CA证书和TLS介绍
數字簽名
? ? 用自己的私鑰給數據加密就叫數字簽名
公鑰傳輸威脅
? ?在A和B的通信中,C可以把自己的公鑰發給A,讓A把C的公鑰當成B的公鑰,這樣的話.B拿到加密數據反而無法解密,而C卻可以解密出數據.從而實現C截獲AB之間的數據
? ?所以在兩者的通信中必須要對公鑰的來源進行確認
? A和B如果想安全交換公鑰,就必須通過CA(證書頒發機構)? 證書的通信過程? ? ? ? A和B首先都內置了CA的公鑰
? 根CA的證書是自己給自己簽名的(自簽名)
?
?
CA和證書?
??PKI: Public Key Infrastructure?
? ? ? ?簽證機構：CA（Certificate Authority）?
? ? ? ?注冊機構：RA?
? ? ? ?證書吊銷列表：CRL?
? ? ? ?證書存取庫：? X.509：定義了證書的結構以及認證協議標準?
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?版本號? ?序列號? ?簽名算法? ?頒發者? ?有效期限? ?主體名稱? ? 主體公鑰? ?CRL分發點? ? ?擴展信息? ? 發行者簽名?
?
SSL
? ?SSL(Secure? ? Socket? ? Layer)和TLS(Transport? ? Layer? Security )本身是一個東西
? ?實現功能:? 機密性? ? ?認證? ? 完整性? ? ?重放保護(正確同樣的數據不能重復發送)
? ?兩階段協議，分為握手階段和應用階段?
? ? 握手階段(協商階段):
? ? ? ? ? ?客戶端和服務器端認證對方身份（依賴于PKI體系，利用數字證書進行 身份認證）,并協商通信中使用的安全參數、密碼套件以及主密鑰.
? ? ? ? ? ?后續通信使用的所有密鑰都是 通過MasterSecret生成。?
? ? ?應用階段:
? ? ? ? ? ? 在握手階段完成后進入,在應用階段通信雙方使用握手階段協商好的密鑰進行安全通信?
? ? taobao? 證書? ?https的通信過程
? ? taobao 證書內容包含? SCA(Ptaobao) CA密鑰加密簽名過的taobao公鑰 + CA證書描述+過期時間+證書其它信息? taobao網站把證書發給客戶端
? ? 客戶端由于信任CA并且拿到了CA的公鑰,就可以解密SCA(Ptaobao)? 獲得taobao的公鑰? Ptaobao
? ? 客戶端(瀏覽器)會在本地生成一個對稱密鑰(key)用taobao的公鑰加密發送給taobao? Ptaobao(key)? ?sendto? taobao
? ? taobao通過自己的私鑰解密得到客戶端發送過來的key? ?Staobao(Ptaobao(key)) = key? 這樣在客戶端和服務端都存在相同的對稱密鑰key
? ? 客戶端和服務端就可以通過key(data)對大量的網頁數據進行對稱加密,實現通信雙方的安全通信
?
OpenSSL 開源實現證書申請和頒發
? ? base64編碼? ? ? 是6bit編碼? ? ? ? 包含字符a-z,A-Z,/,+? 總共64個符號
? ?生成私鑰?
? ? ? ? openssl genrsa -out /PATH/TO/PRIVATEKEY.FILE NUM_BITS? ?(umask 077; openssl genrsa –out? test.key? –des 2048)? ? -des表示對密鑰對稱稱加密
? ? ? ? openssl rsa -in test.key –out test2.key? ? ? ? ? 將加密key解密
? ?從私鑰中提取出公鑰?
? ? ? ?openssl rsa -in PRIVATEKEYFILE –pubout –out PUBLICKEYFILE? openssl rsa –in test.key –pubout –out test.key.pub?
?
實驗:向CA申請證書
建立Root CA
? ? 1. 創建CA重要的配置文件openssl的配置文件：/etc/pki/tls/openssl.cnf?
? ? 2. 默認CA的工作目錄在? ? ? /etc/pki/CA?
1 [root@centos7 ~]# cd /etc/pki/CA 2 #創建CA服務器的私鑰 3 [root@centos7 CA]# (umask 077;openssl genrsa -out private/cakey.pem 4096) 4 Generating RSA private key, 4096 bit long modulus 5 ...................................................++ 6 ..............................................................................................................................................................................................................................................................................................++ 7 e is 65537 (0x10001) 8 [root@centos7 CA]# ls private 9 cakey.pem 10 11 #根CA給自己的私鑰簽名證書 12 [root@centos7 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 13 You are about to be asked to enter information that will be incorporated 14 into your certificate request. 15 What you are about to enter is what is called a Distinguished Name or a DN. 16 There are quite a few fields but you can leave some blank 17 For some fields there will be a default value, 18 If you enter '.', the field will be left blank. 19 ----- 20 Country Name (2 letter code) [XX]:CN 21 State or Province Name (full name) []:beijing 22 Locality Name (eg, city) [Default City]:beijing 23 Organization Name (eg, company) [Default Company Ltd]:mage 24 Organizational Unit Name (eg, section) []:M30 25 Common Name (eg, your name or your server's hostname) []:www.yxh.com 26 Email Address []: 27 #以可讀的文本格式顯示證書內容 28 [root@centos7 CA]# openssl x509 -in cacert.pem -noout -text 29 Certificate: 30 Data: 31 Version: 3 (0x2) 32 Serial Number: 33 f9:72:0f:e1:6c:80:e3:aa 34 Signature Algorithm: sha256WithRSAEncryption 35 Issuer: C=CN, ST=beijing, L=beijing, O=mage, OU=M30, CN=www.yxh.com 36 Validity 37 Not Before: May 19 08:58:14 2018 GMT 38 Not After : May 16 08:58:14 2028 GMT 39 Subject: C=CN, ST=beijing, L=beijing, O=mage, OU=M30, CN=www.yxh.com 40 Subject Public Key Info: 41 Public Key Algorithm: rsaEncryption 42 Public-Key: (4096 bit) 43 Modulus: 44 00:e4:70:ef:fe:9a:43:87:41:ca:05:3d:a6:98:df: 45 89:19:64:ac:fb:24:04:42:be:bc:87:7a:e9:b5:be: 46 9d:21:40:cf:c7:08:a1:ab:8e:03:92:29:e9:50:ed: 47 dd:8d:06:3c:5f:fa:23:9f:96:04:76:b9:be:56:43: 48 58:f8:43:db:24:cf:79:87:be:cc:bd:c0:af:41:04: 49 d4:e1:6b:78:fb:b1:74:8e:25:93:22:9e:f1:22:98: 50 97:7e:dd:dc:af:45:97:93:16:93:8a:89:5c:b0:00: 51 62:a5:2f:72:ec:54:aa:3a:ec:0b:24:72:34:4a:c0: 52 70:ab:02:d8:36:53:93:d1:cc:98:43:a9:a8:f2:3b: 53 b7:fb:be:44:64:9d:c6:bb:7d:16:b5:39:d1:1f:6d: 54 e2:89:c7:9f:b7:e6:10:87:37:01:41:25:af:61:b5: 55 7c:93:3c:bd:75:cb:46:ff:0e:e2:58:92:aa:25:2b: 56 06:b1:25:27:e5:7d:76:02:d8:c5:63:db:d0:e6:ab: 57 ef:ce:69:37:7e:eb:b1:f3:59:05:e1:bf:47:b7:d1: 58 4c:59:45:c9:d6:f0:35:dd:95:b0:c2:69:5b:7e:83: 59 3e:64:8e:66:28:ba:06:f4:99:30:00:4d:76:72:a3: 60 16:d7:7e:f1:9e:9d:fe:15:88:d0:b8:e4:8f:cd:56: 61 c3:89:5c:cf:40:a5:2b:9d:38:56:e2:30:09:85:22: 62 b2:f6:58:20:c2:c0:65:b9:0e:61:f0:b3:a2:94:ea: 63 57:72:77:90:26:7d:90:11:98:18:52:ab:dc:a1:78: 64 68:0d:f0:d8:6b:01:c5:5d:e5:ca:a5:36:68:81:ba: 65 ca:4c:b9:98:fd:f4:54:e3:eb:7f:3d:30:50:34:a6: 66 5e:38:1c:82:93:9b:91:76:34:ab:df:e8:95:dd:2e: 67 d0:c6:98:c5:77:a6:67:13:aa:96:3f:7c:70:7e:54: 68 50:77:cc:5c:d0:70:34:93:90:4a:83:25:d8:1e:1d: 69 6c:17:3c:84:20:df:ee:78:28:e7:63:7f:d5:44:9c: 70 c3:cb:ec:78:a7:2f:05:dc:e7:e9:20:32:34:38:66: 71 fc:1f:54:79:64:bc:92:e9:59:c5:bf:35:4c:aa:1f: 72 93:7a:e7:8c:29:b2:58:03:bf:4f:19:36:da:2f:bd: 73 00:e0:0e:cd:32:09:0b:c7:1d:6c:12:19:b4:fa:4c: 74 a2:b0:24:be:d3:1e:47:55:17:c3:14:ce:cd:af:01: 75 ca:d8:48:44:12:40:99:f2:9f:87:1e:ea:2f:cb:0f: 76 a7:0d:b7:99:d5:e1:3b:68:50:00:80:6f:59:7c:19: 77 96:72:51:bb:9d:6b:02:01:c1:7b:88:d9:20:57:64: 78 1f:86:95 79 Exponent: 65537 (0x10001) 80 X509v3 extensions: 81 X509v3 Subject Key Identifier: 82 C6:80:BB:D0:7D:12:F4:EF:1A:69:CD:92:D3:F7:E1:3D:8A:27:CD:76 83 X509v3 Authority Key Identifier: 84 keyid:C6:80:BB:D0:7D:12:F4:EF:1A:69:CD:92:D3:F7:E1:3D:8A:27:CD:76 85 86 X509v3 Basic Constraints: 87 CA:TRUE 88 Signature Algorithm: sha256WithRSAEncryption 89 a0:df:1a:b4:22:69:a7:8f:92:8b:c0:67:91:66:df:5f:0f:47: 90 2d:2e:6a:fd:d7:21:48:29:46:e7:7e:9b:6a:46:32:04:39:c2: 91 fb:06:2e:eb:d2:f5:25:16:f7:03:f9:d1:e5:d1:d8:1d:96:8e: 92 22:fc:37:d7:22:97:36:4c:2c:f2:8f:09:24:5b:61:a2:29:13: 93 48:21:c9:db:1e:1e:24:18:d0:02:2f:ff:35:fd:21:4c:b6:af: 94 36:33:8a:d0:2f:22:75:f4:89:8b:99:4f:32:69:55:35:13:35: 95 00:d4:f3:82:44:5f:25:a8:82:1c:51:01:31:e2:7b:c0:72:0a: 96 5d:a8:a8:37:30:a7:64:e5:2b:86:e4:92:57:59:ae:0b:a9:7b: 97 fa:be:64:be:7a:d4:f1:6a:1d:9e:07:d4:79:7d:9c:d9:c5:98: 98 ec:fc:d0:0d:55:45:41:81:c9:5a:d1:0e:ba:f1:14:c1:43:ea: 99 26:62:a3:c2:8f:fe:54:fe:03:9d:8c:ca:96:48:66:9f:83:88: 100 c3:e7:d8:6b:e9:43:34:3c:77:b6:2f:97:54:65:39:74:09:a5: 101 a3:c6:d1:aa:52:7b:d3:91:44:32:ee:1a:45:40:ff:1e:46:b9: 102 47:06:68:6e:91:a6:88:77:4a:df:07:bd:81:ae:6e:a0:2d:67: 103 39:15:b6:9b:28:e3:0a:34:bf:0d:f0:01:af:8a:f2:2b:8b:3f: 104 12:a7:8b:cf:c4:eb:c5:bc:58:58:10:6a:84:85:26:01:39:9a: 105 fa:aa:1a:dc:83:46:61:1b:12:90:ad:5a:d7:67:78:68:a9:8c: 106 72:71:f0:64:b7:bf:08:85:9b:71:4a:3f:00:94:43:a7:73:3b: 107 c3:95:da:07:1f:8b:ca:f4:d7:a4:af:34:95:42:a5:e0:46:e8: 108 18:22:29:c4:b7:b0:a0:9a:7b:e8:e5:b1:11:67:07:f3:7d:bd: 109 f7:2f:5f:65:5e:32:5d:0c:65:a1:70:ad:50:6c:02:5c:a5:e6: 110 0c:41:c9:26:9d:95:c4:1b:df:26:a2:43:4f:b6:e0:98:6f:ba: 111 cb:83:e6:1c:00:ba:d6:48:cc:a4:2e:8d:cc:6c:f4:9d:5a:ee: 112 62:0e:57:e2:2e:1f:8c:6c:cd:a3:2d:63:4b:0f:6b:11:bd:18: 113 47:23:0b:b7:7c:fc:d5:45:01:6e:72:a0:7c:43:29:6b:ef:dd: 114 33:d1:39:2a:14:cd:c3:2e:91:4f:78:3d:e2:08:a5:dd:bd:00: 115 aa:18:19:48:03:3a:a1:9d:1c:e7:c3:87:51:a4:42:7a:fd:7f: 116 90:40:c6:bb:ba:8e:22:be:63:5a:10:bb:a4:fd:ef:21:4f:d1: 117 84:a9:fb:2e:61:cc:b0:76 118 119 [root@centos7 CA]# openssl x509 -in cacert.pem -noout -issuer 120 issuer= /C=CN/ST=beijing/L=beijing/O=mage/OU=M30/CN=www.yxh.com 創建CA服務器用戶或者服務器申請證書
1.生成私鑰文件 [root@yxh6 data]# (umask 077;openssl genrsa -out app.key 1024) Generating RSA private key, 1024 bit long modulus ..............................++++++ .....................++++++ e is 65537 (0x10001) [root@yxh6 data]# ls app.key2.利用私鑰文件生成申請文件 [root@yxh6 data]# openssl req -new -key app.key -out app.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:beijing Locality Name (eg, city) [Default City]:beijing Organization Name (eg, company) [Default Company Ltd]:mage Organizational Unit Name (eg, section) []:M30 Common Name (eg, your name or your server's hostname) []:www.yxh.com Email Address []:Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@yxh6 data]# ls app.csr app.key3.將申請文件發送給CAscp app.csr 192.168.33.130:/etc/pki/CA4.CA頒發證書回到CA服務器執行頒發證書touch index.txtecho 0F > serial[root@centos7 CA]# openssl ca -in app.csr -out certs/app.crt -days 100 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details:Serial Number: 15 (0xf)ValidityNot Before: May 19 09:35:37 2018 GMTNot After : Aug 27 09:35:37 2018 GMTSubject:countryName = CNstateOrProvinceName = beijingorganizationName = mageorganizationalUnitName = M30commonName = www.yxh.comX509v3 extensions:X509v3 Basic Constraints: CA:FALSENetscape Comment: OpenSSL Generated CertificateX509v3 Subject Key Identifier: 71:DC:D4:AE:8A:5A:16:A4:13:62:D7:3A:C9:C7:DD:A7:9C:95:B0:4FX509v3 Authority Key Identifier: keyid:C6:80:BB:D0:7D:12:F4:EF:1A:69:CD:92:D3:F7:E1:3D:8A:27:CD:76Certificate is to be certified until Aug 27 09:35:37 2018 GMT (100 days) Sign the certificate? [y/n]:y1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@centos7 certs]# ls app.crt5.證書發送客戶端scp app.csr 192.168.33.129:/data客戶端可以拿著這個證書在應用程序中使用 CA簽發證書(客戶端)?
windows下查看生成的證書信息和安裝證書
可以把證書cacert.pem下載到windows中進行可視化查看證書信息
需要.pem(cacert.pem)后綴名改成windows能識別的.cer(cacert.cer)或者.crt? ? ? 點擊安裝證書可以把此證書安裝到可信任的證書路徑中
?
? ?證書管理
? ? ?查看證書中的信息：?
? ? ? openssl x509 -in /PATH/FROM/CERT_FILE -noout? ? ?-text|issuer|subject|serial|dates?
? ? ? openssl? ca -status SERIAL? ? 查看指定編號的證書狀態?
? ? 吊銷證書?
? ? ? ?在客戶端獲取要吊銷的證書的serial?
? ? ? ? ? ? ?openssl x509 -in /PATH/FROM/CERT_FILE -noout? -serial -subject?
? ? ? ?在CA上,根據客戶提交的serial與subject信息,對比檢驗是否與index.txt文件中的信息一致,吊 銷證書：?
? ? ? ? ? ? openssl ca -revoke /etc/pki/CA/newcerts/SERIAL.pem?
? ? ? 指定第一個吊銷證書的編號,注意:第一次更新證書吊銷列表前,才需要執行? echo 01 > /etc/pki/CA/crlnumber?
? ? ? 更新證書吊銷列表? openssl ca -gencrl -out /etc/pki/CA/crl.pem?
? ? ? 查看crl文件：? openssl crl -in /etc/pki/CA/crl.pem -noout -text?
?
SSH安全服務? ?
? ?ssh: secure shell, protocol, 22/tcp, 安全的遠程登錄
? ?兩種方式的用戶登錄認證：?
? ? ? 1.基于password?
? ? ? ? ? ? ?1.客戶端向服務端發送SSH請求
? ? ? ? ? ? ?2.服務端收到請求,發送公鑰給客戶端
? ? ? ? ? ? ?3.客戶端輸入用戶名和密碼通過公鑰加密回傳給服務端
? ? ? ? ? ? ?4.服務端通過私鑰解密得到用戶名和密碼和本地的用戶名密碼進行驗證匹配
?
? ? ? 2.基于key
? ? ? ? ? ? ?1.首先在客戶端生成一對密鑰對
? ? ? ? ? ? ?2.客戶端將公鑰拷貝給服務端并重命名為 authorized_keys
? ? ? ? ? ? ?3.客戶端向服務端發送一個連接請求,信息包括ip,用戶名
? ? ? ? ? ? ?4.服務端得到客戶端消息后,會到authorized_keys查找是否有對應信息并且隨機生成一個字符串
? ? ? ? ? ? ?5.服務端把隨機生成的字符串用客戶端公鑰加密發送給客戶端
? ? ? ? ? ? ?6.客戶端接收到加密字符串后用自己的私鑰對字符串進行解密,并且把解密后的字符串發送給服務端
? ? ? ? ? ? ?7.服務端會把接收到的字符串和原來自己生成的隨機字符串進行驗證匹配
? ssh客戶端：
? ? ?1.客戶端配置文件? /etc/ssh/ssh_config? ? ? ? ? ? ? ssh服務端的配置文件? ?/etc/ssh/sshd_config
? ? ?ssh客戶端會在第一次連接的時候把遠程主機的公鑰下載到本機,如果需要冒充其它已經連接過的主機,需要把對方的私鑰拷貝到本地來
?
實現基于ssh key的認證
? ?實現指定用戶無密碼連接,默認是root用戶? 在ssh-copy-id命令中指定特定的用戶名就會把公鑰文件拷貝到指定用戶的家目錄下
? ?ssh-copy-id? ?yxh@192.168.33.130
1.在客戶端生成密鑰對 [root@yxh6 data]# ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: 84:69:ce:6b:19:1d:09:c4:94:66:06:2e:76:57:8b:0b root@yxh6.localdomain The key's randomart image is: +--[ RSA 2048]----+ | .=+.. | | . ** o | | o E+* = | | . o * + . | | = S | | + | | + | | . | | | +-----------------+ [root@yxh6 data]# cd /root/.ssh [root@yxh6 .ssh]# ls id_rsa id_rsa.pub known_hosts2.把公鑰復制到服務端主機 [root@yxh6 .ssh]# ssh-copy-id 192.168.33.130 root@192.168.33.130's password: Now try logging into the machine, with "ssh '192.168.33.130'", and check in:.ssh/authorized_keysto make sure we haven't added extra keys that you weren't expecting.3.直接連接遠程主機 [root@yxh6 .ssh]# ssh 192.168.33.130 Last login: Sat May 19 17:31:50 2018 from 192.168.33.1 this is etc/motd,welcome.... [root@centos7 ~]# View Code?
多臺主機之間實現相互key認證登錄
? ? ?1.在一臺主機A上生成一對密鑰對所有主機使用同一密鑰
? ? ?2.ssh-copy-id A
? ? 3.scp? ?-rp? ? ? /root/.ssh B:/root
? ? 4.scp? ?-rp? ? ?/root/.ssh C:/root
?
ssh key認證腳本自動化
? expect匹配輸出規則：
? ? ?#Are you sure you want to continue connecting (yes/no)?
? ? ?#root@192.168.33.129's password:
??
轉載于:https://www.cnblogs.com/yxh168/p/9058043.html
總結
以上是生活随笔為你收集整理的CA证书和TLS介绍的全部內容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： NO--14 微信小程序，左右联动二
- 下一篇： arp_annouce=2详解