Rootop 服务器运维与web架构

环境 almalinux9.3
openssl版本 3.x

证书生成简化脚本

#!/bin/bash

# 1、生成私钥公钥，自己作为CA机构。
echo "#############################################################################################################"
echo "生成CA证书"
mkdir ca && cd ca
openssl genpkey -algorithm RSA -out ca.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key ca.key -out ca.csr

cat <<EOF > v3_ca.ext
basicConstraints = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
EOF

openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt -days 3650 -extfile v3_ca.ext
# 注意这里明确声明自己作为CA，CA:TRUE。
echo "#############################################################################################################"
cd ..
 
 
# 给服务器（域名）颁发证书
echo "#############################################################################################################"
echo "生成域名证书"
mkdir server && cd server
openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key server.key -out server.csr
 
# 创建一个SAN文件
cat <<EOF > san.conf 
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
 
[alt_names]
DNS.1 = www.test.com
DNS.2 = test.x.com
IP.1 = 127.0.0.1
IP.1 = 192.168.6.114
EOF
 
# 用ca的证书给csr颁发证书
openssl x509 -req -in server.csr -CA ../ca/ca.crt -CAkey ../ca/ca.key  -CAcreateserial -out server.crt -days 365 -extfile san.conf
 
 
# 验证证书链
echo "验证证书链"
openssl verify -CAfile ../ca/ca.crt server.crt
#如果输出 server.crt: OK，说明证书链正确。
echo "#############################################################################################################"
 
cd ..

echo "#############################################################################################################"
echo "生成客户端证书"
mkdir client && cd client
openssl genpkey -algorithm RSA -out client.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key client.key -out client.csr
openssl x509 -req -in client.csr -CA ../ca/ca.crt -CAkey ../ca/ca.key  -CAcreateserial -out client.crt -days 365

echo "#############################################################################################################"
rm -f /home/software/openresty/nginx/conf/vhost/server/*
cp ../server/* /home/software/openresty/nginx/conf/vhost/server/
cp ../ca/ca.crt /home/software/openresty/nginx/conf/vhost/server/
/home/software/openresty/nginx/sbin/nginx -s reload

echo "curl访问"
curl --cert client.crt --key client.key --cacert ../ca/ca.crt https://www.test.com


# 为了将证书导入到浏览器，生成p12格式
openssl pkcs12 -export -inkey client.key -in client.crt -out client.p12 -name "ClientCert"


# nginx配置
server {

	listen	80;
	listen	443 ssl;
	http2 on;
	server_name  www.test.com;
	root /www;
	index index.php index.html;
	
	ssl_certificate /home/software/openresty/nginx/conf/vhost/server/server.crt;
	ssl_certificate_key /home/software/openresty/nginx/conf/vhost/server/server.key;
	
	ssl_session_timeout 5m;
	ssl_protocols TLSv1.1 TLSv1.2;
	ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
	ssl_prefer_server_ciphers on;
	
	ssl_verify_client on;
	ssl_client_certificate /home/software/openresty/nginx/conf/vhost/server/ca.crt;
	
	client_max_body_size 100M;
	
	server_tokens off;
	fastcgi_hide_header X-Powered-By;

	location ~ \.php$
	{
		fastcgi_split_path_info ^((?U).+.php)(/?.+)$;
		fastcgi_param  PATH_INFO $fastcgi_path_info;
		fastcgi_param  PATH_TRANSLATED $document_root$fastcgi_path_info;
		fastcgi_pass   127.0.0.1:10000;
		fastcgi_index  index.php;
		fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
		fastcgi_param  RGS_COREPATHNAME GameMotors;
		include        fastcgi_params;
	}

	access_log  /var/log/nginx/www.test.com-access.log;
	error_log   /var/log/nginx/www.test.com-error.log;
}

# ssl_verify_client on 是开启验证客户端证书。
# ssl_client_certificate 这个参数告诉nginx我信任这个文件中的 CA，如果客户端提交的证书是由这些 CA 签发的，那我就接受。

1、首先双击 ca.crt 文件，导入到本地，选择 受信任的根证书颁发机构。这样浏览器才会信任，不会报不安全。
2、Chrome浏览器导入p12证书，点击 设置 – 隐私与安全 – 安全 – 管理证书 – 您的证书 – 管理从Windows导入的证书
点击 导入，选择刚才的p12证书文件。 “证书存储” 部分，选择 “将所有的证书都放入下列存储”，选择 “个人” ，完成。
浏览器访问 https://www.test.com/ 会弹窗选择客户端证书。

如果不导入证书，则访问时nginx会报下面错误