主页 / server / 问题 / 1010312
Accepted
user1169420
Asked: 2020-04-01 12:10:55 +0800 CST

如何正确生成使用受限的 x509 证书

  • 772

我将证书放入存储库中，该存储库不允许使用比前一个更有限的连续证书。我需要一个初始的虚拟证书/密钥/链来引导使用不比允许 serverAuth 和 clientAuth 的 Let's Encrypt 主机证书更开放的进程。我所需要的只是一个具有这些用途或更少用途的虚拟主机证书。但是，在昨天和今天阅读了许多文章和 SO 帖子之后，由于命令的多次迭代，我一直无法生成这个。

这是我正在使用的内容：

生成器

#!/bin/bash -e

rm dummy*

days=100

openssl genrsa -out dummy-root.key 2048

openssl req -new -x509 -days $days -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-root.com' -key dummy-root.key -out dummy-root.crt

openssl genrsa -out dummy-class2.key 2048

openssl req -new -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-class2.com' -key dummy-class2.key -out dummy-class2.csr 

openssl x509 -req -days $days -in dummy-class2.csr -CA dummy-root.crt -CAkey dummy-root.key -CAcreateserial -out dummy-class2.crt

openssl genrsa -out dummy-host.key 2048

openssl req -new -config gen.host.cfg -key dummy-host.key -out dummy-host.csr -extensions my_server_exts

openssl x509 -req -days $days -in dummy-host.csr -CA dummy-class2.crt -CAkey dummy-class2.key -set_serial 1 -out dummy-host.crt -sha256  -ext subjAltName

rm *.srl *.csr
cat dummy-host.crt dummy-class2.crt dummy-root.crt > dummy-chain.crt

# this always fails?
# openssl verify --CAfile dummy-root.crt -untrusted dummy-class2.crt dummy-host.crt

openssl x509 -noout -ext extendedKeyUsage < dummy-host.crt

对于扩展所需的配置文件（参考上文）：

生成主机.cfg

[ req ]
prompt             = no
default_bits       = 2048
default_md         = sha256
distinguished_name = my_dn
req_extensions     = my_server_exts


[ my_dn ]
# The bare minimum is probably a commonName
            commonName = dummy-host2.com
           countryName = US
      organizationName = foo
organizationalUnitName = bar

[ my_server_exts ]
basicConstraints = critical,CA:false
keyUsage = keyEncipherment
# extendedKeyUsage = serverAuth
extendedKeyUsage = 1.3.6.1.5.5.7.3.1

gen.sh 的最后一行尝试读取扩展名并总是说“证书中没有扩展名”，当发送到证书存储库时会解释为具有“任何”使用情况，然后在使用 Lets Encrypt 更新时拒绝减少使用情况证书。

为什么我指定的 EKU 没有通过证书？或者我还能如何创建使用受限的证书？

certificate pki openssl x509

1 个回答

  1. Best Answer

    添加到证书的唯一扩展是根 CA 的扩展，因为您使用默认配置文件。在x509命令调用中，您不提供-extfileand-extensions命令行选项。

    要对添加的扩展进行更多控制，您可能应该在配置文件中明确列出每个证书的keyUsage扩展，添加 CA 证书的扩展subjectKeyIdentifier以及authorityKeyIdentifier所有这些扩展：

    [ req ]
default_bits       = 2048
default_md         = sha256
distinguished_name = dn

[ dn ]
# -subj used instead

[ root_exts ]
basicConstraints = critical,CA:true
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
keyUsage = keyCertSign, cRLSign

[ intermediate_exts ]
# Can not sign other CA certificates
basicConstraints = critical,CA:true,pathlen:0
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
keyUsage = keyCertSign, cRLSign

[ server_exts ]
basicConstraints = critical,CA:false
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
keyUsage = keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:dummy-host.com

    -extfile并使用or-config选项调用所有证书生成命令，以适当者为准：

    #!/bin/bash
set -e
days=100

openssl genrsa -out dummy-root.key 2048
openssl req -x509 -key dummy-root.key -out dummy-root.crt -days $days \
  -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-root.com' \
  -config gen.host.cfg -extensions root_exts

openssl genrsa -out dummy-class2.key 2048
openssl req -new -key dummy-class2.key -out dummy-class2.csr \
  -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-class2.com' 
openssl x509 -req -in dummy-class2.csr -out dummy-class2.crt -days $days \
  -CAkey dummy-root.key -CA dummy-root.crt -CAcreateserial \
  -extfile gen.host.cfg -extensions intermediate_exts

openssl genrsa -out dummy-host.key 2048
openssl req -new -key dummy-host.key -out dummy-host.csr \
  -subj '/C=US/ST=TX/O=foo/OU=bar/CN=dummy-host.com' 
openssl x509 -req -in dummy-host.csr -out dummy-host.crt -days $days \
  -CAkey dummy-class2.key -CA dummy-class2.crt -CAcreateserial \
  -extfile gen.host.cfg -extensions server_exts

rm *.csr
cat dummy-{host,class2,root}.crt > dummy-chain.crt

openssl verify -CAfile dummy-root.crt -untrusted dummy-class2.crt dummy-host.crt
openssl x509 -noout -ext extendedKeyUsage -in dummy-host.crt
    • 2

相关问题