Openssl如何生成并验证公秘钥对
在沒有PKI，也即Public Key Instrastructure的時候，用的是對稱加密，也即雙方持有同一個秘鑰，用同一個秘鑰進行加密和解密。
這種方式表面上看沒有問題，但是仔細一想，共享的秘鑰如何傳給對方呢？如果從網絡上傳輸，如果被截獲了，那就慘了，有可能被仿冒。
只好使用傳統的手段，打個電話，寫封信，或者直接讓你去柜臺領取。
后來就有了公鑰和私鑰對，私鑰放在每個人手里，不用給任何人，也不能給任何人，公鑰可以放在網上，隨人下載。私鑰加密的，公鑰可以解密，公鑰加密的，私鑰可以解密。
因為在秘鑰之外引入了公鑰，所以稱為PKI。
然而一個問題是，既然公鑰隨處可下載，那么我怎么信任這個公鑰呢？
需要有一個更加權威的機構來用它的秘鑰在公鑰上蓋一個章，稱為簽名，權威機構認了，也就能夠證明了。
權威機構是用自己的秘鑰蓋的章，怎么證明這個章沒有偽造呢，需要從權威機構那里拿到他的秘鑰對應的公鑰，發現兩個是一對，能夠把章解的開，就說明章真的是這個權威機構蓋得。
然而權威機構的公鑰也是隨處可以下載，怎么信任呢？還需要更高的權威機構在這個權威機構的公鑰上蓋章，用啥蓋，當然是用更高的權威機構的秘鑰蓋。怎么證明章沒有偽造？當然要用更高的權威機構的公鑰去解密一下這個章。
哈哈，循環了。不斷的找權威機構，從街道辦，一直找到國務院，稱為根權威機構，root CA，沒有更牛的人可以證明了，你愛信不信。
覺得自己最牛，不需要別人證明的網站，自己做自己的root CA，自己給自己簽名，稱為Self Signed Certificate，反正我為自己代言，你愛信不信，不信去別的網站吧。
例如某火車票網站，你必須強制在瀏覽器里面去信任他的證書，有本事你不做火車啊。
接下來我們看整個過程。
先假設自己是一個CA，而且是一個root CA，Cliu8CA
生成一個CA的private key
openssl genrsa -out caprivate.key 1024
當然可以跟密碼
openssl genrsa -out caprivatepass.key 1024 -des3 -passout hello:world 1024
CA有一個certificate，里面放著CA的public key，要生成這個certificate，則需要寫一個certificate request
# openssl req -key caprivate.key -new -out cacertificate.req???????????????????????????
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN?????
State or Province Name (full name) [Some-State]:Cliu8CA
Locality Name (eg, city) []:Cliu8CA
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cliu8CA
Organizational Unit Name (eg, section) []:Cliu8CA
Common Name (e.g. server FQDN or YOUR name) []:Cliu8CA
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
查看證書請求
# openssl req -in cacertificate.req -text??????????????????????????????????????????????
Certificate Request:
??? Data:
??????? Version: 0 (0x0)
??????? Subject: C=CN, ST=Cliu8CA, L=Cliu8CA, O=Cliu8CA, OU=Cliu8CA, CN=Cliu8CA
??????? Subject Public Key Info:
??????????? Public Key Algorithm: rsaEncryption
??????????????? Public-Key: (1024 bit)
??????????????? Modulus:
??????????????????? 00:c5:f1:aa:1e:01:04:1b:a5:dd:7a:ef:c3:7d:2a:
??????????????????? 9c:73:b6:46:bb:f8:be:90:9d:3f:d8:d7:d6:d5:8b:
??????????????????? a5:17:e3:aa:e5:37:bd:cd:fb:da:84:ce:0b:38:56:
??????????????????? b4:19:6d:f6:11:32:bb:e5:77:2d:75:39:49:a0:2a:
??????????????????? 6c:fd:ed:39:0d:b5:59:bc:60:09:c6:5f:06:a0:aa:
??????????????????? 53:a5:3b:94:ad:08:a7:13:99:1b:c4:e4:38:79:07:
??????????????????? 9e:fd:c1:2d:db:ab:f6:2e:d3:2c:51:24:56:e3:3f:
??????????????????? 60:fd:e4:b5:6b:1b:ff:f2:8b:83:7d:11:a1:10:d6:
??????????????????? 85:75:ed:0d:76:69:7a:ac:77
??????????????? Exponent: 65537 (0x10001)
??????? Attributes:
??????????? a0:00
??? Signature Algorithm: sha256WithRSAEncryption
???????? 2b:c2:3d:f6:ff:a3:2a:c0:a3:f4:3c:81:6f:a6:bd:fd:17:58:
???????? 39:a5:de:07:f0:0a:19:3f:ad:4f:2a:5e:c8:60:da:41:5d:67:
???????? 82:cd:08:ef:36:72:b1:25:79:ed:ce:54:9c:12:f8:ba:5d:73:
???????? cf:99:f1:a9:39:af:7a:d0:fa:fa:97:0d:1b:c1:2d:14:6c:d1:
???????? bf:c4:b2:16:76:d8:99:cd:96:dd:99:1b:e1:90:64:e6:9a:51:
???????? ac:ad:27:3a:b3:e0:df:7d:c5:28:89:7b:5f:f8:5a:4c:c1:0d:
???????? ad:d6:b8:a0:9f:fa:68:1f:93:a7:dd:90:de:58:ee:87:23:8a:
???????? b2:d8
-----BEGIN CERTIFICATE REQUEST-----
MIIBpzCCARACAQAwZzELMAkGA1UEBhMCQ04xEDAOBgNVBAgMB0NsaXU4Q0ExEDAO
BgNVBAcMB0NsaXU4Q0ExEDAOBgNVBAoMB0NsaXU4Q0ExEDAOBgNVBAsMB0NsaXU4
Q0ExEDAOBgNVBAMMB0NsaXU4Q0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
AMXxqh4BBBul3Xrvw30qnHO2Rrv4vpCdP9jX1tWLpRfjquU3vc372oTOCzhWtBlt
9hEyu+V3LXU5SaAqbP3tOQ21WbxgCcZfBqCqU6U7lK0IpxOZG8TkOHkHnv3BLdur
9i7TLFEkVuM/YP3ktWsb//KLg30RoRDWhXXtDXZpeqx3AgMBAAGgADANBgkqhkiG
9w0BAQsFAAOBgQArwj32/6MqwKP0PIFvpr39F1g5pd4H8AoZP61PKl7IYNpBXWeC
zQjvNnKxJXntzlScEvi6XXPPmfGpOa960Pr6lw0bwS0UbNG/xLIWdtiZzZbdmRvh
kGTmmlGsrSc6s+DffcUoiXtf+FpMwQ2t1rign/poH5On3ZDeWO6HI4qy2A==
-----END CERTIFICATE REQUEST-----
這個證書請求需要更高級的CA用它的private key對這個證書請求進行簽發，方才能被大家公認(如果大家相信的是更高級的CA，則可以用更高級的CA的certificate審核這個證書)
由于這里的CA是root CA，沒有更高級的CA了，所以要進行自簽發，用自己的private key對自己的certificate請求進行簽發
# openssl x509 -req -in cacertificate.req -signkey caprivate.key -out cacertificate.pem
Signature ok
subject=/C=CN/ST=Cliu8CA/L=Cliu8CA/O=Cliu8CA/OU=Cliu8CA/CN=Cliu8CA
Getting Private key
查看證書內容
# openssl x509 -in cacertificate.pem -noout -text
Certificate:
??? Data:
??????? Version: 1 (0x0)
??????? Serial Number: 13213819544855395531 (0xb760eaddc1383ccb)
??? Signature Algorithm: sha256WithRSAEncryption
??????? Issuer: C=CN, ST=Cliu8CA, L=Cliu8CA, O=Cliu8CA, OU=Cliu8CA, CN=Cliu8CA
??????? Validity
??????????? Not Before: Jul 14 18:35:36 2017 GMT
??????????? Not After : Aug 13 18:35:36 2017 GMT
??????? Subject: C=CN, ST=Cliu8CA, L=Cliu8CA, O=Cliu8CA, OU=Cliu8CA, CN=Cliu8CA
??????? Subject Public Key Info:
??????????? Public Key Algorithm: rsaEncryption
??????????????? Public-Key: (1024 bit)
??????????????? Modulus:
??????????????????? 00:c5:f1:aa:1e:01:04:1b:a5:dd:7a:ef:c3:7d:2a:
??????????????????? 9c:73:b6:46:bb:f8:be:90:9d:3f:d8:d7:d6:d5:8b:
??????????????????? a5:17:e3:aa:e5:37:bd:cd:fb:da:84:ce:0b:38:56:
??????????????????? b4:19:6d:f6:11:32:bb:e5:77:2d:75:39:49:a0:2a:
??????????????????? 6c:fd:ed:39:0d:b5:59:bc:60:09:c6:5f:06:a0:aa:
??????????????????? 53:a5:3b:94:ad:08:a7:13:99:1b:c4:e4:38:79:07:
??????????????????? 9e:fd:c1:2d:db:ab:f6:2e:d3:2c:51:24:56:e3:3f:
??????????????????? 60:fd:e4:b5:6b:1b:ff:f2:8b:83:7d:11:a1:10:d6:
??????????????????? 85:75:ed:0d:76:69:7a:ac:77
??????????????? Exponent: 65537 (0x10001)
??? Signature Algorithm: sha256WithRSAEncryption
???????? 16:61:a5:1f:c9:3c:0f:84:48:e4:52:2f:23:06:bf:c7:2c:29:
???????? 17:ed:26:e0:b8:1a:0e:d1:9b:bb:f7:57:1a:bd:f3:41:75:b1:
???????? ed:d1:44:ea:b6:a8:4d:f4:17:82:af:d7:1d:e8:4f:82:fc:bb:
???????? 87:9b:74:a2:2a:2d:16:8b:26:5b:bf:60:10:ee:2d:0d:e0:d3:
???????? 0e:30:9e:12:1e:2b:12:34:3d:e8:7f:db:0b:05:8b:52:ba:e6:
???????? 36:97:2d:df:72:90:23:16:4e:ab:e4:6a:d1:0b:92:4f:84:ef:
???????? 3e:8f:ec:f7:8f:c2:11:81:c2:e8:aa:57:35:61:20:11:6b:d4:
???????? b5:ef
CA的證書和private key應該是一對
我們首先獲取certificate中public key的RSA模
# openssl x509 -in cacertificate.pem -noout -modulus
Modulus=C5F1AA1E01041BA5DD7AEFC37D2A9C73B646BBF8BE909D3FD8D7D6D58BA517E3AAE537BDCDFBDA84CE0B3856B4196DF61132BBE5772D753949A02A6CFDED390DB559BC6009C65F06A0AA53A53B94AD08A713991BC4E43879079EFDC12DDBABF62ED32C512456E33F60FDE4B56B1BFFF28B837D11A110D68575ED0D76697AAC77
然后獲取private key的RSA模
# openssl rsa -in caprivate.key -noout -modulus
Modulus=C5F1AA1E01041BA5DD7AEFC37D2A9C73B646BBF8BE909D3FD8D7D6D58BA517E3AAE537BDCDFBDA84CE0B3856B4196DF61132BBE5772D753949A02A6CFDED390DB559BC6009C65F06A0AA53A53B94AD08A713991BC4E43879079EFDC12DDBABF62ED32C512456E33F60FDE4B56B1BFFF28B837D11A110D68575ED0D76697AAC77
應該是一致的
下面假設自己是一個普通的機構Cliu8Site
這個普通的機構需要有自己的private key
openssl genrsa -out cliu8siteprivate.key 1024
也需要一個證書，里面放自己的public key，需要一個證書請求
# openssl req -key cliu8siteprivate.key -new -out cliu8sitecertificate.req?????????????????
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Cliu8Site
Locality Name (eg, city) []:Cliu8Site
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cliu8Site
Organizational Unit Name (eg, section) []:Cliu8Site
Common Name (e.g. server FQDN or YOUR name) []:Cliu8Site
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
要使得這個證書被認可，則需要一個CA對這個證書進行簽名，我們用上面的Cliu8CA的private key對他進行簽名
其實這個過程是Cliu8Site這個普通網站，將自己的請求發送給Cliu8CA后，由Cliu8CA來做的，只有Cliu8CA才有自己的private key
# openssl x509 -req -in cliu8sitecertificate.req -CA cacertificate.pem -CAkey caprivate.key -out cliu8sitecertificate.pem -CAcreateserial?????
Signature ok
subject=/C=CN/ST=Cliu8Site/L=Cliu8Site/O=Cliu8Site/OU=Cliu8Site/CN=Cliu8Site
Getting CA Private Key
查看這個證書
# openssl x509 -in cliu8sitecertificate.pem -noout -text?????????????????????????????????? Certificate:
??? Data:
??????? Version: 1 (0x0)
??????? Serial Number: 9637235651545248876 (0x85be56c3cb15b46c)
??? Signature Algorithm: sha256WithRSAEncryption
??????? Issuer: C=CN, ST=Cliu8CA, L=Cliu8CA, O=Cliu8CA, OU=Cliu8CA, CN=Cliu8CA
??????? Validity
??????????? Not Before: Jul 14 18:53:42 2017 GMT
??????????? Not After : Aug 13 18:53:42 2017 GMT
??????? Subject: C=CN, ST=Cliu8Site, L=Cliu8Site, O=Cliu8Site, OU=Cliu8Site, CN=Cliu8Site
??????? Subject Public Key Info:
??????????? Public Key Algorithm: rsaEncryption
??????????????? Public-Key: (1024 bit)
??????????????? Modulus:
??????????????????? 00:e0:53:64:76:ae:f2:30:83:24:ae:0e:b6:a0:88:
??????????????????? 9b:e9:c0:a1:8a:81:f4:ad:0c:79:ac:e0:52:94:2f:
??????????????????? 56:91:09:8c:ec:a8:8b:9b:1a:f9:37:68:dd:57:63:
??????????????????? 06:ec:5f:90:54:d0:8c:3a:da:c5:04:7e:15:b6:32:
??????????????????? c9:2d:f3:c5:4f:c8:a7:f6:0a:99:24:a6:85:9f:79:
??????????????????? 48:c0:7e:8b:b4:58:be:f7:3f:45:a5:a8:eb:ed:dd:
??????????????????? e1:6a:95:bd:a4:12:47:ed:02:11:9a:36:28:52:43:
??????????????????? 3b:6d:33:fe:25:ce:f9:b6:b3:23:e1:e6:a5:5c:65:
??????????????????? 03:4f:24:03:1a:14:fb:d2:21
??????????????? Exponent: 65537 (0x10001)
??? Signature Algorithm: sha256WithRSAEncryption
???????? 35:df:de:b9:aa:6b:d0:f9:4f:c6:3f:ba:6d:de:4b:5a:a3:88:
???????? b1:9f:dd:75:c7:4a:7a:58:84:3b:aa:3e:fb:7b:f1:78:c6:19:
???????? 65:43:94:fb:69:10:1b:3a:7f:65:61:2b:6e:33:9d:0a:92:e5:
???????? 8a:93:74:fe:ee:11:cf:8e:85:37:da:14:db:32:f9:4d:3d:e6:
???????? c3:21:5e:e8:c9:50:85:71:b4:16:60:4b:04:87:df:84:60:4a:
???????? 49:66:a9:69:30:a9:f5:90:95:34:6c:49:23:68:42:16:ef:b1:
???????? 91:e8:60:b8:de:29:d8:aa:10:63:8c:99:05:14:b8:c9:be:c5:
???????? a7:79
從這個證書我們可以看到，它是Cliu8CA頒發給Cliu8Site的
Cliu8Site的certificate和public key是應該相互匹配的
root@popsuper1982:/home/cliu8/keys# openssl x509 -in cliu8sitecertificate.pem -noout -modulus??????????????????????????????? Modulus=E0536476AEF2308324AE0EB6A0889BE9C0A18A81F4AD0C79ACE052942F5691098CECA88B9B1AF93768DD576306EC5F9054D08C3ADAC5047E15B632C92DF3C54FC8A7F60A9924A6859F7948C07E8BB458BEF73F45A5A8EBEDDDE16A95BDA41247ED02119A362852433B6D33FE25CEF9B6B323E1E6A55C65034F24031A14FBD221
root@popsuper1982:/home/cliu8/keys# openssl rsa -in cliu8siteprivate.key -noout -modulus???????????????????????????????????? Modulus=E0536476AEF2308324AE0EB6A0889BE9C0A18A81F4AD0C79ACE052942F5691098CECA88B9B1AF93768DD576306EC5F9054D08C3ADAC5047E15B632C92DF3C54FC8A7F60A9924A6859F7948C07E8BB458BEF73F45A5A8EBEDDDE16A95BDA41247ED02119A362852433B6D33FE25CEF9B6B323E1E6A55C65034F24031A14FBD221
證書鏈的驗證過程
假設我是一個普通用戶，要訪問網站Cliu8Site，通過https協議
Cliu8Site會用自己的private key cliu8siteprivate.key加密數據，傳給我，我接收到數據后，需要用Cliu8Site的public key進行解密
這個時候Cliu8Site會把它的certificate cliu8sitecertificate.pem通過瀏覽器傳給我，里面就有public key。
但是我怎么能夠相信這個certificate呢？我不相信，需要更高的權威機構
我查看cliu8sitecertificate.pem，發現這個certificate是由Cliu8CA進行簽發的，所謂簽發，也即用Cliu8CA的private key caprivate.key進行的簽名。所以我要從Cliu8CA的網站上下載它的certificate，cacertificate.pem，里面包含這public key，我們用這個public key來解簽名
# openssl verify -CAfile cacertificate.pem cliu8sitecertificate.pem?
cliu8sitecertificate.pem: OK
哦，我明白了，Cliu8CA可以證明cliu8sitecertificate.pem是一個對的certificate，里面的public key是可以信任的，你是可以用它來解密Cliu8Site發來的數據。
但是問題來了，我能相信Cliu8CA這個機構么？
我查看cacertificate.pem，發現它是自簽名的，也即是一個root certificate，沒有一個更高的機構為它證明了。
如果我相信Cliu8CA這個機構，那么我解密Cliu8Site的數據，接著進行我們之間的信息交互。
如果我不相信Cliu8CA這個機構，在交互到此為止。
當然有的時候，我們發現Cliu8CA這個機構的證書是更高權威機構簽名的，比如是BeijingPoliceOffice簽發的，如果你相信他，你就可以進行訪問。這就是證書鏈。
總結
以上是生活随笔為你收集整理的Openssl如何生成并验证公秘钥对的全部內容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： mapreduce 算法_MapRedu
- 下一篇： 李想再度“开团”