User Tools
пакет_openssl
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
пакет_openssl [2024/05/20 08:09] val [Подпись запроса на сертификат центром сертификации] |
пакет_openssl [2025/02/27 06:16] (current) val [Интерактивное подключение по ssl] |
||
|---|---|---|---|
| Line 14: | Line 14: | ||
| ===== Интерактивное подключение по ssl ===== | ===== Интерактивное подключение по ssl ===== | ||
| + | |||
| + | * [[Настройка терминалов]] | ||
| + | |||
| <code> | <code> | ||
| $ openssl s_client -connect ru.wikipedia.org:443 | $ openssl s_client -connect ru.wikipedia.org:443 | ||
| - | |||
| - | $ openssl s_client -showcerts -connect webinar6.bmstu.ru:443 2>/dev/null | openssl x509 -noout -dates #-text | grep bmstu | ||
| $ faketime -f "+500d" wget -q -O /dev/null https://webinar7.bmstu.ru && echo Ok || echo Err | $ faketime -f "+500d" wget -q -O /dev/null https://webinar7.bmstu.ru && echo Ok || echo Err | ||
| $ openssl s_client -starttls smtp -crlf -connect mailhub.bmstu.ru:25 | $ openssl s_client -starttls smtp -crlf -connect mailhub.bmstu.ru:25 | ||
| + | $ openssl s_client -connect server.corp13.un:993 -crlf | ||
| lan# openssl s_client -cert user1.crt -key user1.key -connect www.corpX.un:443 | lan# openssl s_client -cert user1.crt -key user1.key -connect www.corpX.un:443 | ||
| Line 44: | Line 46: | ||
| ==== Создание пары приватный/публичный ключ ==== | ==== Создание пары приватный/публичный ключ ==== | ||
| <code> | <code> | ||
| - | student@lan:~$ | + | $ openssl genrsa 2048 > key.private |
| - | user1@server:~$ openssl genrsa 2048 > key.private | + | |
| - | student@lan:~$ | + | $ openssl rsa -pubout < key.private > key.public |
| - | user1@server:~$ openssl rsa -pubout < key.private > key.public | + | |
| - | + | ||
| - | user1@server:~$ scp key.public user2@www: | + | |
| - | student@lan:~$ ftp-upload -h server -u student --password xxxxxxxx -v key.public | + | |
| </code> | </code> | ||
| - | * [[Сервис FTP#Команды ftp клиента]] | ||
| ==== Шифрование данных ==== | ==== Шифрование данных ==== | ||
| <code> | <code> | ||
| - | student@server:~$ openssl pkeyutl -encrypt -inkey key.public -pubin < data.txt > data.enc | + | openssl3$ openssl pkeyutl -encrypt -inkey key.public -pubin < data.txt > data.enc |
| - | user2@www:~$ openssl rsautl -encrypt -inkey key.public -pubin < data.txt > data.enc | + | openssl1$ openssl rsautl -encrypt -inkey key.public -pubin < data.txt > data.enc |
| - | + | ||
| - | user2@www:~$ scp data.enc user1@server: | + | |
| - | student@lan:~$ curl -v -o data.enc ftp://student:xxxxxxxx@server/data.enc | + | |
| - | student@lan:~$ openssl pkeyutl -decrypt -inkey key.private < data.enc | tee data.txt | + | openssl3$ openssl pkeyutl -decrypt -inkey key.private < data.enc | tee data.txt |
| - | user1@server:~$ openssl rsautl -decrypt -inkey key.private < data.enc > data.txt | + | openssl1$ openssl rsautl -decrypt -inkey key.private < data.enc > data.txt |
| </code> | </code> | ||
| ==== Цифровая подпись ==== | ==== Цифровая подпись ==== | ||
| <code> | <code> | ||
| - | student@lan:~$ | + | $ openssl dgst -sha256 -sign key.private -out data.sign data.txt |
| - | user1@server:~$ openssl dgst -sha256 -sign key.private -out data.sign data.txt | + | |
| - | user1@server:~$ scp data.* user2@www: | + | $ openssl dgst -sha256 -verify key.public -signature data.sign data.txt |
| - | student@lan:~$ ftp-upload -h server -u student --password xxxxxxxx -v data* | + | |
| - | + | ||
| - | student@server:~$ | + | |
| - | user2@www:~$ openssl dgst -sha256 -verify key.public -signature data.sign data.txt | + | |
| </code> | </code> | ||
| Line 114: | Line 102: | ||
| <code> | <code> | ||
| + | openssl genrsa -out wild.key 2048 | ||
| openssl req -new -x509 -days 3650 -key wild.key -out wild.crt -subj '/CN=*.corpX.un/O=CKO/C=RU' -addext 'subjectAltName=DNS:*.corpX.un' | openssl req -new -x509 -days 3650 -key wild.key -out wild.crt -subj '/CN=*.corpX.un/O=CKO/C=RU' -addext 'subjectAltName=DNS:*.corpX.un' | ||
| </code> | </code> | ||
| Line 143: | Line 132: | ||
| # cp ca.crt /usr/local/share/ca-certificates/ | # cp ca.crt /usr/local/share/ca-certificates/ | ||
| - | + | или | |
| - | server# cp corpX-PDC-CA.crt /usr/local/share/ca-certificates/ | + | # cp corpX-PDC-CA.crt /usr/local/share/ca-certificates/ |
| + | или | ||
| + | # cp wild.crt /usr/local/share/ca-certificates/ | ||
| # update-ca-certificates | # update-ca-certificates | ||
| Line 151: | Line 142: | ||
| ... | ... | ||
| - | server# ls /etc/ssl/certs | grep corp | + | server# ls /etc/ssl/certs | grep "wild\|corp\|ca.pem" |
| ... | ... | ||
| - | server# openssl verify server.crt | + | # openssl verify server.crt |
| server.crt: OK | server.crt: OK | ||
| - | # wget -O - https://www.corpX.un | + | # curl -v https://www.corpX.un |
| </code> | </code> | ||
| Line 211: | Line 202: | ||
| #unique_subject = no | #unique_subject = no | ||
| ... | ... | ||
| - | copy_extensions = copy | + | #copy_extensions = copy |
| ... | ... | ||
| certificate = /var/www/html/ca.crt | certificate = /var/www/html/ca.crt | ||
| Line 269: | Line 260: | ||
| ==== Инициализация списка отозванных сертификатов ==== | ==== Инициализация списка отозванных сертификатов ==== | ||
| <code> | <code> | ||
| - | lan# openssl ca -gencrl -out /var/www/html/ca.crl | + | lan# openssl ca -gencrl -crldays 365 -out /var/www/html/ca.crl |
| </code><code> | </code><code> | ||
| Enter pass phrase for ./CA/ca.key:Pa$$w0rd | Enter pass phrase for ./CA/ca.key:Pa$$w0rd | ||
| Line 325: | Line 316: | ||
| ==== Подпись запроса на сертификат центром сертификации ==== | ==== Подпись запроса на сертификат центром сертификации ==== | ||
| <code> | <code> | ||
| - | lan# openssl ca -days 365 -in www.req -out www.crt #-extfile www.ext | + | lan# openssl ca -days 365 -in www.req -out www.crt # -extfile www.ext |
| lan# cat CA/index.txt | lan# cat CA/index.txt | ||
| Line 352: | Line 343: | ||
| ==== Проверка подписи сертификата ==== | ==== Проверка подписи сертификата ==== | ||
| + | |||
| + | * [[#Просмотр содержимого файла сертификата]] | ||
| <code> | <code> | ||
| www# wget http://lan.corpX.un/ca.crt | www# wget http://lan.corpX.un/ca.crt | ||
| Line 420: | Line 413: | ||
| lan# less CA/index.txt | lan# less CA/index.txt | ||
| - | lan# openssl ca -gencrl -out /var/www/html/ca.crl | + | lan# openssl ca -gencrl -crldays 365 -out /var/www/html/ca.crl |
| lan# openssl crl -text -noout -in /var/www/html/ca.crl | less | lan# openssl crl -text -noout -in /var/www/html/ca.crl | less | ||
пакет_openssl.1716181768.txt.gz · Last modified: 2024/05/20 08:09 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
