openssl3.2/test/certs - 033 - time stamping certificates

LostSpeed2024-01-25 14:00

文章目录

    • [openssl3.2/test/certs - 033 - time stamping certificates](#openssl3.2/test/certs - 033 - time stamping certificates)
    • 概述
    • 笔记
    • END

openssl3.2/test/certs - 033 - time stamping certificates

概述

openssl3.2 - 官方demo学习 - test - certs

笔记

/*!

  • \file my_openssl_linux_log_doc_033.txt
  • \note openssl3.2/test/certs - 033 - time stamping certificates
  • 带时间戳的证书
  • 自己调用openssl时, 如果也要动态参数文件(不落地), 也可以参照.sh的用法, 自己建立多个参数输入的管道, 拼好配置文件内容, 再将管道名称传给openssl作为参数
  • 只要openssl命令行需要文件的场合, 我们都可以用程序中建立的有名管道传进去.
    */

// --------------------------------------------------------------------------------

// official bash script

// --------------------------------------------------------------------------------

// openssl3.2/test/certs - 033 - time stamping certificates

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,serverAuth -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-serverauth ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-anyextkeyusage ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,cRLSign server.example ee-key ee-timestampsign-CABforum-crlsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,keyCertSign server.example ee-key ee-timestampsign-CABforum-keycertsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping server.example ee-key ee-timestampsign-rfc3161 ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping server.example ee-key ee-timestampsign-rfc3161-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k digitalSignature server.example ee-key ee-timestampsign-rfc3161-digsig ca-key ca-cert

// --------------------------------------------------------------------------------

// openssl cmd line parse

// --------------------------------------------------------------------------------

// --------------------------------------------------------------------------------

// sh1

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

// cfg_exp033_sh1_cmd2.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh1_cmd2.txt -out ee-key-req.pem

// cfg_exp033_sh1_cmd3.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile cfg_exp033_sh1_cmd3.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req.pem

// --------------------------------------------------------------------------------

// sh2

// --------------------------------------------------------------------------------

// cfg_exp033_sh2_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh2_cmd1.txt -out ee-key-req-sh2.pem

// cfg_exp033_sh2_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile cfg_exp033_sh2_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req-sh2.pem

// --------------------------------------------------------------------------------

// sh3

// --------------------------------------------------------------------------------

// cfg_exp033_sh3_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh3_cmd1.txt -out ee-key-sh3-req.pem

// cfg_exp033_sh3_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile cfg_exp033_sh3_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh3-req.pem

// --------------------------------------------------------------------------------

// sh4

// --------------------------------------------------------------------------------

// cfg_exp033_sh4_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh4_cmd1.txt -out ee-key-sh4-cmd1-req.pem

// cfg_exp033_sh4_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile cfg_exp033_sh4_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh4-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh5

// --------------------------------------------------------------------------------

// cfg_exp033_sh5_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh5_cmd1.txt -out ee-key-sh5_cmd1.pem

// cfg_exp033_sh5_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile cfg_exp033_sh5_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh5_cmd1.pem

// --------------------------------------------------------------------------------

// sh6

// --------------------------------------------------------------------------------

// cfg_exp033_sh6_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh6_cmd1.txt -out ee-key-sh6-cmd1-req.pem

// cfg_exp033_sh6_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile cfg_exp033_sh6_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh6-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh7

// --------------------------------------------------------------------------------

// cfg_exp033_sh7_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh7_cmd1.txt -out ee-key-sh7-cmd1-req.pem

// cfg_exp033_sh7_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile cfg_exp033_sh7_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh7-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh8

// --------------------------------------------------------------------------------

// cfg_exp033_sh8_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh8_cmd1.txt -out ee-key-sh8-cmd1-req.pem

// cfg_exp033_sh8_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile cfg_exp033_sh8_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh8-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh9

// --------------------------------------------------------------------------------

// cfg_exp033_sh9_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh9_cmd1.txt -out ee-key-sh9-cmd1-req.pem

// cfg_exp033_sh9_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile cfg_exp033_sh9_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh9-cmd1-req.pem

// --------------------------------------------------------------------------------

// openssl log

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

END

相关推荐
fangeqin2 天前
ubuntu源码安装python3.13遇到Could not build the ssl module!解决方法
linux·python·ubuntu·openssl
API开发13 天前
苹果芯片macOS安装版Homebrew(亲测) ，一键安装node、python、vscode等，比绿色软件还干净、无污染
vscode·python·docker·nodejs·openssl·brew·homebrew
码农不惑16 天前
Rust使用tokio（二）HTTPS相关
https·rust·web·openssl
liulilittle22 天前
通过高级处理器硬件指令集AES-NI实现AES-256-CFB算法并通过OPENSSL加密验证算法正确性。
linux·服务器·c++·算法·安全·加密·openssl
liulilittle24 天前
OpenSSL 的 AES-NI 支持机制
linux·运维·服务器·算法·加密·openssl·解密
liulilittle24 天前
通过高级处理器硬件指令集AES-NI实现AES-256-CFB算法。
linux·服务器·c++·算法·安全·加密·openssl
花花少年25 天前
Ubuntu系统下交叉编译openssl
openssl·交叉编译
什么名字都被用了2 个月前
编译openssl源码
c++·openssl
toooooop82 个月前
openssl_error_string() 不要依赖错误信息作为逻辑判断
php·openssl
whoarethenext2 个月前
加密认证库openssl初始附带c/c++的使用源码
c语言·网络·c++·openssl
热门推荐
01集群聊天服务器---MySQL数据库的建立02GPU 进阶笔记（二）：华为昇腾 910B GPU03Coze扣子平台完整体验和实践（附国内和国际版对比）04使用Ruby接入实时行情API教程05Word粘贴时出现“运行时错误53,文件未找到：MathPage.WLL“的解决方案06扣子（coze）实战|我用扣子搭建了一个自动分析小红薯笔记内容的AI应用|详细步骤拆解07Java学习第十五部分——MyBatis08扣子空间的使用教程与大模型技术思考09DeepSeek各版本说明与优缺点分析10基于odoo17的设计模式详解---装饰模式