openssl3.2/test/certs - 033 - time stamping certificates

LostSpeed2024-01-25 14:00

文章目录

    • [openssl3.2/test/certs - 033 - time stamping certificates](#openssl3.2/test/certs - 033 - time stamping certificates)
    • 概述
    • 笔记
    • END

openssl3.2/test/certs - 033 - time stamping certificates

概述

openssl3.2 - 官方demo学习 - test - certs

笔记

/*!

  • \file my_openssl_linux_log_doc_033.txt
  • \note openssl3.2/test/certs - 033 - time stamping certificates
  • 带时间戳的证书
  • 自己调用openssl时, 如果也要动态参数文件(不落地), 也可以参照.sh的用法, 自己建立多个参数输入的管道, 拼好配置文件内容, 再将管道名称传给openssl作为参数
  • 只要openssl命令行需要文件的场合, 我们都可以用程序中建立的有名管道传进去.
    */

// --------------------------------------------------------------------------------

// official bash script

// --------------------------------------------------------------------------------

// openssl3.2/test/certs - 033 - time stamping certificates

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,serverAuth -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-serverauth ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-anyextkeyusage ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,cRLSign server.example ee-key ee-timestampsign-CABforum-crlsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,keyCertSign server.example ee-key ee-timestampsign-CABforum-keycertsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping server.example ee-key ee-timestampsign-rfc3161 ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping server.example ee-key ee-timestampsign-rfc3161-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k digitalSignature server.example ee-key ee-timestampsign-rfc3161-digsig ca-key ca-cert

// --------------------------------------------------------------------------------

// openssl cmd line parse

// --------------------------------------------------------------------------------

// --------------------------------------------------------------------------------

// sh1

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

// cfg_exp033_sh1_cmd2.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh1_cmd2.txt -out ee-key-req.pem

// cfg_exp033_sh1_cmd3.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile cfg_exp033_sh1_cmd3.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req.pem

// --------------------------------------------------------------------------------

// sh2

// --------------------------------------------------------------------------------

// cfg_exp033_sh2_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh2_cmd1.txt -out ee-key-req-sh2.pem

// cfg_exp033_sh2_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile cfg_exp033_sh2_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req-sh2.pem

// --------------------------------------------------------------------------------

// sh3

// --------------------------------------------------------------------------------

// cfg_exp033_sh3_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh3_cmd1.txt -out ee-key-sh3-req.pem

// cfg_exp033_sh3_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile cfg_exp033_sh3_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh3-req.pem

// --------------------------------------------------------------------------------

// sh4

// --------------------------------------------------------------------------------

// cfg_exp033_sh4_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh4_cmd1.txt -out ee-key-sh4-cmd1-req.pem

// cfg_exp033_sh4_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile cfg_exp033_sh4_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh4-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh5

// --------------------------------------------------------------------------------

// cfg_exp033_sh5_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh5_cmd1.txt -out ee-key-sh5_cmd1.pem

// cfg_exp033_sh5_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile cfg_exp033_sh5_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh5_cmd1.pem

// --------------------------------------------------------------------------------

// sh6

// --------------------------------------------------------------------------------

// cfg_exp033_sh6_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh6_cmd1.txt -out ee-key-sh6-cmd1-req.pem

// cfg_exp033_sh6_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile cfg_exp033_sh6_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh6-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh7

// --------------------------------------------------------------------------------

// cfg_exp033_sh7_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh7_cmd1.txt -out ee-key-sh7-cmd1-req.pem

// cfg_exp033_sh7_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile cfg_exp033_sh7_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh7-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh8

// --------------------------------------------------------------------------------

// cfg_exp033_sh8_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh8_cmd1.txt -out ee-key-sh8-cmd1-req.pem

// cfg_exp033_sh8_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile cfg_exp033_sh8_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh8-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh9

// --------------------------------------------------------------------------------

// cfg_exp033_sh9_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh9_cmd1.txt -out ee-key-sh9-cmd1-req.pem

// cfg_exp033_sh9_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile cfg_exp033_sh9_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh9-cmd1-req.pem

// --------------------------------------------------------------------------------

// openssl log

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

END

相关推荐
什么名字都被用了25 天前
编译openssl源码
c++·openssl
toooooop81 个月前
openssl_error_string() 不要依赖错误信息作为逻辑判断
php·openssl
whoarethenext2 个月前
加密认证库openssl初始附带c/c++的使用源码
c语言·网络·c++·openssl
好记忆不如烂笔头abc2 个月前
centos7.9升级OpenSSL 1.1.1
openssl
宁静致远20212 个月前
openssl交叉编译
openssl·嵌入式linux
漫步企鹅2 个月前
【漏洞修复】Android 10 系统源码中的 glibc、curl、openssl、cups、zlib 更新到最新版本
android·glibc·openssl·curl·zlib·漏洞修复·cups
Winter_Sun灬3 个月前
curl库+openssl库windows编译
c++·windows·openssl·curl
ScilogyHunter3 个月前
使用 OpenSSL 构建安全的网络应用
安全·openssl
dreadp3 个月前
使用 OpenSSL 和 Python 实现 AES-256-CBC 加密与解密（安全密钥管理）
python·安全·网络安全·密码学·openssl
初级代码游戏3 个月前
编写一个基于OpenSSL的SSL/TLS服务端（HTTPS）可运行的完整示例
网络协议·https·ssl·openssl·tls
热门推荐
01【图像处理与机器视觉】XJTU期末考点02从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑03KGG转MP3工具|非KGM文件|解密音频04海康Visionmaster-常见问题排查方法-启动阶段05YOLOv8入门 | 重要性能衡量指标、训练结果评价及分析及影响mAP的因素【发论文关注的指标】06【SpeedAI科研小助手】2分钟极速解决知网维普重复率、AIGC率过高，一键全文降！文件格式不变，公式都保留的！07Coze扣子平台完整体验和实践（附国内和国际版对比）08DeepSeek各版本说明与优缺点分析09VMware虚拟机安装Win7专业版保姆级教程（附镜像包）10R-tree详解