Openssl and Keytool Example

Posted 2021-02-28 onion94

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Openssl and Keytool Example相关的知识，希望对你有一定的参考价值。

keytool

创建服务端密钥库

$ keytool -genkey -alias example.com -keypass changepass -keyalg RSA -keysize 2048 -validity 30 -keystore example.com.pkcs12 -storetype pkcs12 -storepass changepass
$ keytool -list -v -storetype pkcs12 -keystore example.com.pkcs12 -storepass changepass

导出服务端证书

$ keytool -export -alias example.com -keystore example.com.pkcs12 -file example.com.crt -rfc -storepass changepass
$ keytool -printcert -file example.com.crt

客户端证书库导入服务端证书

$ keytool -import -alias example.com -file example.com.crt -keystore trust.pkcs12 -storetype pkcs12 -storepass changepass
$ keytool -list -v -storetype pkcs12 -keystore trust.pkcs12 -storepass changepass

openssl

查看openssl版本

$ openssl version -a
OpenSSL 1.1.1 11 Sep 2018
built on: Thu Jun 20 17:36:28 2019 UTC
platform: debian-amd64
......

创建私钥文件

$ openssl genrsa -out rsa_private_key.pem 1024 
Generating RSA private key, 1024 bit long modulus (2 primes)
....+++++
.........+++++
e is 65537 (0x010001)
$ cat rsa_private_key.pem 
-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQDqyaddpooMAy0+aWhazbt/o+EPX1hdTP5rObji//ybbJ/FVMv0
iw8fc9c9pty8ubKCkqOA6h9+EY3sO1cEQNLMInyd4Eqwr3Jk9InF8cwH83fDomrY
+baJ03ZyWee5PMTBIiIeExOw4OPetSfPDVNVNiEF3Scm7gSpkuLlWUsAHQIDAQAB
AoGANjQb2XkLQb6yAUigeOYqNUuGN+BRLCkMS4Dl+DIVBWTMdegftfMsqJw7wtX0
+/T7Cz4DVU23u4kd9L22VxsIDvta8Oj1YbrQiY0TnxZ/hNMLa4jjVn1MO8FffzFK
Ys7H1I3iWuMF11WpiIkXnGNlPQp0ihLhWZhcfCLTupt3CAECQQD9upDXplFlKRyL
BS3YKoWG2m/kAi6XvAmb2KzORdGox/cpjeWsxkupbpGRiZ+22UujMS9UOcxHAoi4
3fCJwtkdAkEA7OOu9cnJpWm6slJoFD10taMjR5TnsK2h3GVrHIrs8FwpVkzwq1Lf
FUPbj7NX/xumbYRRuPS5I4EnzOzwficTAQJBAOY1jhF7n8JPKMyh6FSHUBtoubiA
mlGllHpIf5GwG2gt9n1Hd6npSODzpzQLUFQQl+X7TFv5DPUowXAqPoJfvakCQQCn
GVBwVn/kK7mjUhfStysdeU9IjhQE/+XeRrgQsTrDre8Gzk0yPMnaATzel96puEJk
nGLdOdti3RdLKZPXGQ8BAkAub7ffpiXJeD1nPUyclOr8SsgcH7YwJffp/wf03bkd
aZ+ggiTVdP2H+DJXEE6bjZWBGMez0yBih0dIkZKvzbbs
-----END RSA PRIVATE KEY-----

算法:RSA
格式:PKCS#1
文件数据为Base64编码的字符串,首行和尾行特殊标记,RFC2405规定每行最多76个字符,上例是64个字符长

从私钥文件创建公钥

$ openssl rsa -in rsa_private_key.pem -out rsa_public_key.pem -pubout 
writing RSA key
$ cat rsa_public_key.pem 
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqyaddpooMAy0+aWhazbt/o+EP
X1hdTP5rObji//ybbJ/FVMv0iw8fc9c9pty8ubKCkqOA6h9+EY3sO1cEQNLMInyd
4Eqwr3Jk9InF8cwH83fDomrY+baJ03ZyWee5PMTBIiIeExOw4OPetSfPDVNVNiEF
3Scm7gSpkuLlWUsAHQIDAQAB
-----END PUBLIC KEY-----

算法:RSA
格式:X.509

将PKCS#1私钥转成PKCS#8

$ openssl pkcs8 -topk8 -in rsa_private_key.pem -out pkcs8_rsa_private_key.pem -nocrypt
$ cat pkcs8_rsa_private_key.pem 
-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOrJp12migwDLT5p
aFrNu3+j4Q9fWF1M/ms5uOL//Jtsn8VUy/SLDx9z1z2m3Ly5soKSo4DqH34Rjew7
VwRA0swifJ3gSrCvcmT0icXxzAfzd8Oiatj5tonTdnJZ57k8xMEiIh4TE7Dg4961
J88NU1U2IQXdJybuBKmS4uVZSwAdAgMBAAECgYA2NBvZeQtBvrIBSKB45io1S4Y3
4FEsKQxLgOX4MhUFZMx16B+18yyonDvC1fT79PsLPgNVTbe7iR30vbZXGwgO+1rw
6PVhutCJjROfFn+E0wtriONWfUw7wV9/MUpizsfUjeJa4wXXVamIiRecY2U9CnSK
EuFZmFx8ItO6m3cIAQJBAP26kNemUWUpHIsFLdgqhYbab+QCLpe8CZvYrM5F0ajH
9ymN5azGS6lukZGJn7bZS6MxL1Q5zEcCiLjd8InC2R0CQQDs4671ycmlabqyUmgU
PXS1oyNHlOewraHcZWsciuzwXClWTPCrUt8VQ9uPs1f/G6ZthFG49LkjgSfM7PB+
JxMBAkEA5jWOEXufwk8ozKHoVIdQG2i5uICaUaWUekh/kbAbaC32fUd3qelI4POn
NAtQVBCX5ftMW/kM9SjBcCo+gl+9qQJBAKcZUHBWf+QruaNSF9K3Kx15T0iOFAT/
5d5GuBCxOsOt7wbOTTI8ydoBPN6X3qm4QmScYt0522LdF0spk9cZDwECQC5vt9+m
Jcl4PWc9TJyU6vxKyBwftjAl9+n/B/TduR1pn6CCJNV0/Yf4MlcQTpuNlYEYx7PT
IGKHR0iRkq/Ntuw=
-----END PRIVATE KEY-----

算法:RSA
格式:PKCS#8

PKCS#8私钥转换为PKCS#1

$ openssl rsa -in pkcs8_rsa_private_key.pem -out pkcs1_rsa_private_key.pem
writing RSA key
$ diff rsa_private_key.pem pkcs1_rsa_private_key.pem

转换一致

PKCS#8私钥生成X509公钥

$ openssl rsa -in pkcs8_rsa_private_key.pem -pubout -out x509_rsa_public_key.pem
writing RSA key
$ diff rsa_public_key.pem x509_rsa_public_key.pem

转换一致

公钥证书

-_spring_io.crt:通过浏览器导出spring.io网站的证书

$ openssl x509 -in -_spring_io.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:32:95:81:43:7e:1d:99:e0:47:1d:bd:f6:b4:16:76
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
        Validity
            Not Before: Mar 15 00:00:00 2019 GMT
            Not After : Apr 1 12:00:00 2020 GMT
        Subject: C = US, ST = California, L = Palo Alto, O = "Pivotal Software, Inc.", OU = Spring, CN = .spring.io
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)

......

#转成二进制格式的证书
$ openssl x509 -in -_spring_io.crt -outform der -out -_spring_io.der
#查看
$ openssl x509 -inform DER -in -_spring_io.der -text -noout
#转成文本格式
$ openssl x509 -in -_spring_io.der -inform der -out -_spring_io-2.crt

创建自签名的CA证书

#创建私钥
$ openssl genrsa -out ca.key 2048
#创建证书签名请求
$ openssl req -new -key ca.key -out ca.csr
#查看
$ openssl req -in ca.csr -text
#签名
$ openssl x509 -in ca.csr -req -signkey ca.key -days 365 -out ca.crt
#查看
$ openssl x509 -in ca.crt -text -noout

创建证书签名

#创建私钥
$ openssl genrsa -out my.key 2048
#创建证书签名请求
$ openssl req -new -key my.key -out my.csr
#使用CA证书签名
$ openssl x509 -req -in my.csr -CA ca.crt -CAkey ca.key -days 365 -CAcreateserial -out my.crt

导出PKCS12证书

$ openssl pkcs12 -export -inkey my.key -in my.crt -CAfile ca.crt -out my.pfx

常见的证书相关文件格式,术语

PKCS

公钥加密标准（Public Key Cryptography Standards, PKCS）

.csr

证书签名请求.某些应用程序可以生成这些文件以提交给证书颁发机构.实际格式是RFC 2986中定义的PKCS10.它包括所请求证书的一些或所有关键详细信息, 例如主题, 组织，状态, 诸如此类, 以及要签名的证书的公钥. 这些由CA签名并返回证书。返回的证书是公用证书(包括公用密钥, 但不包括专用密钥)