• Цифровые SSL сертификаты. Разновидности, как выбрать?
• Основы работы с OpenSSL
• How to create an intermediate certificate authority (CA)
• Check your certificate installation

$ openssl speed

$ openssl s_client -connect ru.wikipedia.org:443

$ openssl s_client -showcerts -connect webinar6.bmstu.ru:443 2>/dev/null | openssl x509 -noout -dates #-text | grep bmstu

$ faketime -f "+500d" wget -q -O /dev/null https://webinar7.bmstu.ru && echo Ok || echo Err

$ openssl s_client -starttls smtp -crlf -connect mailhub.bmstu.ru:25

lan# openssl s_client -cert user1.crt -key user1.key -connect www.corpX.un:443

GET /cgi-bin/test-cgi HTTP/1.1
Host: www.corpX.un

lan# openssl s_client -cert user1.crt -key user1.key -connect server.corpX.un:993

01 AUTHENTICATE EXTERNAL =

# openssl enc -aes-256-cbc -e -md md5 -in /root/spa-000E08NNNNNN.cfg -out spa-000E08NNNNNN.enc -pass pass:spapassword

# openssl enc -aes-256-cbc -d -md md5 -in spa-000E08NNNNNN.enc -out spa-000E08NNNNNN.cfg -pass pass:spapassword

student@lan:~$
user1@server:~$ openssl genrsa 2048 > key.private

user1@server:~$ openssl rsa -pubout < key.private > key.public

user1@server:~$ scp key.public user2@www:
student@lan:~$ ftp-upload -h server -u student --password xxxxxxxx -v key.public

• Команды ftp клиента

student@server:~$ openssl pkeyutl -encrypt -inkey key.public -pubin < data.txt > data.enc
user2@www:~$ openssl rsautl -encrypt -inkey key.public -pubin < data.txt > data.enc

user2@www:~$ scp data.enc user1@server:
student@lan:~$ curl -v -o data.enc ftp://student:xxxxxxxx@server/data.enc

student@lan:~$ openssl pkeyutl -decrypt -inkey key.private < data.enc | tee data.txt
user1@server:~$ openssl rsautl -decrypt -inkey key.private < data.enc > data.txt

student@lan:~$
user1@server:~$ openssl dgst -sha256 -sign key.private -out data.sign data.txt

user1@server:~$ scp data.* user2@www:
student@lan:~$ ftp-upload -h server -u student --password password -v data*

student@server:~$
user2@www:~$ openssl dgst -sha256 -verify key.public -signature data.sign data.txt

# time openssl dhparam -out /etc/openvpn/dh2048.pem 2048
real    0m24.676s

• *.corpX.un для wild card сертификата

server# openssl genrsa -out server.key 2048

server# ###chmod 400 server.key

server# openssl req -new -x509 -days 3650 -key server.key -out server.crt -addext 'subjectAltName=DNS:server.corpX.un'

...
Country Name (2 letter code) [AU]:RU
State or Province Name (full name) [Some-State]:Moscow region
Locality Name (eg, city) []:Moscow
Organization Name (eg, company) [Internet Widgits Pty Ltd]:cko       
Organizational Unit Name (eg, section) []:noc
Common Name (eg, YOUR name) []:server.corpX.un       !!!! для некоторых сервисов (ovpn) не должно быть пустым
Email Address []:noc@corpX.un

ИЛИ

openssl req -new -x509 -days 3650 -key wild.key -out wild.crt -subj '/CN=*.corpX.un/O=CKO/C=RU' -addext 'subjectAltName=DNS:*.corpX.un'

server# openssl x509 -text -noout -in server.crt

server# openssl x509 -text -noout
-----BEGIN CERTIFICATE-----
...

$ cat ~/.kube/config | grep client-certificate-data | cut -f2 -d : | tr -d ' ' | base64 -d | openssl x509 -text -out -

• Материалы по Windows Экспорт корневого сертификата

server# openssl verify server.crt
...
error 20 at 0 depth lookup: unable to get local issuer certificate
error server.crt: verification failed

# wget http://lan.corpX.un/ca.crt

# cp ca.crt /usr/local/share/ca-certificates/

server# cp corpX-PDC-CA.crt /usr/local/share/ca-certificates/

# update-ca-certificates
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
...

server# ls /etc/ssl/certs | grep corp
...

server# openssl verify server.crt
server.crt: OK

# wget -O - https://www.corpX.un

# yum install ca-certificates

# update-ca-trust force-enable

# wget http://lan.corp13.un/ca.crt

# cp ca.crt /etc/pki/ca-trust/source/anchors/

# update-ca-trust extract

# wget -O - https://www.corp13.un

server# rm /usr/local/share/ca-certificates/corpX-PDC-CA.crt

server# rm /etc/ssl/certs/corpX-PDC-CA.pem

server# update-ca-certificates

• Certificate Management and Generation with OpenSSL
• Авторизация с помощью клиентских SSL сертификатов
• Create your own Certificate Authority (CA) using OpenSSL
• openssl ca vs openssl x509 comparison

• Can I create client certificates for a received LetsEncrypt certificate?

• Сервис NTP

• OpenSSL sign requests with extensions

lan# cat /etc/ssl/openssl.cnf

...
[ CA_default ]

dir           = /root/CA
...
#unique_subject = no
...
copy_extensions = copy
...
certificate   = /var/www/html/ca.crt
crl           = /var/www/html/ca.crl
private_key   = $dir/ca.key

[ policy_match ]
...

cd
mkdir -p /var/www/html/
mkdir CA
mkdir CA/certs
mkdir CA/newcerts
mkdir CA/crl
touch CA/index.txt
echo "01" > CA/serial
echo "01" > CA/crlnumber

lan# openssl genrsa -des3 -out CA/ca.key 2048

Generating RSA key, 2048 bits
Enter PEM pass phrase:Pa$$w0rd
Verifying - Enter PEM pass phrase:Pa$$w0rd

lan# cat /etc/ssl/openssl.cnf

...
[ req_distinguished_name ]
...
countryName_default           = RU
stateOrProvinceName_default   = Moscow region
localityName_default          = Moscow
0.organizationName_default    = cko
organizationalUnitName_default = noc
emailAddress_default          = noc@corpX.un

[ req_attributes ]
...

lan# openssl req -new -x509 -days 3650 -key CA/ca.key -out /var/www/html/ca.crt

Enter pass phrase for ca.key:Pa$$w0rd
...
Common Name (eg, YOUR name) []:corpX.un

lan# openssl ca -gencrl -out /var/www/html/ca.crl

Enter pass phrase for ./CA/ca.key:Pa$$w0rd

www# openssl genrsa -out www.key 2048

• *.corpX.un для wild card сертификата

lan# scp /etc/ssl/openssl.cnf www:/etc/ssl/

www# openssl req -new -key www.key -out www.req   #-sha256

...
Common Name (eg, YOUR name) []:www.corpX.un
...

# cat /etc/ssl/openssl.cnf

...
[ req ]
...
req_extensions = v3_req

[ req_distinguished_name ]
...
[ v3_req ]
...
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = corpX.un
DNS.2 = www.corpX.un
#DNS.1 = *.corpX.un

www# scp www.req lan:

lan# openssl req -text -noout -in www.req

lan# openssl ca -days 365 -in www.req -out www.crt

lan# cat CA/index.txt

lan# ls CA/newcerts/

# cat www.ext

subjectAltName = @alt_names
[alt_names]
DNS.1 = corpX.un
DNS.2 = www.corpX.un
#DNS.1 = *.corpX.un

lan# openssl ca ... -extfile www.ext

lan# scp www.crt www:

www# rm www.req

www# wget http://lan.corpX.un/ca.crt

www# openssl verify -CAfile ca.crt www.crt

$ openssl x509 -noout -modulus -in www.crt | openssl md5

$ openssl rsa -noout -modulus -in www.key | openssl md5

www# openssl rsa -des3 -in www.clkey -out www.enckey

$ openssl genrsa -out user1.key 2048

$ openssl req -new -key user1.key -out user1.req #-sha256
...
Organizational Unit Name (eg, section) [noc]:group1
Common Name (eg, YOUR name) []:user1
Email Address [noc@corpX.un]:user1@corpX.un
...

ИЛИ

$ openssl req -new -key user1.key -out user1.req -subj '/C=RU/ST=Moscow region/L=Moscow/O=cko/OU=group1/CN=user1/emailAddress=user1@corpX.un/'

lan# openssl ca -days 365 -in user1.req -out user1.crt

lan# cat CA/index.txt

lan# ls CA/newcerts/

!!! Сразу импортировать в хранилище сертификатов на клиенте !!!

$ openssl pkcs12 -export -in user1.crt -inkey user1.key -out user1.p12 -passout pass:ppassword1
openssl3# openssl pkcs12 -legacy -export -in user1.crt -inkey user1.key -out user1.p12 -passout pass:ppassword1

$ openssl pkcs12 -info -in user1.p12

lan# less CA/index.txt

lan# openssl ca -revoke CA/newcerts/02.pem

lan# less CA/index.txt

lan# openssl ca -gencrl -out /var/www/html/ca.crl

lan# openssl crl -text -noout -in /var/www/html/ca.crl | less
...
    Serial Number: 0M
...
    Serial Number: 0N
...