nginx代理服务器配置双向证书验证的方法-创新互联

生成证书链

用脚本生成一个根证书, 一个中间证书(intermediate), 三个客户端证书.

中间证书的域名为 localhost.

#!/bin/bash -x
set -e
for C in `echo root-ca intermediate`; do
 mkdir $C
 cd $C
 mkdir certs crl newcerts private
 cd ..
 echo 1000 > $C/serial
 touch $C/index.txt $C/index.txt.attr
 echo '
[ ca ]
default_ca = CA_default
[ CA_default ]
dir      = '$C'  # Where everything is kept
certs     = $dir/certs        # Where the issued certs are kept
crl_dir    = $dir/crl        # Where the issued crl are kept
database    = $dir/index.txt      # database index file.
new_certs_dir = $dir/newcerts      # default place for new certs.
certificate  = $dir/cacert.pem        # The CA certificate
serial     = $dir/serial        # The current serial number
crl      = $dir/crl.pem        # The current CRL
private_key  = $dir/private/ca.key.pem    # The private key
RANDFILE    = $dir/.rnd   # private random number file
nameopt    = default_ca
certopt    = default_ca
policy     = policy_match
default_days  = 365
default_md   = sha256
[ policy_match ]
countryName      = optional
stateOrProvinceName  = optional
organizationName    = optional
organizationalUnitName = optional
commonName       = supplied
emailAddress      = optional
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req]
basicConstraints = CA:TRUE
' > $C/openssl.conf
done
openssl genrsa -out root-ca/private/ca.key 2048
openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/CN=Root-ca'
openssl genrsa -out intermediate/private/intermediate.key 2048
openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/CN=localhost.'
openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt
mkdir out
for I in `seq 1 3` ; do
 openssl req -new -keyout out/$I.key -out out/$I.request -days 365 -nodes -subj "/CN=$I.example.com" -newkey rsa:2048
 openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$I.crt -infiles out/$I.request
done

另外有需要云服务器可以了解下创新互联scvps.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。