nginx ssl双向认证实战
2022-10-26 本文已影响0人
奶茶不要奶不要茶
本次实验所使用操作系统为Ubuntu20.04，通过openssl工具生成所有的ssl证书。
1、生成自签CA证书
CA证书的作用是签发服务器和客户端证书，并且用于校验客户端的证书。
# 生成CA的私钥文件
root@k8s-master1:~/ssl# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..................................................................................................................................+++++
.........................................+++++
e is 65537 (0x010001)
root@k8s-master1:~/ssl#
# 生成CA证书，-subj参数可以免去交互式
root@k8s-master1:~/ssl# openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=CN/O=People's Republic of China/CN=China CA"
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl# ls
ca.crt ca.key
root@k8s-master1:~/ssl#
# 通过openssl工具查看CA证书的内容
root@k8s-master1:~/ssl# openssl x509 -text -noout -in ca.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0e:91:a9:4f:4b:b5:22:65:8f:f9:f4:13:10:a6:03:c6:f3:80:fd:b2
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = CN, O = People's Republic of China, CN = China CA
Validity
Not Before: Oct 27 12:08:35 2022 GMT
Not After : Oct 24 12:08:35 2032 GMT
Subject: C = CN, O = People's Republic of China, CN = China CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:dd:00:26:20:9a:f2:ed:94:e5:30:99:fe:38:ae:
...
...
7d:56:26:48:35:a6:97:ac:1d:4c:23:dd:39:76:89:
31:5b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
42:19:EB:18:05:C7:A0:AB:E5:6C:93:9C:FC:EB:F6:E1:5F:93:E2:E1
X509v3 Authority Key Identifier:
keyid:42:19:EB:18:05:C7:A0:AB:E5:6C:93:9C:FC:EB:F6:E1:5F:93:E2:E1
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
1c:e3:a5:45:c3:b6:1e:16:d2:d7:58:93:3d:0c:79:8f:6a:b0:
...
...
6f:e6:d5:0e:71:92:ca:65:cd:1a:4b:7c:2b:f3:08:dd:bc:f7:
dc:dd:c1:a3
root@k8s-master1:~/ssl#
2、生成自签服务器证书
-subj 参数很重要，其中/CN要填写具体的域名，要与nginx的server_name匹配上。
chrome浏览器对证书很严格，证书必须要有SAN（Subject Alternative Name）。
v3_req表示生成是X.509 v3和SAN的证书，-extfile和-extensions这两个参数是可选的，如果没有这两个参数，那证书就是没有SAN的，推荐加上这两个参数。
# 生成服务器的私钥文件
root@k8s-master1:~/ssl# openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................+++++
..............................................+++++
e is 65537 (0x010001)
root@k8s-master1:~/ssl#
# 生成服务器的证书签发文件，即csr后缀的文件
root@k8s-master1:~/ssl# openssl req -new -key server.key -out server.csr -subj "/C=CN/O=People's Republic of China/CN=example.com"
root@k8s-master1:~/ssl#
# 使用CA签发服务器证书
root@k8s-master1:~/ssl# openssl x509 -req -in server.csr -out server.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -extfile <(sed "/\[ v3_req \]/ a\subjectAltName = @alt_names" /etc/ssl/openssl.cnf <(printf "\n[alt_names]\nDNS.1=example.com\nDNS.2=www.example.com")) -extensions v3_req
Signature ok
subject=C = CN, O = People's Republic of China, CN = example.com
Getting CA Private Key
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl# ls
ca.crt ca.key ca.srl server.crt server.csr server.key
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl# openssl x509 -text -noout -in server.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
30:be:cf:e7:ce:18:b5:3c:04:a1:da:74:d0:8e:7c:a5:e9:08:7d:3d
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = CN, O = People's Republic of China, CN = China CA
Validity
Not Before: Oct 27 12:12:32 2022 GMT
Not After : Oct 24 12:12:32 2032 GMT
Subject: C = CN, O = People's Republic of China, CN = example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:b2:63:3f:85:f0:99:8a:13:f8:62:3d:d3:5f:60:
...
...
3f:a2:b3:a1:8a:d4:b3:48:b9:b4:18:b5:10:a0:b1:
61:ab
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:example.com, DNS:www.example.com
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
Signature Algorithm: sha256WithRSAEncryption
42:f0:fa:93:b9:75:5b:6a:63:4f:a9:c5:c2:c8:5a:e9:ca:9e:
...
...
10:10:94:72:92:56:bf:e6:91:97:1f:b0:54:2c:6e:37:22:59:
9f:bd:c2:67
root@k8s-master1:~/ssl#
3、配置nginx，开启ssl双向认证
nginx ssl双向认证配置文件的关键内容如下。
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
# 服务器证书所在路径
ssl_certificate "/etc/nginx/ssl/server.crt";
ssl_certificate_key "/etc/nginx/ssl/server.key";
ssl_protocols TLSv1.2 TLSv1.3;
# 开启ssl双向认证
ssl_verify_client on;
# 使用ca.crt校验客户端证书，由该ca.crt签发的证书才可以通过校验
ssl_client_certificate "/etc/nginx/ssl/ca.crt";
location / {
return 200 "success";
}
}
4、生成客户端证书
客户端证书步骤跟服务器证书一样，只是参数不一样。
# 生成客户端的私钥文件
root@k8s-master1:~/ssl# openssl genrsa -out client.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..............+++++
..........................................................................+++++
e is 65537 (0x010001)
root@k8s-master1:~/ssl#
# 生成客户端的证书签发文件
root@k8s-master1:~/ssl# openssl req -new -key client.key -out client.csr -subj "/C=CN/O=People's Republic of China/CN=Private certificate assigned to Tom"
root@k8s-master1:~/ssl#
# 使用CA签发客户端证书
root@k8s-master1:~/ssl# openssl x509 -req -in client.csr -out client.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650
Signature ok
subject=C = CN, O = People's Republic of China, CN = Private certificate assigned to Tom
Getting CA Private Key
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl# ls
ca.crt ca.key ca.srl client.crt client.csr client.key server.crt server.csr server.key
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl# openssl x509 -text -noout -in client.crt
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
30:be:cf:e7:ce:18:b5:3c:04:a1:da:74:d0:8e:7c:a5:e9:08:7d:3e
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = CN, O = People's Republic of China, CN = China CA
Validity
Not Before: Oct 27 12:24:28 2022 GMT
Not After : Oct 24 12:24:28 2032 GMT
Subject: C = CN, O = People's Republic of China, CN = Private certificate assigned to Tom
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:c1:ed:df:46:b9:8b:3a:e9:3e:ed:09:29:a6:56:
...
...
3b:87:22:39:87:8b:ce:bd:e4:f4:28:94:a4:83:95:
a2:df
Exponent: 65537 (0x10001)
Signature Algorithm: sha256WithRSAEncryption
46:04:fe:6a:b1:c9:9b:df:f6:8e:ac:c4:e2:dd:a1:75:1a:f4:
...
...
ef:94:84:c5
root@k8s-master1:~/ssl#
5、使用curl测试ssl双向认证
curl没有使用客户端证书去请求，会报400错误。如果使用的客户端证书不是由特定CA签发的，也同样会报400错误。
root@k8s-master1:~/ssl# curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1
* Added www.example.com:443:127.0.0.1 to DNS cache
* Hostname www.example.com was found in DNS cache
* Trying 127.0.0.1:443...
* TCP_NODELAY set
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connected to www.example.com (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
...
...
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=CN; O=People's Republic of China; CN=example.com
* start date: Oct 27 12:12:32 2022 GMT
* expire date: Oct 24 12:12:32 2032 GMT
* issuer: C=CN; O=People's Republic of China; CN=China CA
* SSL certificate verify result: certificate signature failure (7), continuing anyway.
} [5 bytes data]
> GET / HTTP/1.1
> Host: www.example.com
> User-Agent: curl/7.68.0
> Accept: */*
>
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [265 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [265 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< Server: nginx
< Date: Thu, 27 Oct 2022 12:39:16 GMT
< Content-Type: text/html
< Content-Length: 230
< Connection: close
<
{ [230 bytes data]
100 230 100 230 0 0 20909 0 --:--:-- --:--:-- --:--:-- 20909
* Closing connection 0
} [5 bytes data]
* TLSv1.3 (OUT), TLS alert, close notify (256):
} [2 bytes data]
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl# curl -k https://www.example.com/ --resolve www.example.com:443:127.0.0.1
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx</center>
</body>
</html>
root@k8s-master1:~/ssl#
root@k8s-master1:~/ssl#
--cert和--key参数指定客户端证书，服务器校验证书没问题就能正常访问。
也可以将客户端证书转换成PC浏览器用的证书格式，命令如下。
openssl pkcs12 -export -clcerts -out client.p12 -in client.crt -inkey client.key
温馨提示：不需要密码就按回车键。
root@k8s-master1:~/ssl# curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1 --cert ./client.crt --key ./client.key
* Added www.example.com:443:127.0.0.1 to DNS cache
* Hostname www.example.com was found in DNS cache
* Trying 127.0.0.1:443...
* TCP_NODELAY set
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connected to www.example.com (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
...
...
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=CN; O=People's Republic of China; CN=example.com
* start date: Oct 27 12:12:32 2022 GMT
* expire date: Oct 24 12:12:32 2032 GMT
* issuer: C=CN; O=People's Republic of China; CN=China CA
* SSL certificate verify result: certificate signature failure (7), continuing anyway.
} [5 bytes data]
> GET / HTTP/1.1
> Host: www.example.com
> User-Agent: curl/7.68.0
> Accept: */*
>
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1097 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1097 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 27 Oct 2022 12:46:20 GMT
< Content-Type: application/octet-stream
< Content-Length: 7
< Connection: keep-alive
<
{ [7 bytes data]
100 7 100 7 0 0 583 0 --:--:-- --:--:-- --:--:-- 583
* Connection #0 to host www.example.com left intact
root@k8s-master1:~/ssl#
6、命令汇总
生成自签CA证书
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=CN/O=People's Republic of China/CN=China CA"
生成服务器证书
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/C=CN/O=People's Republic of China/CN=example.com"
openssl x509 -req -in server.csr -out server.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -extfile <(sed "/\[ v3_req \]/ a\subjectAltName = @alt_names" /etc/ssl/openssl.cnf <(printf "\n[alt_names]\nDNS.1=example.com\nDNS.2=www.example.com")) -extensions v3_req
生成客户端证书
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr -subj "/C=CN/O=People's Republic of China/CN=Private certificate assigned to Tom"
openssl x509 -req -in client.csr -out client.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650
curl命令
curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1
curl -k https://www.example.com/ --resolve www.example.com:443:127.0.0.1
curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1 --cert ./client.crt --key ./client.key
