User Tools
пакет_openssl
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
пакет_openssl [2024/07/18 14:40] val [Debian] |
пакет_openssl [2025/10/20 09:30] (current) val [Отзыв сертификатов] |
||
|---|---|---|---|
| Line 14: | Line 14: | ||
| ===== Интерактивное подключение по ssl ===== | ===== Интерактивное подключение по ssl ===== | ||
| + | |||
| + | * [[Настройка терминалов]] | ||
| + | |||
| <code> | <code> | ||
| $ openssl s_client -connect ru.wikipedia.org:443 | $ openssl s_client -connect ru.wikipedia.org:443 | ||
| - | |||
| - | $ openssl s_client -showcerts -connect webinar6.bmstu.ru:443 2>/dev/null | openssl x509 -noout -dates #-text | grep bmstu | ||
| $ faketime -f "+500d" wget -q -O /dev/null https://webinar7.bmstu.ru && echo Ok || echo Err | $ faketime -f "+500d" wget -q -O /dev/null https://webinar7.bmstu.ru && echo Ok || echo Err | ||
| Line 103: | Line 104: | ||
| openssl genrsa -out wild.key 2048 | openssl genrsa -out wild.key 2048 | ||
| openssl req -new -x509 -days 3650 -key wild.key -out wild.crt -subj '/CN=*.corpX.un/O=CKO/C=RU' -addext 'subjectAltName=DNS:*.corpX.un' | openssl req -new -x509 -days 3650 -key wild.key -out wild.crt -subj '/CN=*.corpX.un/O=CKO/C=RU' -addext 'subjectAltName=DNS:*.corpX.un' | ||
| + | |||
| + | |||
| </code> | </code> | ||
| ==== Просмотр содержимого файла сертификата ==== | ==== Просмотр содержимого файла сертификата ==== | ||
| Line 259: | Line 262: | ||
| ==== Инициализация списка отозванных сертификатов ==== | ==== Инициализация списка отозванных сертификатов ==== | ||
| <code> | <code> | ||
| - | lan# openssl ca -gencrl -out /var/www/html/ca.crl | + | lan# openssl ca -gencrl -crldays 365 -out /var/www/html/ca.crl |
| </code><code> | </code><code> | ||
| Enter pass phrase for ./CA/ca.key:Pa$$w0rd | Enter pass phrase for ./CA/ca.key:Pa$$w0rd | ||
| Line 284: | Line 287: | ||
| ... | ... | ||
| </code> | </code> | ||
| + | или | ||
| + | <code> | ||
| + | gate# openssl req -new -key gate.key -out gate.req -subj '/C=RU/ST=Moscow region/L=Moscow/O=cko/OU=noc/CN=gate.corpX.un' | ||
| + | </code> | ||
| + | |||
| + | |||
| === Добавление расширений в запрос на сертификат === | === Добавление расширений в запрос на сертификат === | ||
| Line 314: | Line 323: | ||
| ==== Подпись запроса на сертификат центром сертификации ==== | ==== Подпись запроса на сертификат центром сертификации ==== | ||
| - | <code> | ||
| - | lan# openssl ca -days 365 -in www.req -out www.crt # -extfile www.ext | ||
| - | |||
| - | lan# cat CA/index.txt | ||
| - | |||
| - | lan# ls CA/newcerts/ | ||
| - | </code> | ||
| === Добавление расширений при подписи запроса на сертификат === | === Добавление расширений при подписи запроса на сертификат === | ||
| Line 332: | Line 334: | ||
| DNS.2 = www.corpX.un | DNS.2 = www.corpX.un | ||
| #DNS.1 = *.corpX.un | #DNS.1 = *.corpX.un | ||
| + | </code><code> | ||
| + | lan# openssl ca -days 365 -in www.req -out www.crt -extfile www.ext | ||
| + | |||
| + | lan# cat CA/index.txt | ||
| + | |||
| + | lan# ls CA/newcerts/ | ||
| </code> | </code> | ||
| + | |||
| + | |||
| ==== Копирование подписанного сертификата на целевой сервер ==== | ==== Копирование подписанного сертификата на целевой сервер ==== | ||
| Line 382: | Line 392: | ||
| <code> | <code> | ||
| $ openssl req -new -key user1.key -out user1.req -subj '/C=RU/ST=Moscow region/L=Moscow/O=cko/OU=group1/CN=user1/emailAddress=user1@corpX.un/' | $ openssl req -new -key user1.key -out user1.req -subj '/C=RU/ST=Moscow region/L=Moscow/O=cko/OU=group1/CN=user1/emailAddress=user1@corpX.un/' | ||
| + | </code> | ||
| + | ИЛИ | ||
| + | <code> | ||
| + | freeipaclient$ openssl req -new -key user1.key -out user1.req -subj '/O=CORPX.UN/CN=user1/emailAddress=user1@corpX.un/' | ||
| </code> | </code> | ||
| Line 412: | Line 426: | ||
| lan# less CA/index.txt | lan# less CA/index.txt | ||
| - | lan# openssl ca -gencrl -out /var/www/html/ca.crl | + | lan# openssl ca -gencrl -crldays 365 -out /var/www/html/ca.crl |
| lan# openssl crl -text -noout -in /var/www/html/ca.crl | less | lan# openssl crl -text -noout -in /var/www/html/ca.crl | less | ||
| Line 420: | Line 434: | ||
| Serial Number: 0N | Serial Number: 0N | ||
| ... | ... | ||
| + | </code><code> | ||
| + | lan# scp /var/www/html/ca.crl gate:/etc/ssl/certs/ | ||
| </code> | </code> | ||
пакет_openssl.1721302858.txt.gz · Last modified: 2024/07/18 14:40 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
