创建 SSL证书并应用于WebSocket

写在前面

由于上一篇介绍 如何使用Fleck创建WebSocket服务器 ,感觉不够完善,因为生产环境中肯定是需要用到ssl的,而创建或申请ssl证书,相对而言是比较繁琐的事情,特别是本地如果要构建一个使用ssl的测试环境时,就难免要多费一番周折了。

本文介绍了如何创建一个 ssl 证书,用于test.com在本地环境中测试带安全验证的 WebSocket。

1.首先下载并安装 Win64 OpenSSL

建议把安装目录指定为 C:\OpenSSL-Win64\

2.然后创建openssl.cnf 并保存到如下目录:C:\OpenSSL-Win64\

内容如下:

bash 复制代码
[ req ]
default_bits        = 2048
default_keyfile     = server-key.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = US

stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = NY

localityName            = Locality Name (eg, city)
localityName_default        = New York

organizationName         = Organization Name (eg, company)
organizationName_default    = Example, LLC

# Use a friendly name here because its presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you 
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = Example Company

emailAddress            = Email Address
emailAddress_default        = test@test.com

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier        = hash
authorityKeyIdentifier  = keyid,issuer

# You only need digitalSignature below. *If* you don't allow
#   RSA Key transport (i.e., you use ephemeral cipher suites), then
#   omit keyEncipherment because that's key transport.
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
#   In either case, you probably only need serverAuth.
# extendedKeyUsage  = serverAuth, clientAuth

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier        = hash

basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
#   In either case, you probably only need serverAuth.
# extendedKeyUsage  = serverAuth, clientAuth

[ alternate_names ]

DNS.1       = test.com
DNS.2       = www.test.com
DNS.3       = mail.test.com
DNS.4       = ftp.test.com

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.5       = localhost
# DNS.6       = localhost.localdomain
# DNS.7       = 127.0.0.1

# IPv6 localhost
# DNS.8     = ::1

详细步骤

打开命令提示符窗口:

1.执行 cd "c:\OpenSSL-Win64\bin"

2.执行 set OPENSSL_CONF=c:\OpenSSL-Win64\openssl.cnf

3.执行 openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout test.key -out test.crt -subj "/CN=test.com" -days 3650

如下图所示:

将C:\OpenSSL-Win64\bin目录下 test.crt 导入证书存储:

  1. 打开certlm.msc
  2. 转至受信任的根证书颁发机构 > 证书
  3. 右键单击某处,选择"所有任务">"导入"
  4. 浏览刚刚创建的文件test.crt(位于 C:\OpenSSL-Win32\bin 中)
  5. 选择将所有证书放入以下存储中:受信任的根证书颁发机构
  6. 单击"完成"

从证书列表中导出此证书:

  1. 刷新受信任的根证书颁发机构 > 证书,找到并右键单击 test.com 证书
  2. 选择所有任务 > 导出
  3. 导出为test.p7b并保存在C:\OpenSSL-Win64\bin\
  4. 删除test.com证书存储中当前的证书

接着执行:openssl pkcs7 -in test.p7b -inform DER -out result.pem -print_certs

在执行:openssl pkcs12 -export -inkey test.key -in result.pem -name test.com -out final_result.pfx

过程中需要输入密码,后面要用到不要忘掉,建议保存一下。

将"final_result.pfx"导入证书存储区:

  1. 双击生成的final_result.pfx文件运行安装程序
  2. 选择本地机器
  3. 输入密码
  4. 选择将此密钥标记为可导出
  5. 选择包括所有扩展属性
  6. 选择将所有证书放入以下存储中:受信任的根证书颁发机构
  7. 单击"完成"

再次重复上述导入步骤 1 到 7,但这次在步骤 6 中,将证书放置在"Web宿主"证书存储中(以便 IIS 在绑定到 https 时可以看到该证书

从存储中导出此证书(以在套接字服务器应用程序中使用):

  1. 刷新受信任的根证书颁发机构 > 证书,找到并右键单击该test.com证书
  2. 选择所有任务 > 导出
  3. 选择yes,导出私钥
  4. 选择个人信息交换
  5. 如果可能,选择包括所有证书
  6. 选择导出所有扩展属性
  7. 选择启用证书隐私
  8. 添加密码
  9. 添加文件名test.com.pfx将其保存到 C:\ 或"套接字服务器应用程序"将引用它的位置,请参见下文
    X509Certificate2 certificate = new X509Certificate2("C:\\test.com.pfx", "password");

test.com与本地电脑 IP 一起添加到主机文件中,C:\Windows\System32\drivers\etc\hosts

创建 IIS 网站并为 http 和 https 添加到 test.com 的绑定(并在 https 绑定中选择 test.com 证书)

​访问 https://test.com/your-socket-client.htm (在 Chrome/Edge 中,当提示 ssl 警告时单击高级 > 继续)

套接字客户端现在应该使用 wss 成功连接wss://test.com:xxxx

注意事项

如果是用 Chrome 进行测试,则可能需要使用 TLS 1.2。因为Chrome貌似加强了可以使用的安全协议。另外要在套接字服务器上使用 TLS 1.2,请设置:

server.EnabledSslProtocols = SslProtocols.Tls12;

或更多选项,比如:

server.EnabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Ssl3 | SslProtocols.Tls11 | SslProtocols.Tls;

在套接字服务器上,尝试监听 0.0.0.0
var server = new WebSocketServer("wss://0.0.0.0:7181");

在客户端,如果使用wss,则需要使用ssl证书注册的域的url,而不是ip地址:
window.ws = new wsImpl('wss://test.com:7181/');

代码实现

控制台代码

cs 复制代码
using Fleck;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
public class WebSocketServerDemo
{
    public static void Main(string[] args)
    {
        X509Certificate2 certificate = new X509Certificate2("C:\\test.com.pfx", "test");
        var server = new WebSocketServer("wss://0.0.0.0:7181");
        if (certificate != null)
        {
            server.Certificate = certificate;
            server.EnabledSslProtocols = SslProtocols.Ssl3 | SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
            //server.EnabledSslProtocols = SslProtocols.Tls12;
        }
        server.Start(socket =>
        {
            socket.OnOpen = () => Console.WriteLine("Open!");
            socket.OnClose = () => Console.WriteLine("Close!");
            socket.OnMessage = message =>
            {
                Console.WriteLine(message);
                socket.Send(message + " from server");
            };
        });
        Console.WriteLine("Server Started");

        Console.ReadLine();
    }
}

客户端代码

html 复制代码
<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title>WebSocket Demo</title>
    <script type="text/javascript">
        var start = function () {
            var inc = document.getElementById('incomming');
            var wsImpl = window.WebSocket || window.MozWebSocket;
            var form = document.getElementById('sendForm');
            var input = document.getElementById('sendText');

            inc.innerHTML += "connecting to server ...<br/>";

            // 创建新的websocket新连接端口为7181
            window.ws = new wsImpl('wss://test.com:7181/');

            // 当数据从服务器服务中心发送后,继续向下运行过程
            ws.onmessage = function (evt) {
                inc.innerHTML += evt.data + '<br/>';
            };

            // 当链接对象找到服务端成功对接后,提示正常打开
            ws.onopen = function () {
                inc.innerHTML += 'connection opened<br/>';
            };

            // 当链接对象未找找到服务端成功对接后,提示打开失败,别切单项关闭
            ws.onclose = function () {
                inc.innerHTML += 'connection closed<br/>';
            }

            form.addEventListener('submit', function (e) {
                e.preventDefault();
                var val = input.value;
                ws.send(val);
                input.value = "";
            });
        }
        window.onload = start;
    </script>
</head>
<body>
    <form id="sendForm">
        <input id="sendText" placeholder="Text to send" />
    </form>
    <pre id="incomming"></pre>
</body>
</html>

调用示例

IIS 站点配置

相关推荐
听风吹等浪起4 分钟前
改进系列(3):基于ResNet网络与CBAM模块融合实现的生活垃圾分类
网络·深度学习·神经网络·分类·生活
速盾cdn40 分钟前
速盾:vue的cdn是干嘛的?
服务器·前端·网络
叫我龙翔1 小时前
【计网】实现reactor反应堆模型 --- 框架搭建
linux·运维·网络
不爱学习的YY酱2 小时前
【计网不挂科】计算机网络期末考试——【选择题&填空题&判断题&简述题】试卷(4)
网络·计算机网络
装睡的小5郎2 小时前
家庭宽带如何开启公网ipv4和ipv6
网络
yfs10242 小时前
压缩Minio桶中的文件为ZIP,并通过 HTTP 响应输出
网络·网络协议·http
有谁看见我的剑了?2 小时前
Ubuntu 22.04.5 配置vlan子接口和网桥
服务器·网络·ubuntu
hgdlip2 小时前
有什么办法换网络ip动态
网络·tcp/ip·智能路由器
超栈2 小时前
HCIP(11)-期中综合实验(BGP、Peer、OSPF、VLAN、IP、Route-Policy)
运维·网络·网络协议·计算机网络·web安全·网络安全·信息与通信
დ旧言~2 小时前
【网络】应用层——HTTP协议
开发语言·网络·网络协议·http·php