default:    
ssl_ecdh_curve auto;
Context:    http, server
# This directive appeared in versions 1.1.0 and 1.0.6.

ssl_ecdh_curve prime256v1:secp384r1;

Syntax:    ssl_password_file file;
Default:    —
Context:    http, server
# This directive appeared in version 1.7.3.

http {
    ssl_password_file /etc/keys/global.pass;
    ...

    server {
        server_name www1.example.com;
        ssl_certificate_key /etc/keys/first.key;
    }

    server {
        server_name www2.example.com;

        # named pipe can also be used instead of a file
        ssl_password_file /etc/keys/fifo;
        ssl_certificate_key /etc/keys/second.key;
    }
}

Syntax:    ssl_prefer_server_ciphers on | off;
Default:    ssl_prefer_server_ciphers off;
Context:    http, server

Syntax:    ssl_protocols [SSLv2] [SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2] [TLSv1.3];
Default:    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
Context:    http, server

TLSv1.1和 TLSv1.2参数 (1.1.13、1.0.12) 仅在使用 OpenSSL 1.0.1 或更高时才起作用。
TLSv1.3参数 (1.13.0) 仅在使用用 TLSv1.3 仅在使用 OpenSSL 1.1.1 时有效。

Syntax:    ssl_session_cache off | none | [builtin[:size]] [shared:name:size];
Default:    ssl_session_cache none;
Context:    http, server

ssl_session_cache builtin:1000 shared:SSL:10m;

Syntax:    ssl_session_ticket_key file;
Default:    —
Context:    http, server
# This directive appeared in version 1.5.7.

ssl_session_ticket_key current.key;
ssl_session_ticket_key previous.key;

openssl rand 80 > ticket.key

Syntax:    ssl_session_tickets on | off;
Default:    ssl_session_tickets on;
Context:    http, server
# This directive appeared in version 1.5.9.

Syntax:    ssl_session_timeout time;
Default:    ssl_session_timeout 5m;
Context:    http, server

Syntax:    ssl_stapling on | off;
Default:    ssl_stapling off;
Context:    http, server
# This directive appeared in version 1.3.7.

ssl_stapling on;
resolver 192.0.2.1;

Syntax:    ssl_stapling_file file;
Default:    —
Context:    http, server
# This directive appeared in version 1.3.7.

该文件应该是由“ openssl ocsp”命令产生的DER格式。

Syntax:    ssl_stapling_responder url;
Default:    —
Context:    http, server
# This directive appeared in version 1.3.7.

ssl_stapling_responder http://ocsp.example.com/;

Syntax:    ssl_stapling_verify on | off;
Default:    ssl_stapling_verify off;
Context:    http, server
# This directive appeared in version 1.3.7.

Syntax:    ssl_trusted_certificate file;
Default:    —
Context:    http, server
# This directive appeared in version 1.3.7.

Syntax:    ssl_verify_client on | off | optional | optional_no_ca;
Default:    ssl_verify_client off;
Context:    http, server

Syntax:    ssl_verify_depth number;
Default:    ssl_verify_depth 1;
Context:    http, server