一文搞定SSL证书的所有创建问题

certinfo baidu.com:443

--- [baidu.com:443 TLS 1.2] ---
Version: 3
Serial Number: 11567442207000512002371158812715313681
Signature Algorithm: SHA256-RSA
Type: end-entity
Issuer: CN=DigiCert Secure Site Pro CN CA G3,O=DigiCert Inc,C=US
Validity
    Not Before: Feb 11 00:00:00 2022 UTC
    Not After : Feb 25 23:59:59 2023 UTC
Subject: CN=www.baidu.cn,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,ST=Beijing,C=CN
DNS Names: www.baidu.cn, baidu.cn, baidu.com, baidu.com.cn, w.baidu.com, ww.baidu.com, www.baidu.com.cn, www.baidu.com.hk, www.baidu.hk, www.baidu.net.au, www.baidu.net.ph, www.baidu.net.tw, www.baidu.net.vn, wwww.baidu.com, wwww.baidu.com.cn
IP Addresses:
Key Usage: Digital Signature, Key Encipherment
Ext Key Usage: Server Auth, Client Auth
CA: false

Version: 3
Serial Number: 6807354621841521274861062396893733477
Signature Algorithm: SHA256-RSA
Type: intermediate
Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Validity
    Not Before: Mar 13 12:00:48 2020 UTC
    Not After : Mar 13 12:00:48 2030 UTC
Subject: CN=DigiCert Secure Site Pro CN CA G3,O=DigiCert Inc,C=US
DNS Names:
IP Addresses:
Key Usage: Digital Signature, Cert Sign, CRL Sign
Ext Key Usage: Server Auth, Client Auth
CA: true

--- 1 verified chains ---

mkcert example.com

example.com-key.pem  example.com.pem

--- [example.com.pem] ---
Version: 3
Serial Number: 167868079130384122688578569988391501606
Signature Algorithm: SHA256-RSA
Type: end-entity
Issuer: CN=mkcert,OU=你的电脑信息,O=mkcert development CA
Validity
    Not Before: Dec  3 04:10:22 2022 UTC
    Not After : Mar  3 04:10:22 2025 UTC
Subject: OU=你的电脑信息,O=mkcert development certificate
DNS Names: example.com
IP Addresses:
Key Usage: Digital Signature, Key Encipherment
Ext Key Usage: Server Auth
CA: false

# 创建ca证书的私钥
openssl genrsa -out ca.key 3072

# 创建ca证书的自签名请求
openssl req -new -key ca.key -out ca.csr

# 基于自签名请求创建ca证书
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt

# 创建证书本身的私钥
openssl genrsa -out server.key 3072

# 创建证书的签名需求
openssl req -new -out server1.csr -key server.key

[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
req_extensions = req_ext

[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = cn
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = gd
localityName                = Locality Name (eg, city)
localityName_default        = sz
organizationName            = Organization Name (eg, company)
organizationName_default    = self
organizationalUnitName            = Organizational Unit Name (eg, section)
organizationalUnitName_default    = as
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = example.com

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.31.11
DNS.1 = example.com
DNS.2 = *.example.com

openssl req -new  -out server2.csr -key server.key -config ssl.conf

# 基于csr创建证书
openssl x509 -req -days 365 -in server1.csr -signkey ca.key -out server1.crt

# 通过额外指定配置文件创建
openssl x509 -req -days 365 -in server2.csr -signkey ca.key -out server2.crt --extensions req_ext -extfile ssl.conf

CLOUDFLARE_EMAIL="[email protected]" \
CLOUDFLARE_API_KEY="yourprivatecloudflareapikey" \
lego --email "[email protected]" --dns cloudflare --domains "example.org" run

CLOUDFLARE_EMAIL="[email protected]" \
CLOUDFLARE_API_KEY="yourprivatecloudflareapikey" \
lego --email="[email protected]" --dns cloudflare --csr="/path/to/csr.pem" run

package main

import (
	"crypto"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/pem"
	"flag"
	"io/ioutil"
	"log"
)

var ecc bool
var out string

func generateKey() (crypto.PrivateKey, error) {
	if ecc {
		return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	}
	return rsa.GenerateKey(rand.Reader, 2048)
}

func main() {
	flag.BoolVar(&ecc, "ecdsa", false, "创建ecdsa算法创建密钥")
	flag.StringVar(&out, "out", "server.key", "密钥输出路径")
	flag.Parse()

	priv, err := generateKey()
	checkErr(err)
	privDER, err := x509.MarshalPKCS8PrivateKey(priv)
	checkErr(err)
	err = ioutil.WriteFile(out, pem.EncodeToMemory(
		&pem.Block{Type: "PRIVATE KEY", Bytes: privDER}), 0640)
	checkErr(err)
}

func checkErr(err error) {
	if err != nil {
		log.Fatal(err)
	}

}

go run src/cmd/new_key/main.go

package main

import (
	"crypto"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"flag"
	"fmt"
	"io/ioutil"
	"log"
	"os"
)

var out string
var key string

var (
	country       = "china"
	stateProvince = "GD"
	locality      = "SZ"
	org           = "self"
	orgUnit       = "self"
	commonName    = "example.com"
)

func loadPrivateKey(key string) (crypto.PrivateKey, error) {
	file, err := os.Open(key)
	if err != nil {
		return nil, err
	}
	defer file.Close()

	data, err := ioutil.ReadAll(file)
	if err != nil {
		return nil, err
	}
	block, _ := pem.Decode(data)
	if block == nil || block.Type != "PRIVATE KEY" {
		return nil, fmt.Errorf("解码私钥失败")
	}

	priv, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		return nil, err
	}
	return priv, nil
}

func newCSR(key crypto.PrivateKey) ([]byte, error) {
	subject := pkix.Name{Country: []string{country}, Province: []string{stateProvince}, Locality: []string{locality},
		Organization: []string{org}, OrganizationalUnit: []string{orgUnit}, CommonName: commonName}

	template := x509.CertificateRequest{Subject: subject, DNSNames: []string{commonName}}
	return x509.CreateCertificateRequest(rand.Reader, &template, key)
}

func main() {
	flag.StringVar(&out, "out", "server.csr", "证书签名请求输出路径")
	flag.StringVar(&key, "key", "server.key", "私钥路径")
	flag.Parse()
	priv, err := loadPrivateKey(key)
	checkErr(err)
	csr, err := newCSR(priv)
	checkErr(err)
	err = ioutil.WriteFile(out, pem.EncodeToMemory(
		&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csr}), 0640)
	checkErr(err)

}

func checkErr(err error) {
	if err != nil {
		log.Fatal(err)
	}
}

go run src/cmd/new_csr/main.go

package main

import (
	"crypto"
	"crypto/rand"
	"crypto/sha1"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"encoding/pem"
	"flag"
	"fmt"
	"io/ioutil"
	"log"
	"math/big"
	"os"
	"time"
)

var key string
var out string

func randomSerialNumber() *big.Int {
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	checkErr(err)
	return serialNumber
}

func loadPrivateKey(key string) (crypto.PrivateKey, error) {
	file, err := os.Open(key)
	if err != nil {
		return nil, err
	}
	defer file.Close()

	data, err := ioutil.ReadAll(file)
	if err != nil {
		return nil, err
	}
	block, _ := pem.Decode(data)
	if block == nil || block.Type != "PRIVATE KEY" {
		return nil, fmt.Errorf("解码私钥失败")
	}

	priv, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		return nil, err
	}
	return priv, nil
}

func main() {
	flag.StringVar(&out, "out", "ca.crt", "证书输出路径")
	flag.StringVar(&key, "key", "server.key", "私钥路径")
	flag.Parse()

	priv, err := loadPrivateKey(key)
	checkErr(err)

	pub := priv.(crypto.Signer).Public()

	spkiASN1, err := x509.MarshalPKIXPublicKey(pub)
	checkErr(err)

	var spki struct {
		Algorithm        pkix.AlgorithmIdentifier
		SubjectPublicKey asn1.BitString
	}
	_, err = asn1.Unmarshal(spkiASN1, &spki)
	checkErr(err)

	skid := sha1.Sum(spki.SubjectPublicKey.Bytes)

	tpl := &x509.Certificate{
		SerialNumber: randomSerialNumber(),
		Subject: pkix.Name{
			Organization:       []string{"golang deployment CA"},
			OrganizationalUnit: []string{"youerning"},

			// The CommonName is required by iOS to show the certificate in the
			// "Certificate Trust Settings" menu.
			// https://github.com/FiloSottile/mkcert/issues/47
			CommonName: "youerning.org",
		},
		SubjectKeyId: skid[:],

		NotAfter:  time.Now().AddDate(10, 0, 0),
		NotBefore: time.Now(),

		KeyUsage: x509.KeyUsageCertSign,

		BasicConstraintsValid: true,
		IsCA:                  true,
		MaxPathLenZero:        true,
	}
	// 根证书的parent证书是自己
	cert, err := x509.CreateCertificate(rand.Reader, tpl, tpl, pub, priv)
	checkErr(err)
	err = ioutil.WriteFile(out, pem.EncodeToMemory(
		&pem.Block{Type: "CERTIFICATE", Bytes: cert}), 0644)
	checkErr(err)

}

func checkErr(err error, msg ...string) {
	if err != nil {
		log.Fatal(msg)
	}
}

go run src/cmd/new_ca_cert/main.go

package main

import (
	"crypto"
	"crypto/rand"
	"crypto/x509"
	"encoding/pem"
	"flag"
	"fmt"
	"io/ioutil"
	"log"
	"math/big"
	"os"
	"time"
)

var csr string
var key string
var out string
var cacert string

func randomSerialNumber() *big.Int {
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	checkErr(err)
	return serialNumber
}

func loadPrivateKey(key string) (crypto.PrivateKey, error) {
	file, err := os.Open(key)
	if err != nil {
		return nil, err
	}
	defer file.Close()

	data, err := ioutil.ReadAll(file)
	if err != nil {
		return nil, err
	}
	block, _ := pem.Decode(data)
	if block == nil || block.Type != "PRIVATE KEY" {
		return nil, fmt.Errorf("解码私钥失败")
	}

	priv, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		return nil, err
	}
	return priv, nil
}

func main() {
	flag.StringVar(&csr, "csr", "server.csr", "证书签名请求文件路径")
	flag.StringVar(&cacert, "ca", "ca.crt", "ca证书文件路径")
	flag.StringVar(&out, "out", "server.crt", "证书输出路径")
	flag.StringVar(&key, "key", "server.key", "私钥路径")
	flag.Parse()

	priv, err := loadPrivateKey(key)
	checkErr(err)
	csrPEMBytes, err := ioutil.ReadFile(csr)
	checkErr(err)
	csrPEM, _ := pem.Decode(csrPEMBytes)
	if csrPEM == nil {
		log.Fatalln("加载证书签名失败")
	}
	if csrPEM.Type != "CERTIFICATE REQUEST" &&
		csrPEM.Type != "NEW CERTIFICATE REQUEST" {
		log.Fatalln("未知的证书签名类型, 期望的值是CERTIFICATE REQUEST, 得到的却是 " + csrPEM.Type)
	}
	csr, err := x509.ParseCertificateRequest(csrPEM.Bytes)
	checkErr(err)
	certPEMBlock, err := ioutil.ReadFile(cacert)
	checkErr(err)
	certDERBlock, _ := pem.Decode(certPEMBlock)
	if certDERBlock == nil || certDERBlock.Type != "CERTIFICATE" {
		log.Fatalln("读取CA证书失败")
	}
	ca, err := x509.ParseCertificate(certDERBlock.Bytes)
	checkErr(err)

	expiration := time.Now().AddDate(2, 3, 0)
	tpl := &x509.Certificate{
		SerialNumber:    randomSerialNumber(),
		Subject:         csr.Subject,
		ExtraExtensions: csr.Extensions,
		NotBefore:       time.Now(), NotAfter: expiration,
		DNSNames:    []string{csr.Subject.CommonName},
		KeyUsage:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	}
	cert, err := x509.CreateCertificate(rand.Reader, tpl, ca, csr.PublicKey, priv)
	checkErr(err)
	err = ioutil.WriteFile(out, pem.EncodeToMemory(
		&pem.Block{Type: "CERTIFICATE", Bytes: cert}), 0644)
	checkErr(err)

}

func checkErr(err error) {
	if err != nil {
		log.Fatal(err)
	}
}

go run src/cmd/new_cert/main.go