$ openssl speed
$ openssl s_client -connect ru.wikipedia.org:443 $ openssl s_client -showcerts -connect webinar6.bmstu.ru:443 2>/dev/null | openssl x509 -noout -dates #-text | grep bmstu $ faketime -f "+500d" wget -q -O /dev/null https://webinar7.bmstu.ru && echo Ok || echo Err $ openssl s_client -starttls smtp -crlf -connect mailhub.bmstu.ru:25 $ openssl s_client -connect server.corp13.un:993 -crlf lan# openssl s_client -cert user1.crt -key user1.key -connect www.corpX.un:443
GET /cgi-bin/test-cgi HTTP/1.1 Host: www.corpX.un
lan# openssl s_client -cert user1.crt -key user1.key -connect server.corpX.un:993
01 AUTHENTICATE EXTERNAL =
# openssl enc -aes-256-cbc -e -md md5 -in /root/spa-000E08NNNNNN.cfg -out spa-000E08NNNNNN.enc -pass pass:spapassword # openssl enc -aes-256-cbc -d -md md5 -in spa-000E08NNNNNN.enc -out spa-000E08NNNNNN.cfg -pass pass:spapassword
$ openssl genrsa 2048 > key.private $ openssl rsa -pubout < key.private > key.public
openssl3$ openssl pkeyutl -encrypt -inkey key.public -pubin < data.txt > data.enc openssl1$ openssl rsautl -encrypt -inkey key.public -pubin < data.txt > data.enc openssl3$ openssl pkeyutl -decrypt -inkey key.private < data.enc | tee data.txt openssl1$ openssl rsautl -decrypt -inkey key.private < data.enc > data.txt
$ openssl dgst -sha256 -sign key.private -out data.sign data.txt $ openssl dgst -sha256 -verify key.public -signature data.sign data.txt
# time openssl dhparam -out /etc/openvpn/dh2048.pem 2048 ... real 2m6.588s ...
server# openssl genrsa -out server.key 2048 server# ###chmod 400 server.key
server# openssl req -new -x509 -days 3650 -key server.key -out server.crt -addext 'subjectAltName=DNS:server.corpX.un'
... Country Name (2 letter code) [AU]:RU State or Province Name (full name) [Some-State]:Moscow region Locality Name (eg, city) []:Moscow Organization Name (eg, company) [Internet Widgits Pty Ltd]:cko Organizational Unit Name (eg, section) []:noc Common Name (eg, YOUR name) []:server.corpX.un !!!! для некоторых сервисов (ovpn) не должно быть пустым Email Address []:noc@corpX.un
ИЛИ
openssl genrsa -out wild.key 2048 openssl req -new -x509 -days 3650 -key wild.key -out wild.crt -subj '/CN=*.corpX.un/O=CKO/C=RU' -addext 'subjectAltName=DNS:*.corpX.un'
server# openssl x509 -text -noout -in server.crt server# openssl x509 -text -noout -----BEGIN CERTIFICATE----- ... $ cat ~/.kube/config | grep client-certificate-data | cut -f2 -d : | tr -d ' ' | base64 -d | openssl x509 -text -out -
server# openssl verify server.crt ... error 20 at 0 depth lookup: unable to get local issuer certificate error server.crt: verification failed
# wget http://lan.corpX.un/ca.crt # cp ca.crt /usr/local/share/ca-certificates/ или # cp corpX-PDC-CA.crt /usr/local/share/ca-certificates/ или # cp wild.crt /usr/local/share/ca-certificates/ # update-ca-certificates Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done. ... server# ls /etc/ssl/certs | grep "wild\|corp\|ca.pem" ... # openssl verify server.crt server.crt: OK # curl -v https://www.corpX.un
# yum install ca-certificates # update-ca-trust force-enable # wget http://lan.corp13.un/ca.crt # cp ca.crt /etc/pki/ca-trust/source/anchors/ # update-ca-trust extract # wget -O - https://www.corp13.un
server# rm /usr/local/share/ca-certificates/corpX-PDC-CA.crt server# rm /etc/ssl/certs/corpX-PDC-CA.pem server# update-ca-certificates
lan# cat /etc/ssl/openssl.cnf
... [ CA_default ] dir = /root/CA ... #unique_subject = no ... #copy_extensions = copy ... certificate = /var/www/html/ca.crt crl = /var/www/html/ca.crl private_key = $dir/ca.key [ policy_match ] ...
cd mkdir -p /var/www/html/ mkdir CA mkdir CA/certs mkdir CA/newcerts mkdir CA/crl touch CA/index.txt echo "01" > CA/serial echo "01" > CA/crlnumber
lan# openssl genrsa -des3 -out CA/ca.key 2048
Generating RSA key, 2048 bits Enter PEM pass phrase:Pa$$w0rd Verifying - Enter PEM pass phrase:Pa$$w0rd
lan# cat /etc/ssl/openssl.cnf
... [ req_distinguished_name ] ... countryName_default = RU stateOrProvinceName_default = Moscow region localityName_default = Moscow 0.organizationName_default = cko organizationalUnitName_default = noc emailAddress_default = noc@corpX.un [ req_attributes ] ...
lan# openssl req -new -x509 -days 3650 -key CA/ca.key -out /var/www/html/ca.crt
Enter pass phrase for ca.key:Pa$$w0rd ... Common Name (eg, YOUR name) []:corpX.un
lan# openssl ca -gencrl -out /var/www/html/ca.crl
Enter pass phrase for ./CA/ca.key:Pa$$w0rd
www# openssl genrsa -out www.key 2048
lan# scp /etc/ssl/openssl.cnf www:/etc/ssl/ www# openssl req -new -key www.key -out www.req #-sha256
... Common Name (eg, YOUR name) []:www.corpX.un ...
# cat /etc/ssl/openssl.cnf
... [ req ] ... req_extensions = v3_req [ req_distinguished_name ] ... [ v3_req ] ... subjectAltName = @alt_names [ alt_names ] DNS.1 = corpX.un DNS.2 = www.corpX.un #DNS.1 = *.corpX.un
www# scp www.req lan: lan# openssl req -text -noout -in www.req
lan# openssl ca -days 365 -in www.req -out www.crt # -extfile www.ext lan# cat CA/index.txt lan# ls CA/newcerts/
# cat www.ext
subjectAltName = @alt_names [alt_names] DNS.1 = corpX.un DNS.2 = www.corpX.un #DNS.1 = *.corpX.un
lan# scp www.crt www: www# rm www.req
www# wget http://lan.corpX.un/ca.crt www# openssl verify -CAfile ca.crt www.crt
$ openssl x509 -noout -modulus -in www.crt | openssl md5 $ openssl rsa -noout -modulus -in www.key | openssl md5
www# openssl rsa -des3 -in www.clkey -out www.enckey
$ openssl genrsa -out user1.key 2048
$ openssl req -new -key user1.key -out user1.req ... Organizational Unit Name (eg, section) [noc]:group1 Common Name (eg, YOUR name) []:user1 Email Address [noc@corpX.un]:user1@corpX.un ...
ИЛИ
$ openssl req -new -key user1.key -out user1.req -subj '/C=RU/ST=Moscow region/L=Moscow/O=cko/OU=group1/CN=user1/emailAddress=user1@corpX.un/'
lan# openssl ca -days 365 -in user1.req -out user1.crt lan# cat CA/index.txt lan# ls CA/newcerts/
!!! Сразу импортировать в хранилище сертификатов на клиенте !!!
$ openssl pkcs12 -export -in user1.crt -inkey user1.key -out user1.p12 -passout pass:ppassword1 openssl3# openssl pkcs12 -legacy -export -in user1.crt -inkey user1.key -out user1.p12 -passout pass:ppassword1 $ openssl pkcs12 -info -in user1.p12
lan# less CA/index.txt
lan# openssl ca -revoke CA/newcerts/02.pem
lan# less CA/index.txt
lan# openssl ca -gencrl -out /var/www/html/ca.crl
lan# openssl crl -text -noout -in /var/www/html/ca.crl | less
...
Serial Number: 0M
...
Serial Number: 0N
...