OpenSSL 命令说明

需求:验证过期的证书在系统中不能使用。

Using OpenSSL Utilities

问题:如何生成过期的证书呢?


解决方法:1.调整系统时间

An openssl command line takes the following form:

openssl utility arguments 

For example:

openssl x509 -in OrbixCA -text 

Each command is individually described in this appendix. To get a list of the arguments associated with a particular command, use the -help option as follows:

openssl utility -help 

For example:

openssl x509 -help 

                  2.生成证书

The x509 Utility

In Orbix 2000 SSL/TLS the x509 utility is mainly used for:

  • Printing text details of certificates you wish to examine.

  • Converting certificates to different formats.

The options supported by the openssl x509 utility are as follows:

-inform arg

- input format - default PEM
(one of DER, NET or PEM)

-outform arg

- output format - default PEM
(one of DER, NET or PEM

-keyform arg

- private key format - default PEM

-CAform arg

- CA format - default PEM

-CAkeyform arg

- CA key format - default PEM

-in arg

- input file - default stdin

-out arg

- output file - default stdout

-serial

- print serial number value

-hash

- print serial number value

-subject

- print subject DN

-issuer

- print issuer DN

-startdate

- notBefore field

-enddate

- notAfter field

-dates

- both Before and After dates

-modulus

- print the RSA key modulus

-fingerprint

- print the certificate fingerprint

-noout

- no certificate output

-days arg

- How long till expiry of a signed certificate
- def 30 days

-signkey arg

- self sign cert with arg

-x509toreq

- output a certification request object

-req

- input is a certificate request, sign and output

-CA arg

- set the CA certificate, must be PEM format

-CAkey arg

- set the CA key, must be PEM format. If missing it is assumed to be in the CA file

-CAcreateserial

- create serial number file if it does not exist

-CAserial

- serial file

-text

- print the certificate in text form

-C

- print out C code forms

-md2/-md5/-sha1/
-mdc2

- digest to do an RSA sign with

 

Using the x509 Utility

To print the text details of an existing PEM-format X.509 certificate, use the x509 utility as follows:

openssl x509 -in MyCert.pem -inform PEM -text 

To print the text details of an existing DER-format X.509 certificate, use the x509 utility as follows:

openssl x509 -in MyCert.der -inform DER -text 

To change a certificate from PEM format to DER format, use the x509 utility as follows:

openssl x509 -in MyCert.pem -inform PEM -outform DER -out MyCert.der 

                  3.验证证书startdate 和 enddate 是否符合你的预期

The req Utility

The req utility is used to generate a self-signed certificate or a certificate signing request (CSR). A CSR contains details of a certificate to be issued by a CA. When creating a CSR, the req command prompts you for the necessary information from which a certificate request file and an encrypted private key file are produced. The certificate request is then submitted to a CA for signing.

If the -nodes (no DES) parameter is not supplied to req, you are prompted for a pass phrase which will be used to protect the private key.

Note:
It is important to specify a validity period (using the -days parameter). If the certificate expires, applications that are using that certificate will not be authenticated successfully.

The options supported by the openssl req utility are as follows:

-inform arg 

input format - one of DER TXT PEM

-outform 
arg output format - one of DER TXT PEM 
-in arg 
inout file 
-out arg 
output file 

-text

text form of request

-noout 
do not output REQ 
-verify 
verify signature on REQ 
-modulus 
RSA modulus 

-nodes

do not encrypt the output key

-key file

use the private key contained in file 

-keyform arg

key file format 

-keyout arg

file to send the key to

-newkey rsa:bits

generate a new RSA key of `bits' in size 

-newkey dsa:file

generate a new DSA key, parameters taken from CA in `file'

-[digest]

Digest to sign with (md5, sha1, md2, mdc2) 

-config file

request template file

-new

new request

-x509

output an x509 structure instead of a certificate req. (Used for creating self signed certificates)

-days

number of days an x509 generated by -x509 is valid for

-asn1-kludge

Output the `request' in a format that is wrong but some CA's have been reported as requiring [It is now always turned on but can be turned off with -no-asn1-kludge] 

 

Using the req Utility

To create a self-signed certificate with an expiry date a year from now, the req utility can be used as follows to create the certificate CA_cert.pem and the corresponding encrypted private key file CA_pk.pem:

openssl req -config ssl_conf_path_name -days 365  
-out CA_cert.pem -new -x509 -keyout CA_pk.pem 

This following command creates the certificate request MyReq.pem and the corresponding encrypted private key file MyEncryptedKey.pem:

openssl req -config ssl_conf_path_name -days 365 
-out MyReq.pem -new -keyout MyEncryptedKey.pem 

1.调整系统时间

The rsa Utility

The rsa command is a useful utility for examining and modifying RSA private key files. Generally RSA keys are stored encrypted with a symmetric algorithm using a user-supplied pass phrase. The OpenSSL req command prompts the user for a pass phrase in order to encrypt the private key. By default, req uses the triple DES algorithm. The rsa command can be used to change the password that protects the private key and to convert the format of the private key. Any rsa command that involves reading an encrypted rsa private key will prompt for the PEM pass phrase used to encrypt it.

The options supported by the openssl rsa utility are as follows:

-inform arg

input format - one of DER NET PEM

-outform arg

output format - one of DER NET PEM

-in arg

inout file

-out arg

output file

-des

encrypt PEM output with cbc des

-des3

encrypt PEM output with ede cbc des using 168 bit key

-text

print the key in text

-noout

do not print key out

-modulus

print the RSA key modulus

 

Using the rsa Utility

Converting a private key to PEM format from DER format involves using the rsa utility as follows:

openssl rsa -inform DER -in MyKey.der -outform PEM -out MyKey.pem 

Changing the pass phrase which is used to encrypt the private key involves using the rsa utility as follows:

openssl rsa -inform PEM -in MyKey.pem -outform PEM -out MyKey.pem -des3 

Removing encryption from the private key (which is not recommended) involves using the rsa command utility as follows:

openssl rsa -inform PEM -in MyKey.pem -outform PEM -out MyKey2.pem 

Note:
Do not specify the same file for the -in and -out parameters, because this can corrupt the file.

          1.Set date from the command line:

The ca Utility

You can use the ca utility create X.509 certificates by signing existing signing requests. It is imperative that you check the details of a certificate request before signing. Your organization should have a policy with respect to the issuing of certificates. Before implementing CAs, refer to Managing Certificates for more information.

The ca utility is used to sign certificate requests thereby creating a valid X.509 certificate which can be returned to the request submitter. It can also be used to generate Certificate Revocation Lists (CRLS). For information on the ca -policy and -name options, refer to "The OpenSSL Configuration File" on page?117.

To create a new CA using the openssl ca utility, two files (serial and index.txt) need to be created in the location specified by the openssl configuration file that you are using.

The options supported by the openssl ca utility are as follows:

-verbose

- Talk alot while doing things

-config file

- A config file

-name arg

- The particular CA definition to use

-gencrl

- Generate a new CRL

-crldays days

- Days is when the next CRL is due

-crlhours hours

- Hours is when the next CRL is due

-days arg

- number of days to certify the certificate for

-md arg

- md to use, one of md2, md5, sha or sha1

-policy arg

- The CA `policy' to support

-keyfile arg

- PEM private key file

-key arg

- key to decode the private key if it is encrypted

-cert

- The CA certificate

-in file

- The input PEM encoded certificate request(s)

-out file

- Where to put the output file(s)

-outdir dir

- Where to put output certificates 

-infiles....

- The last argument, requests to process

-spkac file

- File contains DN and signed public key and challenge

-preserveDN

- Do not re-order the DN

-batch

- Do not ask questions

-msie_hack

- msie modifications to handle all thos universal strings 

 

Note:
Most of the above parameters have default values as defined in openssl.cnf.

Using the ca Utility

Converting a private key to PEM format from DER format involves using the ca utility as shown in the following example. To sign the supplied CSR MyReq.pem to be valid for 365 days and create a new X.509 certificate in PEM format, use the ca utility as follows:

openssl ca -config ssl_conf_path_name -days 365 
-in MyReq.pem -out MyNewCert.pem 
 1 date +%Y%m%d -s "20120418" 

          2.Set time from the command line:

 1 date +%T -s "11:14:00" 
  1. 生成证书

       参考连接:https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

Generate a Self-Signed Certificate

Use this method if you want to use HTTPS (HTTP over TLS) to secure your Apache HTTP or Nginx web server, and you do not require that your certificate is signed by a CA.

This command creates a 2048-bit private key (domain.key) and a self-signed certificate (domain.crt) from scratch:

1 openssl req 
2        -newkey rsa:2048 -nodes -keyout domain.key 
3        -x509 -days 365 -out domain.crt

本文由金沙官网线上发布于操作系统,转载请注明出处:OpenSSL 命令说明

您可能还会对下面的文章感兴趣: