openssl3.2/test/certs - 033 - time stamping certificates

LostSpeed2024-01-25 14:00

文章目录

    • [openssl3.2/test/certs - 033 - time stamping certificates](#openssl3.2/test/certs - 033 - time stamping certificates)
    • 概述
    • 笔记
    • END

openssl3.2/test/certs - 033 - time stamping certificates

概述

openssl3.2 - 官方demo学习 - test - certs

笔记

/*!

  • \file my_openssl_linux_log_doc_033.txt
  • \note openssl3.2/test/certs - 033 - time stamping certificates
  • 带时间戳的证书
  • 自己调用openssl时, 如果也要动态参数文件(不落地), 也可以参照.sh的用法, 自己建立多个参数输入的管道, 拼好配置文件内容, 再将管道名称传给openssl作为参数
  • 只要openssl命令行需要文件的场合, 我们都可以用程序中建立的有名管道传进去.
    */

// --------------------------------------------------------------------------------

// official bash script

// --------------------------------------------------------------------------------

// openssl3.2/test/certs - 033 - time stamping certificates

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,serverAuth -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-serverauth ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-anyextkeyusage ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,cRLSign server.example ee-key ee-timestampsign-CABforum-crlsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,keyCertSign server.example ee-key ee-timestampsign-CABforum-keycertsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping server.example ee-key ee-timestampsign-rfc3161 ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping server.example ee-key ee-timestampsign-rfc3161-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k digitalSignature server.example ee-key ee-timestampsign-rfc3161-digsig ca-key ca-cert

// --------------------------------------------------------------------------------

// openssl cmd line parse

// --------------------------------------------------------------------------------

// --------------------------------------------------------------------------------

// sh1

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

// cfg_exp033_sh1_cmd2.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh1_cmd2.txt -out ee-key-req.pem

// cfg_exp033_sh1_cmd3.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile cfg_exp033_sh1_cmd3.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req.pem

// --------------------------------------------------------------------------------

// sh2

// --------------------------------------------------------------------------------

// cfg_exp033_sh2_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh2_cmd1.txt -out ee-key-req-sh2.pem

// cfg_exp033_sh2_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile cfg_exp033_sh2_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req-sh2.pem

// --------------------------------------------------------------------------------

// sh3

// --------------------------------------------------------------------------------

// cfg_exp033_sh3_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh3_cmd1.txt -out ee-key-sh3-req.pem

// cfg_exp033_sh3_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile cfg_exp033_sh3_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh3-req.pem

// --------------------------------------------------------------------------------

// sh4

// --------------------------------------------------------------------------------

// cfg_exp033_sh4_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh4_cmd1.txt -out ee-key-sh4-cmd1-req.pem

// cfg_exp033_sh4_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile cfg_exp033_sh4_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh4-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh5

// --------------------------------------------------------------------------------

// cfg_exp033_sh5_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh5_cmd1.txt -out ee-key-sh5_cmd1.pem

// cfg_exp033_sh5_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile cfg_exp033_sh5_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh5_cmd1.pem

// --------------------------------------------------------------------------------

// sh6

// --------------------------------------------------------------------------------

// cfg_exp033_sh6_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh6_cmd1.txt -out ee-key-sh6-cmd1-req.pem

// cfg_exp033_sh6_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile cfg_exp033_sh6_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh6-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh7

// --------------------------------------------------------------------------------

// cfg_exp033_sh7_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh7_cmd1.txt -out ee-key-sh7-cmd1-req.pem

// cfg_exp033_sh7_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile cfg_exp033_sh7_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh7-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh8

// --------------------------------------------------------------------------------

// cfg_exp033_sh8_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh8_cmd1.txt -out ee-key-sh8-cmd1-req.pem

// cfg_exp033_sh8_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile cfg_exp033_sh8_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh8-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh9

// --------------------------------------------------------------------------------

// cfg_exp033_sh9_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh9_cmd1.txt -out ee-key-sh9-cmd1-req.pem

// cfg_exp033_sh9_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile cfg_exp033_sh9_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh9-cmd1-req.pem

// --------------------------------------------------------------------------------

// openssl log

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

END

相关推荐
Lsetea3 天前
证书没到期却报certificate has expired：OpenSSL定位中间证书与系统时间
运维·https·ssl证书·openssl·证书链
Lsetea4 天前
Nginx报No required SSL certificate was sent：mTLS客户端证书排查
运维·nginx·https·ssl·openssl
Lsetea5 天前
部署证书后提示“证书名称与输入不匹配”：Safari 报错的三层排查
nginx·https·safari·ssl证书·openssl
Lsetea6 天前
OpenSSL快速生成域名证书：含SAN的自签命令、验证与排错
nginx·https·ssl证书·openssl·自签证书
Lsetea10 天前
CDN换了SSL证书仍显示旧证书？按边缘节点、SNI和缓存逐层排查
https·cdn·ssl证书·openssl·tls
Lsetea11 天前
Nginx HTTPS证书域名不匹配：用SAN与SNI定位 ERR_CERT_COMMON_NAME_INVALID
nginx·https·ssl证书·openssl·tls
bosins15 天前
Windows IIS 配置本地HTTPS 全流程指南：自签名证书 + 端口绑定 + 避坑详解
powershell·openssl
Lsetea19 天前
Nginx报SSL_CTX_use_PrivateKey failed：证书与私钥不匹配怎么排查
nginx·https·ssl证书·openssl·私钥
Lsetea21 天前
SSL证书快过期怎么自动检查：用OpenSSL checkend做7天预警与线上证书验收
https·ssl证书·openssl·systemd·证书监控
蜡台1 个月前
本机 局域网 搭建本地 HTTPS 域名完整方案
网络协议·http·https·openssl
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02Telegram APK 下载安装完整指南 — 2026年最新03GitHub 镜像站点04历年考研数学一、数学二、数学三真题试卷及答案PDF05如何新建文件夹？ 电脑新建文件夹的4种方法06蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接072026年CSP-J初赛分数线-----预测082026 爱知・名古屋亚运会怎么看？直播平台+赛程安排分享09微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新10人工智能（AI）发展史：详细里程碑