文章目录
-
- [openssl3.2/test/certs - 074 - CT entry](#openssl3.2/test/certs - 074 - CT entry)
- 概述
- 笔记
- setup074.sh
- setup074_sc1.sh
- setup074_sc2.sh
- setup074_sc3.sh
- END
openssl3.2/test/certs - 074 - CT entry
概述
openssl3.2 - 官方demo学习 - test - certs
笔记
setup074.sh
bash
#! /bin/bash
# \file setup074.sh
# openssl3.2/test/certs - 074 - CT entry
# sc1
openssl -v
./mkcert.sh genct server.example embeddedSCTs1-key embeddedSCTs1 embeddedSCTs1_issuer-key embeddedSCTs1_issuer ct-server-key
# sc2
openssl -v
OPENSSL_SIGALG= OPENSSL_KEYALG=ed448 ./mkcert.sh genroot "Root Ed448" root-ed448-key root-ed448-cert
# sc3
openssl -v
OPENSSL_SIGALG=ED448 OPENSSL_KEYALG=ed448 ./mkcert.sh genee ed448 server-ed448-key server-ed448-cert root-ed448-key root-ed448-cert
官方脚本报错, 分为3个小脚本做实验
setup074_sc1.sh
bash
/*!
* \file D:\my_dev\my_local_git_prj\study\openSSL\test_certs\074\my_openssl_linux_doc_074_sc1.txt
* \note
*/
// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
#! /bin/bash
# \file setup074.sh
# openssl3.2/test/certs - 074 - CT entry
# sc1
openssl -v
./mkcert.sh genct server.example embeddedSCTs1-key embeddedSCTs1 embeddedSCTs1_issuer-key embeddedSCTs1_issuer ct-server-key
// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------
// cmd 1
// cfg_exp074_sc1_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example
openssl req -new -sha256 -key embeddedSCTs1-key.pem -config cfg_exp074_sc1_cmd1.txt -out req_exp074_sc1_cmd1.pem
// cmd 2
// cfg_exp074_sc1_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.3 = critical,ASN1:NULL
subjectAltName = @alts
[alts]
DNS=server.example
// ok
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile cfg_exp074_sc1_cmd2.txt -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525 -in req_exp074_sc1_cmd1.pem
// cmd 3
// cfg_exp074_sc1_cmd3.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.2 = ASN1:FORMAT:HEX,OCT:00780076subjectAltName = @alts
DNS=server.example
[alts]
// err
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile cfg_exp074_sc1_cmd3.txt -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525 -in req_exp074_sc1_cmd1.pem
报错如下:
Error checking extension section default
88140400:error:07800066:common libcrypto routines:hexstr2buf_sep:illegal hex digit:crypto\o_str.c:158:
88140400:error:068000B2:asn1 encoding routines:asn1_str2type:illegal hex:crypto\asn1\asn1_gen.c:696:string=00780076subjectAltName = @alts
88140400:error:11000074:X509 V3 routines:v3_generic_extension:extension value error:crypto\x509\v3_conf.c:260:value=FORMAT:HEX,OCT:00780076subjectAltName = @alts
原因 [alts]节中是空的, 没写内容
// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------
openssl -v
openssl req -new -sha256 -key embeddedSCTs1-key.pem -config /dev/fd/63
-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile /dev/fd/63 -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525
-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.3 = critical,ASN1:NULL
subjectAltName = @alts
[alts]
DNS=server.example
openssl x509 -req -sha256 -out embeddedSCTs1.pem -extfile /dev/fd/63 -CA embeddedSCTs1_issuer.pem -CAkey embeddedSCTs1_issuer-key.pem -set_serial 2 -days 36525
-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
extendedKeyUsage = serverAuth
1.3.6.1.4.1.11129.2.4.2 = ASN1:FORMAT:HEX,OCT:00780076subjectAltName = @alts
DNS=server.example
[alts]
setup074_sc2.sh
bash
/*!
* \file D:\my_dev\my_local_git_prj\study\openSSL\test_certs\074\my_openssl_linux_doc_074_sc2.txt
* \note
*/
// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
#! /bin/bash
# \file setup074.sh
# openssl3.2/test/certs - 074 - CT entry
# sc2
openssl -v
OPENSSL_SIGALG= OPENSSL_KEYALG=ed448 ./mkcert.sh genroot "Root Ed448" root-ed448-key root-ed448-cert
// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------
// cmd 1
openssl genpkey -algorithm ed448 -out root-ed448-key.pem
// cmd 2
// cfg_exp074_sc2_cmd2.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Root Ed448
openssl req -new -sha256 -key root-ed448-key.pem -config cfg_exp074_sc2_cmd2.txt -out req_exp074_sc2_cmd2.pem
// cmd 3
// cfg_exp074_sc2_cmd3.txt
basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
openssl x509 -req -sha256 -out root-ed448-cert.pem -extfile cfg_exp074_sc2_cmd3.txt -signkey root-ed448-key.pem -set_serial 1 -days 36525 -in req_exp074_sc2_cmd2.pem
// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------
openssl genpkey -algorithm ed448 -out root-ed448-key.pem
openssl req -new -sha256 -key root-ed448-key.pem -config /dev/fd/63
-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = Root Ed448
openssl x509 -req -sha256 -out root-ed448-cert.pem -extfile /dev/fd/63 -signkey root-ed448-key.pem -set_serial 1 -days 36525
-extfile /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt
basicConstraints = critical,CA:true
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
setup074_sc3.sh
bash
/*!
* \file D:\my_dev\my_local_git_prj\study\openSSL\test_certs\074\my_openssl_linux_doc_074_sc3.txt
* \note
*/
// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
#! /bin/bash
# \file setup074.sh
# openssl3.2/test/certs - 074 - CT entry
# sc3
openssl -v
OPENSSL_SIGALG=ED448 OPENSSL_KEYALG=ed448 ./mkcert.sh genee ed448 server-ed448-key server-ed448-cert root-ed448-key root-ed448-cert
// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------
// cmd 1
openssl genpkey -algorithm ed448 -out server-ed448-key.pem
// cmd 2
// cfg_exp074_sc3_cmd2.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = ed448
// 这里只生成了一个证书请求, 这是干啥?
openssl req -new -ED448 -key server-ed448-key.pem -config cfg_exp074_sc3_cmd2.txt
// 报错 : req: Unknown option or message digest: ED448
// 官方脚本单独运行, 是看不到任何报错信息的.
// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------
openssl genpkey -algorithm ed448 -out server-ed448-key.pem
openssl req -new -ED448 -key server-ed448-key.pem -config /dev/fd/63
-config /dev/fd/63 => /home/lostspeed/openssl/openssl-3.2.0_debian/test/certs/my_openssl_linux_log.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = ed448