当前位置： 首页 > news >正文

gRPC之SAN证书生成

news 来源：原创 2024/5/14 12:39:03

1、SAN证书生成

SAN(Subject Alternative Name)是 SSL 标准 x509 中定义的一个扩展。使用了 SAN 字段的 SSL 证书，可以扩

展此证书支持的域名，使得一个证书可以支持多个不同域名的解析。接下来我们重新利用配置文件生成CA证书，

再利用ca相关去生成服务端的证书。

1.1 CA根证书生成

新建工作目录：

[root@zsx cert]# pwd
/home/zhangshixing/cert

新建一个配置文件ca.conf，文件内容如下：

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = SiChuan
localityName                = Locality Name (eg, city)
localityName_default        = Chengdu
organizationName            = Organization Name (eg, company)
organizationName_default    = Step
commonName                  = CommonName (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = tonghua

依次执行下面的命令，执行过程中遇到的填写国家之类的直接Enter跳过，选择配置文件中默认的，从而生成CA私

钥(ca.key)、签名请求(ca.csr)和签名证书(ca.pem)。

[root@zsx cert]# ll
total 4
-rw-r--r--. 1 root root 635 Feb 16 19:53 ca.conf
[root@zsx cert]# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
...................................+++
......................+++
e is 65537 (0x10001)[root@zsx cert]# ls
ca.conf  ca.key

[root@zsx cert]# openssl req -new -sha256 -out ca.csr -key ca.key -config ca.conf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SiChuan]:
Locality Name (eg, city) [Chengdu]:
Organization Name (eg, company) [Step]:
CommonName (e.g. server FQDN or YOUR name) [tonghua]:[root@zsx cert]# ls
ca.conf  ca.csr  ca.key

[root@zsx cert]# openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.pem
Signature ok
subject=/C=CN/ST=SiChuan/L=Chengdu/O=Step/CN=tonghua
Getting Private key[root@zsx cert]# ls
ca.conf  ca.csr  ca.key  ca.pem

1.2 签发服务端证书

接下来创建服务端配置文件server.conf，文件内容如下：

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = SiChuan
localityName                = Locality Name (eg, city)
localityName_default        = Chengdu
organizationName            = Organization Name (eg, company)
organizationName_default    = Step
commonName                  = CommonName (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = tonghua
[ req_ext ]
# 添加subjectAltName 
subjectAltName = @alt_names
# www.example.cn代表允许的ServerName
[alt_names]
DNS.1   = www.example.cn
IP      = 127.0.0.1

同样，使用上面得到的CA根证书(ca.pem)签发服务端证书，依次执行下面命令生成服务端的密钥、签名请求和签

名证书：

# 服务端私钥
[root@zsx cert]# openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
.......................................................................................................................................................+++
................................................+++
e is 65537 (0x10001)[root@zsx cert]# ls
ca.conf  ca.csr  ca.key  ca.pem  server.conf  server.key

# 服务端签名请求
[root@zsx cert]# openssl req -new -sha256 -out server.csr -key server.key -config server.conf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SiChuan]:
Locality Name (eg, city) [Chengdu]:
Organization Name (eg, company) [Step]:
CommonName (e.g. server FQDN or YOUR name) [tonghua]:[root@zsx cert]# ls
ca.conf  ca.csr  ca.key  ca.pem  server.conf  server.csr  server.key

# 用根证书签发服务端证书server.pem
[root@zsx cert]# openssl x509 -req -days 3650 -CA ca.pem -CAkey ca.key -CAcreateserial -in server.csr -out server.pem -extensions req_ext -extfile server.conf
Signature ok
subject=/C=CN/ST=SiChuan/L=Chengdu/O=Step/CN=tonghua
Getting CA Private Key[root@zsx cert]# ls
ca.conf  ca.csr  ca.key  ca.pem  ca.srl  server.conf  server.csr  server.key  server.pem

1.3 签发客户端证书

建立配置文件client.conf：

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = SiChuan
localityName                = Locality Name (eg, city)
localityName_default        = Chengdu
organizationName            = Organization Name (eg, company)
organizationName_default    = Step
commonName                  = CommonName (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = tonghua
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1   = www.example.cn
IP      = 127.0.0.1

执行下面命令生成客户端密钥、证书等：

[root@zsx cert]# openssl ecparam -genkey -name secp384r1 -out client.key[root@zsx cert]# ls
ca.conf  ca.key  ca.srl       client.key   server.csr  server.pem
ca.csr   ca.pem  client.conf  server.conf  server.key

[root@zsx cert]# openssl req -new -sha256 -out client.csr -key client.key -config client.conf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SiChuan]:
Locality Name (eg, city) [Chengdu]:
Organization Name (eg, company) [Step]:
CommonName (e.g. server FQDN or YOUR name) [tonghua]:[root@zsx cert]# ls
ca.conf  ca.key  ca.srl       client.csr  server.conf  server.key
ca.csr   ca.pem  client.conf  client.key  server.csr   server.pem

[root@zsx cert]# openssl x509 -req -days 3650 -CA ca.pem -CAkey ca.key -CAcreateserial -in client.csr -out client.pem -extensions req_ext -extfile client.conf
Signature ok
subject=/C=CN/ST=SiChuan/L=Chengdu/O=Step/CN=tonghua
Getting CA Private Key[root@zsx cert]# ls
ca.conf  ca.key  ca.srl       client.csr  client.pem   server.csr  server.pem
ca.csr   ca.pem  client.conf  client.key  server.conf  server.key

1.4 双向认证

1.4.1 proto编写和编译
syntax = "proto3";
package proto;
option go_package = "./base;base";service BaseService {rpc GetTime (TimeRequest) returns (TimeResponse) {}
}message TimeRequest {}message TimeResponse {string time = 1;
}

protoc --go_out=plugins=grpc:. base.proto
1.4.2 服务端
package mainimport ("context""crypto/tls""crypto/x509"pb "demo/base""google.golang.org/grpc""google.golang.org/grpc/credentials""io/ioutil""log""net""time"
)const (// Address gRPC服务地址Address = "127.0.0.1:8888"
)type service struct {pb.UnimplementedBaseServiceServer
}func main() {// TLS认证// 从证书相关文件中读取和解析信息,得到证书公钥、密钥对cert, err := tls.LoadX509KeyPair("./cert/server.pem", "./cert/server.key")if err != nil {log.Fatalln("cert err: ", err)}// 初始化一个CertPoolcertPool := x509.NewCertPool()ca, err := ioutil.ReadFile("./cert/ca.pem")if err != nil {log.Fatalln("ca err: ", err)}// 解析传入的证书,解析成功会将其加到池子中certPool.AppendCertsFromPEM(ca)// 构建基于TLS的TransportCredentials选项creds := credentials.NewTLS(&tls.Config{// 服务端证书链,可以有多个Certificates: []tls.Certificate{cert},// 要求必须验证客户端证书ClientAuth: tls.RequireAndVerifyClientCert,// 设置根证书的集合,校验方式使用 ClientAuth 中设定的模式ClientCAs: certPool,})// 实例化grpc ServerrpcServer := grpc.NewServer(grpc.Creds(creds))// 创建带ca证书验证的服务端pb.RegisterBaseServiceServer(rpcServer, &service{})// 设置传输协议和监听地址listen, err := net.Listen("tcp", Address)if err != nil {log.Fatalln("listen err: ", err)}log.Println("Listen on " + Address + " with TLS")rpcServer.Serve(listen)
}// 实现接口
func (s *service) GetTime(ctx context.Context, in *pb.TimeRequest) (*pb.TimeResponse, error) {now := time.Now().Format("2006-01-02 15:04:05")return &pb.TimeResponse{Time: now}, nil
}

[root@zsx demo]# go run server.go
2023/02/16 20:53:13 Listen on 127.0.0.1:8888 with TLS
1.4.3 客户端
package mainimport ("context""crypto/tls""crypto/x509"pb "demo/base""fmt""google.golang.org/grpc""google.golang.org/grpc/credentials""io/ioutil""log"
)const (// Address gRPC服务地址Address = "127.0.0.1:8888"
)func main() {// TLS连接// 从证书相关文件中读取和解析信息,得到证书公钥、密钥对cert, err := tls.LoadX509KeyPair("./cert/client.pem", "./cert/client.key")if err != nil {log.Fatalln("cert err: ", err)}certPool := x509.NewCertPool()ca, err := ioutil.ReadFile("./cert/ca.pem")if err != nil {log.Fatalln("ca err: ", err)}certPool.AppendCertsFromPEM(ca)creds := credentials.NewTLS(&tls.Config{//客户端证书Certificates: []tls.Certificate{cert},//注意这里的参数为配置文件中所允许的ServerName,也就是其中配置的DNSServerName: "www.example.cn",RootCAs:    certPool,})// 连接服务端conn, err := grpc.Dial(Address, grpc.WithTransportCredentials(creds))if err != nil {log.Fatal(err)}defer conn.Close()client := pb.NewBaseServiceClient(conn)reps, err := client.GetTime(context.Background(), &pb.TimeRequest{})// 初始化客户端if err != nil {log.Fatal(err)}fmt.Printf("grpcClient response is %s\n", reps.Time)
}

[root@zsx demo]# go run client.go
grpcClient response is 2023-02-16 20:53:30

1.5 单向认证

1.5.1 服务端
package mainimport ("context"pb "demo/base""google.golang.org/grpc""google.golang.org/grpc/credentials""log""net""time"
)type service struct {pb.UnimplementedBaseServiceServer
}func main() {creds, err := credentials.NewServerTLSFromFile("./cert/server.pem", "./cert/server.key")if err != nil {log.Fatal(err)}Address := "127.0.0.1:8888"//创建带ca证书验证的服务端rpcServer := grpc.NewServer(grpc.Creds(creds))pb.RegisterBaseServiceServer(rpcServer, &service{})listen, _ := net.Listen("tcp", Address)log.Println("Listen on " + Address + " with TLS")rpcServer.Serve(listen)
}// 实现接口
func (s *service) GetTime(ctx context.Context, in *pb.TimeRequest) (*pb.TimeResponse, error) {now := time.Now().Format("2006-01-02 15:04:05")return &pb.TimeResponse{Time: now}, nil
}

[root@zsx demo]# go run server1.go
2023/02/16 20:53:55 Listen on 127.0.0.1:8888 with TLS
1.5.2 客户端
package mainimport ("context"pb "demo/base""fmt""google.golang.org/grpc""google.golang.org/grpc/credentials""log"
)func main() {creds, err := credentials.NewClientTLSFromFile("./cert/server.pem", "www.example.cn")if err != nil {log.Fatal(err)}conn, err := grpc.Dial("127.0.0.1:8888", grpc.WithTransportCredentials(creds))if err != nil {log.Fatal(err)}defer conn.Close()client := pb.NewBaseServiceClient(conn)resp, err := client.GetTime(context.Background(), &pb.TimeRequest{})if err != nil {log.Fatal(err)}fmt.Printf("grpcClient response is %s\n", resp.Time)
}

[root@zsx demo]# go run client1.go
grpcClient response is 2023-02-16 20:54:14

# 项目结构
$ tree demo/
demo/
├── base
│   └── base.pb.go
├── base.proto
├── cert
│   ├── ca.conf
│   ├── ca.csr
│   ├── ca.key
│   ├── ca.pem
│   ├── ca.srl
│   ├── client.conf
│   ├── client.csr
│   ├── client.key
│   ├── client.pem
│   ├── server.conf
│   ├── server.csr
│   ├── server.key
│   └── server.pem
├── client1.go
├── client.go
├── go.mod
├── go.sum
├── server1.go
└── server.go

相关文章：

  • 二百零二、Hive——Hive解析JSON字段（单个字段与json数组）
  • 第六章 图（上）【图的基本概念和存储】
  • IntelliJ IDE 插件开发 |（一）快速入门
  • 使用IDEA 将Eclipse java工程转为maven格式
  • 快速弄懂C++中的this指针
  • Android7.1 高通 特定apk最上面活动时，禁止关机或重启
  • 算法----小行星碰撞
  • 解决SSH连接自动断开的问题
  • [Vue 配置] Vite + Vue3 项目配置 Tailwind CSS
  • 2024年山东省职业院校技能大赛中职组 “网络安全”赛项竞赛试题-B卷
  • 人充当LLM Agent的工具（Human-In-The-Loop ），提升复杂问题解决成功率
  • STM32F429主控TB6612驱动直流电机----解决PWM波形未输出bug
  • 清华学霸告诉你：如何自学人工智能？
  • 【Python 千题 —— 基础篇】输出列表方差
  • 国产化项目改造：使用达梦数据库和东方通组件部署，前后端分离框架
  • SegmentFault for Android 3.0 发布
  • “大数据应用场景”之隔壁老王（连载四）
  • 《Javascript高级程序设计 (第三版)》第五章 引用类型
  • 【翻译】Mashape是如何管理15000个API和微服务的（三）
  • 【划重点】MySQL技术内幕：InnoDB存储引擎
  • 0基础学习移动端适配
  • Babel配置的不完全指南
  • CentOS7 安装JDK
  • Cumulo 的 ClojureScript 模块已经成型
  • docker python 配置
  • IOS评论框不贴底（ios12新bug）
  • JS基础之数据类型、对象、原型、原型链、继承
  • Linux快速复制或删除大量小文件
  • npx命令介绍
  • Octave 入门
  • PHP那些事儿
  • Python_OOP
  • vue 个人积累(使用工具，组件)
  • Vue实战(四)登录/注册页的实现
  • WordPress 获取当前文章下的所有附件/获取指定ID文章的附件(图片、文件、视频)...
  • 高性能JavaScript阅读简记（三）
  • 快速体验 Sentinel 集群限流功能，只需简单几步
  • 聊一聊前端的监控
  • 爬虫进阶 -- 神级程序员：让你的爬虫就像人类的用户行为！
  • 前端每日实战：70# 视频演示如何用纯 CSS 创作一只徘徊的果冻怪兽
  • 扫描识别控件Dynamic Web TWAIN v12.2发布，改进SSL证书
  • postgresql行列转换函数
  • 策略 ： 一文教你成为人工智能（AI）领域专家
  • 关于Android全面屏虚拟导航栏的适配总结
  • 如何用纯 CSS 创作一个菱形 loader 动画
  • ​软考-高级-系统架构设计师教程（清华第2版）【第12章 信息系统架构设计理论与实践（P420~465）-思维导图】​
  • #设计模式#4.6 Flyweight（享元） 对象结构型模式
  • (04)Hive的相关概念——order by 、sort by、distribute by 、cluster by
  • （145）光线追踪距离场柔和阴影
  • （C语言）深入理解指针2之野指针与传值与传址与assert断言
  • (delphi11最新学习资料) Object Pascal 学习笔记---第8章第5节（封闭类和Final方法）
  • (办公)springboot配置aop处理请求.
  • （算法设计与分析）第一章算法概述-习题
  • （自用）learnOpenGL学习总结-高级OpenGL-抗锯齿
  • （最优化理论与方法）第二章最优化所需基础知识-第三节：重要凸集举例