https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/Recent content in OpenSSL on 蛇索尼 AidenHugo -- gohugo.iozh-CNshesl-meow@qq.com (佘崧林)shesl-meow@qq.com (佘崧林)Thu, 07 Feb 2019 18:54:49 +0800https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/1.aboutcsr/Thu, 07 Feb 2019 18:54:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/1.aboutcsr/1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 graph TB; subgraph Client; F{Infomation}; PK1("PrivateKey(*.key)"); PK2("PublicKey(*.pub)"); DN("DistinguisedName(DN)") CSR("CertificateSigningRequest(*.csr)") F---PK1; F---PK2; F---DN; PK2-->CSR; DN-->CSR CRTclient("ClientCertificate(*.crt)") end subgraph CAroot; CRTroot("CACertificate(*.crt)") end CSR-->|request|CRTroot CRTroot-->|sign|CRTclient If you would like to obtain an SSL certificate from a certificate authority (CA), you must generate a certificate signing request (CSR). A CSR consists mainly of the public keyhttps://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/6.convertformats/Thu, 07 Feb 2019 18:54:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/6.convertformats/All of the certificates that we have been working with have been X.509 certificates that are ASCII PEM encoded. OpenSSL can be used to convert certificates to and from a large variety of these formats. This section will cover a some of the possible conversions. Convert PEM to DER Use this command if you want to convert a PEM-encoded certificate (domain.crt) to a DER-encoded certificate (domain.der), a binary format: 1https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/2.generatecsr/Thu, 07 Feb 2019 18:54:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/2.generatecsr/Generate a private key and a CSR This command creates a 2048-bit private key (domain.key) and a CSR (domain.csr) from scratch: 1 2 3 $ openssl req \ -newkey rsa:2048 -nodes -keyout domain.key \ -out domain.csr The -newkey rsa:2048 option specifies that the key should be 2048-bit, generated using the RSA algorithm. The -nodes option specifies that the private key should not be encrypted with a pass phrase. The -newhttps://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/3.generatessl/Thu, 07 Feb 2019 18:54:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/3.generatessl/If you would like to use an SSL certificate to secure a service but you do not require a CA-signed certificate, a valid (and free) solution is to sign your own certificates. A common type of certificate that you can issue yourself is a self-signed certificate. Therefore, self-signed certificates should only be used if you do not need to prove your service’s identity to its users (e.g. non-production or non-publichttps://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/5.privatekey/Thu, 07 Feb 2019 18:54:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/5.privatekey/Create a Private Key Use this command to create a password-protected, 2048-bit private key (domain.key): 1 $ openssl genrsa -des3 -out domain.key 2048 Verify a Private Key Use this command to check that a private key (domain.key) is a valid key: 1 $ openssl rsa -check -in domain.key Verify a Private Key Matches a Certificate and CSR Use these commands to verify if a private key (domain.key) matches a certificatehttps://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/4.viewcertificate/Thu, 07 Feb 2019 18:54:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/openssl/4.viewcertificate/CSR Entries This command allows you to view and verify the contents of a CSR (domain.csr) in plain text: 1 $ openssl req -text -noout -verify -in domain.csr Certificate Entries This command allows you to view the contents of a certificate (domain.crt) in plain text: 1 $ openssl x509 -text -noout -in domain.crt Verify a Certificate was Signed by a CA Use this command to verify that a certificate (domain.crt)