openssl3.2/test/certs - 033 - time stamping certificates

LostSpeed2024-01-25 14:00

文章目录

    • [openssl3.2/test/certs - 033 - time stamping certificates](#openssl3.2/test/certs - 033 - time stamping certificates)
    • 概述
    • 笔记
    • END

openssl3.2/test/certs - 033 - time stamping certificates

概述

openssl3.2 - 官方demo学习 - test - certs

笔记

/*!

  • \file my_openssl_linux_log_doc_033.txt
  • \note openssl3.2/test/certs - 033 - time stamping certificates
  • 带时间戳的证书
  • 自己调用openssl时, 如果也要动态参数文件(不落地), 也可以参照.sh的用法, 自己建立多个参数输入的管道, 拼好配置文件内容, 再将管道名称传给openssl作为参数
  • 只要openssl命令行需要文件的场合, 我们都可以用程序中建立的有名管道传进去.
    */

// --------------------------------------------------------------------------------

// official bash script

// --------------------------------------------------------------------------------

// openssl3.2/test/certs - 033 - time stamping certificates

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,serverAuth -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-serverauth ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-anyextkeyusage ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,cRLSign server.example ee-key ee-timestampsign-CABforum-crlsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,keyCertSign server.example ee-key ee-timestampsign-CABforum-keycertsign ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping server.example ee-key ee-timestampsign-rfc3161 ca-key ca-cert

openssl -v

./mkcert.sh genee -p timeStamping server.example ee-key ee-timestampsign-rfc3161-noncritxku ca-key ca-cert

openssl -v

./mkcert.sh genee -p critical,timeStamping -k digitalSignature server.example ee-key ee-timestampsign-rfc3161-digsig ca-key ca-cert

// --------------------------------------------------------------------------------

// openssl cmd line parse

// --------------------------------------------------------------------------------

// --------------------------------------------------------------------------------

// sh1

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

// cfg_exp033_sh1_cmd2.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh1_cmd2.txt -out ee-key-req.pem

// cfg_exp033_sh1_cmd3.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile cfg_exp033_sh1_cmd3.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req.pem

// --------------------------------------------------------------------------------

// sh2

// --------------------------------------------------------------------------------

// cfg_exp033_sh2_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh2_cmd1.txt -out ee-key-req-sh2.pem

// cfg_exp033_sh2_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile cfg_exp033_sh2_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req-sh2.pem

// --------------------------------------------------------------------------------

// sh3

// --------------------------------------------------------------------------------

// cfg_exp033_sh3_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh3_cmd1.txt -out ee-key-sh3-req.pem

// cfg_exp033_sh3_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile cfg_exp033_sh3_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh3-req.pem

// --------------------------------------------------------------------------------

// sh4

// --------------------------------------------------------------------------------

// cfg_exp033_sh4_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh4_cmd1.txt -out ee-key-sh4-cmd1-req.pem

// cfg_exp033_sh4_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile cfg_exp033_sh4_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh4-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh5

// --------------------------------------------------------------------------------

// cfg_exp033_sh5_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh5_cmd1.txt -out ee-key-sh5_cmd1.pem

// cfg_exp033_sh5_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile cfg_exp033_sh5_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh5_cmd1.pem

// --------------------------------------------------------------------------------

// sh6

// --------------------------------------------------------------------------------

// cfg_exp033_sh6_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh6_cmd1.txt -out ee-key-sh6-cmd1-req.pem

// cfg_exp033_sh6_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile cfg_exp033_sh6_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh6-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh7

// --------------------------------------------------------------------------------

// cfg_exp033_sh7_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh7_cmd1.txt -out ee-key-sh7-cmd1-req.pem

// cfg_exp033_sh7_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile cfg_exp033_sh7_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh7-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh8

// --------------------------------------------------------------------------------

// cfg_exp033_sh8_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh8_cmd1.txt -out ee-key-sh8-cmd1-req.pem

// cfg_exp033_sh8_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile cfg_exp033_sh8_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh8-cmd1-req.pem

// --------------------------------------------------------------------------------

// sh9

// --------------------------------------------------------------------------------

// cfg_exp033_sh9_cmd1.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh9_cmd1.txt -out ee-key-sh9-cmd1-req.pem

// cfg_exp033_sh9_cmd2.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile cfg_exp033_sh9_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh9-cmd1-req.pem

// --------------------------------------------------------------------------------

// openssl log

// --------------------------------------------------------------------------------

openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,serverAuth

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature

extendedKeyUsage = critical,timeStamping,2.5.29.37.0

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,cRLSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = critical,digitalSignature,keyCertSign

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

extendedKeyUsage = timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

openssl -v

openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63

-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

string_mask=utf8only

req

prompt = no

distinguished_name = dn

dn

CN = server.example

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile /dev/fd/63 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525

-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid, issuer

basicConstraints = CA:false

keyUsage = digitalSignature

extendedKeyUsage = critical,timeStamping

alts

subjectAltName = @alts

DNS=server.example

alts

END

相关推荐
Lsetea5 天前
OpenSSL的checkhost显示不匹配却退出0：名称检查与证书验收
linux·https·shell·ssl证书·openssl
Lsetea6 天前
OpenSSL的showcerts没有根证书正常吗：服务端发链与show_chain构链排查
https·ssl证书·openssl·tls·证书链
Lsetea8 天前
SSL证书指纹相同但文件哈希不同：PEM、DER与公钥摘要怎么比
运维·https·ssl证书·openssl·证书链
Lsetea8 天前
OpenSSL指定-cipher仍协商TLS1.3：证书排查中的套件与协议边界
运维·https·ssl证书·openssl·tls
Lsetea10 天前
curl设置SSL_CERT_FILE仍报60：CURL_CA_BUNDLE与CA路径优先级排查
linux·https·ssl证书·openssl·curl
Lsetea11 天前
OpenSSL报certificate rejected：error 28与CA辅助信任属性排查
linux·https·ssl证书·openssl·证书链
Lsetea12 天前
OpenSSL报certificate revoked：error 23与CRL吊销层级排查
linux·https·ssl证书·openssl·crl
Lsetea13 天前
OpenSSL报certificate chain too long：error 22与verify_depth深度排查
linux·https·ssl证书·openssl·证书链
Lsetea14 天前
OpenSSL读取加密私钥报bad decrypt：passin与口令来源排查
linux·https·ssl证书·openssl·私钥
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02如何新建文件夹？ 电脑新建文件夹的4种方法03历年考研数学一、数学二、数学三真题试卷及答案PDF04GitHub 镜像站点05几个好用的ip纯净度检测网站06苹果iPA游戏软件资源下载网站07昇腾910B系列芯片完全指南：四款型号对比、服务器选型与大模型部署实战08ai安全工具:CyberStrikeAI安装部署与使用09蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接10Windows 10/11 如何退出微软账户并改用本地账户登录（含找不到选项的解决方法）