nlp销售心理学,起点中文网白金作家,曹星原
生成证书链
用脚本生成一个根证书, 一个中间证书(intermediate), 三个客户端证书.
脚本来源于(有修改)
中间证书的域名为 localhost.
#!/bin/bash -x set -e for c in `echo root-ca intermediate`; do mkdir $c cd $c mkdir certs crl newcerts private cd .. echo 1000 > $c/serial touch $c/index.txt $c/index.txt.attr echo ' [ ca ] default_ca = ca_default [ ca_default ] dir = '$c' # where everything is kept certs = $dir/certs # where the issued certs are kept crl_dir = $dir/crl # where the issued crl are kept database = $dir/index.txt # database index file. new_certs_dir = $dir/newcerts # default place for new certs. certificate = $dir/cacert.pem # the ca certificate serial = $dir/serial # the current serial number crl = $dir/crl.pem # the current crl private_key = $dir/private/ca.key.pem # the private key randfile = $dir/.rnd # private random number file nameopt = default_ca certopt = default_ca policy = policy_match default_days = 365 default_md = sha256 [ policy_match ] countryname = optional stateorprovincename = optional organizationname = optional organizationalunitname = optional commonname = supplied emailaddress = optional [req] req_extensions = v3_req distinguished_name = req_distinguished_name [req_distinguished_name] [v3_req] basicconstraints = ca:true ' > $c/openssl.conf done openssl genrsa -out root-ca/private/ca.key 2048 openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/cn=root-ca' openssl genrsa -out intermediate/private/intermediate.key 2048 openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/cn=localhost.' openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt mkdir out for i in `seq 1 3` ; do openssl req -new -keyout out/$i.key -out out/$i.request -days 365 -nodes -subj "/cn=$i.example.com" -newkey rsa:2048 openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$i.crt -infiles out/$i.request done
服务器
nginx 配置
我要评论
worker_processes 1;
events {
worker_connections 1024;
}
stream{
upstream backend{
server 127.0.0.1:8080;
}
server {
listen 8888 ssl;
proxy_pass backend;
ssl_certificate intermediate.crt;
ssl_certificate_key intermediate.key;
ssl_verify_depth 2;
ssl_client_certificate root.crt;
ssl_verify_client optional_no_ca;
}
}
客户端
curl \ -i \ -vv \ -x https://localhost:8888/ \ --proxy-cert client1.crt \ --proxy-key client1.key \ --proxy-cacert ca.crt \ https://www.baidu.com/
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持移动技术网。
如对本文有疑问，请在下面进行留言讨论，广大热心网友会与你互动！！ 点击进行留言回复
网友评论