PKI秘钥及证书生成管理_pki --signcrl-CSDN博客

此博客详细介绍了如何生成和管理各种加密密钥、证书以及相关文件，包括RSA和ECDSA密钥对、自签名根证书、PEM与DER格式转换、PKCS#8格式处理、OCSP和CRL设置，以及用于不同场景的证书签发，如服务器、客户端和OCSP签名。此外，还涵盖了不同加密强度和哈希算法的应用。
摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >
这是时间的定义：
START=`date  -d "-2 day"    "+%d.%m.%y %T"`
SH_END=`date -d "-1 day"    "+%d.%m.%y %T"`    #  1 day
CA_END=`date -d "+3651 day" "+%d.%m.%y %T"`    # 10 years
IM_END=`date -d "+3286 day" "+%d.%m.%y %T"`    #  9 years
EE_END=`date -d "+2920 day" "+%d.%m.%y %T"`    #  8 years
SH_EXP=`date -d "-1 day"    "+%y%m%d%H%M%SZ"`  #  1 day
IM_EXP=`date -d "+3286 day" "+%y%m%d%H%M%SZ"`  #  9 years
EE_EXP=`date -d "+2920 day" "+%y%m%d%H%M%SZ"`  #  8 years
NOW=`date "+%y%m%d%H%M%SZ"`

#生成CA的秘钥及自签名的根证书
pki --gen  --type rsa --size 3072 --outform pem > strongswanKey.pem
pki --self --type rsa --in strongswanKey.pem --not-before "${START}" --not-after "${CA_END}" \
    --ca --pathlen 1 --dn "C=CH, O=strongSwan Project, CN=strongSwan Root CA" \
    --outform pem > strongswanCert.pem

#证书格式装换pem转der
openssl x509 -in strongswanCert.pem -outform der -out strongswanCert.der

#生成RSA的秘钥
pki --gen --type rsa --size 3072 --outform pem > moonKey.pem

#将秘钥格式由pem转der
openssl rsa -in moonKey.pem -outform der -out moonKey.der \
          2> /dev/null
		  
# 将moon私钥转换为未加密的pkcs8格式  
openssl pkcs8 -in moonKey.pem -nocrypt -topk8 -out moonKey.pem

# 转换moon私钥到v1.5 DES加密PKCS8格式  
openssl pkcs8 -in moonKey.pem -nocrypt -topk8 -v1 PBE-MD5-DES \
              -passout "pass:nH5ZQEWtku0RJEZ6" -out moonKey.pem
			  
# 将dave私钥转换为v2.0 AES-128加密PKCS#8格式  
openssl pkcs8 -in moonKey.pem -nocrypt -topk8  -v2 aes128 \
              -passout "pass:OJlNZBx+80dLh4wC6fw5LmBd" -out moonKey.pem
			  
#导出公钥
pki --pub --type rsa --in moonKey.pem --outform pem > moonPub.pem



	
#为各个主机制作证书	
# Generate host certificates
issue_cert 01 carol carol@strongswan.org Research
issue_cert 02 dave dave@strongswan.org Accounting
issue_cert 03 moon moon.strongswan.org
issue_cert 04 sun sun.strongswan.org
issue_cert 05 alice alice@strongswan.org Sales
issue_cert 06 venus venus.strongswan.org
issue_cert 07 bob bob@strongswan.org Research
	
if [ -z "${4}" ]
  then
  OU=""
else
  OU=" OU=${4},"
fi
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san ${3} \
--serial ${1} --dn "C=CH, O=${PROJECT},${OU} CN=${3}" \
--outform pem > ${HOST_CERT}

#示例：网关路由器	  
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl http://crl.strongswan.org/strongswan.crl --type rsa \
--in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
--serial 03 --dn "C=CH, O=strongSwan Project, CN=moon.strongswan.org" \
--outform pem > moonCert.pem
#示例：主机
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl http://crl.strongswan.org/strongswan.crl --type rsa \
--in carolKey.pem --not-before "${START}" --not-after "${EE_END}" --san carol@strongswan.org \
--serial 03 --dn "C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org" \
--outform pem > carolCert.pem


# 为moon创建PKCS12文件
openssl pkcs12 -export -inkey moonKey.pem -in moonCert.pem -name "moon" \
-certfile strongswanCert.pem -caname "strongSwan Root CA" \
-aes128 -passout "pass:kUqd8O7mzbjXNJKQ" > moonCert.p12 2> /dev/null

# 加密 carolKey.pem
openssl rsa -in carolKey.pem -aes128 --passout pass:nH5ZQEWtku0RJEZ6 -out carolKey.pem \
        2> /dev/null
openssl rsa -in carolKey.pem -aes192 --passout pass:ITP/H4lSHqGpUGmCpgNDklbzTNV+swjA -out carolKey.pem \
        2> /dev/null
openssl rsa -in carolKey.pem -aes256 --passout pass:MeFnDN7VUbj+qU/bkgRIFvbCketIk2wrrs5Ii8297N2v -out carolKey.pem \
        2> /dev/null	
#撤销证书
pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem --reason "key-compromise" \
--serial 08 > http://crl.strongswan.org/strongswan.crl

# 生成AES-128加密的moon密钥和SHA-224哈希证书  
pki --gen --type rsa --size 3072 --outform pem > moonKey.pem
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
    --in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, OU=SHA-224, CN=moon.strongswan.org" \
    --digest sha224 --outform pem > moonCert.pem
# 生成AES-192加密的carol密钥和SHA-384哈希证书  	
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
    --in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, OU=SHA-384, CN=moon.strongswan.org" \
    --digest sha384 --outform pem > moonCert.pem
# 生成AES-256加密的dave密钥和SHA-512哈希证书	
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
    --in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san moon.strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, OU=SHA-512, CN=moon.strongswan.org" \
    --digest sha512 --outform pem > moonCert.pem
# 使用OCSP URI生成另一个carol证书  
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
    --in moonKey.pem --not-before "${START}" --not-after "${EE_END}" --san carol@strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, OU=OCSP, CN=carol@strongswan.org" \
    --ocsp http://ocsp.strongswan.org:8880 --outform pem > moonCert.pem
# 为strongSwan根CA生成OCSP签名证书  	
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
    --in ocspKey.pem --not-before "${START}" --not-after "${EE_END}" --san ocsp.strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, OU=OCSP Signing Authority, CN=ocsp.strongswan.org" \
    --flag ocspSigning --outform pem > ocspCert.pem
	
# 生成自签名OCSP签名证书  
pki --gen --type rsa --size 3072 --outform pem > ocspKey.pem
pki --self --type rsa --in ocspKey.pem --flag ocspSigning \
    --not-before "${START}" --not-after "${CA_END}" --san ocsp.strongswan.org \
    --dn "C=CH, O=strongSwan Project, OU=OCSP Self-Signed Authority, CN=ocsp.strongswan.org" \
    --outform pem > ocspCert.pem
	
# 生成winnetou服务器证书
pki --gen --type rsa --size 3072 --outform pem > ${HOST_KEY}
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --crl ${CA_CDP} --type rsa \
    --in winnetouKey.pem --not-before "${START}" --not-after "${EE_END}" --san winnetou.strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, CN=winnetou.strongswan.org" \
    --flag serverAuth --outform pem > winnetouCert.pem

# Generate strongSwan EC Root CA
#生成strongSwan EC根CA
pki --gen  --type ecdsa --size 521 --outform pem > strongswanKey.pem
pki --self --type ecdsa --in strongswanKey.pem \
    --not-before "${START}" --not-after "${CA_END}" --ca \
    --dn "C=CH, O=strongSwan Project, CN=strongSwan EC Root CA" \
    --outform pem > strongswanCert.pem
#生成dave ECDSA 384位证书
pki --gen --type ecdsa --size 384 --outform pem > daveKey.pem
pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --type ecdsa \
    --in daveKey.pem --not-before "${START}" --not-after "${EE_END}" --san dave@strongswan.org \
    --serial 01 --dn "C=CH, O=strongSwan Project, OU=ECDSA 384 bit, CN=dave@strongswan.org" \
    --crl ${ECDSA_CDP} --outform pem > daveCert.pem