Я пытаюсь создать сертификаты для использования с проектом gRP C.
Я использую этот сценарий для их создания с помощью OpenSsl:
set path=D:\programas\OpenSSL-Win64\bin
set OPENSSL_CONF=.\openssl.cfg
# Generate valid CA
openssl genrsa -passout pass:1234 -des3 -out ca.key 4096
openssl req -passin pass:1234 -new -x509 -days 365 -key ca.key -out ca.crt -subj "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Test/CN=Root CA"
# Generate valid Server Key/Cert
openssl genrsa -passout pass:1234 -des3 -out server.key 4096
openssl req -passin pass:1234 -new -key server.key -out server.csr -config openssl.cfg
openssl x509 -req -passin pass:1234 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
# Remove passphrase from the Server Key
openssl rsa -passin pass:1234 -in server.key -out server.key
# Generate valid Client Key/Cert
openssl genrsa -passout pass:1234 -des3 -out client.key 4096
openssl req -passin pass:1234 -new -key client.key -out client.csr -subj "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Client/CN=Cliente"
openssl x509 -passin pass:1234 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
# Remove passphrase from Client Key
openssl rsa -passin pass:1234 -in client.key -out client.key
pause
Файл конфигурации это:
[req]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
countryName = ES
stateOrProvinceName = N/A
localityName = N/A
organizationName = Self-signed certificate
commonName = Server
[req_ext]
subjectAltName = @alt_names
[v3_req]
subjectAltName = @alt_names
[alt_names]
DNS.1 = unaprueba.com
IP.1 = 192.168.1.33
IP.2 = 127.0.0.1
IP.3 = 0.0.0.0
Чтобы проверить, есть ли в csr информация, я использую эту команду:
openssl req -text -noout -verify -in server.csr
Я получаю следующие результаты:
verify OK
Certificate Request:
Data:
Version: 1 (0x0)
Subject: C = ES, ST = N/A, L = N/A, O = Self-signed certificate, CN = Server
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (4096 bit)
Modulus:
00:c2:31:6b:58:ac:13:6f:0e:04:f1:a9:1b:6e:fe:
0d:b5:db:87:46:2e:22:e4:33:75:0a:30:00:43:75:
78:34:1d:4d:6c:a2:58:06:dc:d6:f3:95:fe:24:1b:
c4:de:f2:21:9f:40:40:93:c2:2d:95:f9:f7:ad:68:
dd:3e:9d:ea:db:65:67:a9:a8:9b:33:c8:bd:99:fa:
30:3c:b2:fc:fe:03:b1:1b:54:af:xx:2d:0a:6e:41:
da:f4:2f:3a:8c:58:e1:60:8b:3f:1b:89:66:d7:88:
c1:0b:ab:77:a1:bf:88:cd:e9:1b:fe:f4:29:6c:c8:
1e:0e:39:60:a8:97:1f:0e:4a:05:09:7f:b1:d3:66:
42:0d:6a:9d:76:06:ae:9e:4e:de:22:56:95:4a:21:
bf:c1:b9:2b:fe:f5:d3:2c:ae:60:2d:21:5b:b3:5e:
b1:29:25:3a:2f:cf:d0:35:df:82:b9:f1:d6:ac:7e:
ce:23:f0:2f:7c:22:32:dc:a6:8f:bd:87:72:41:61:
98:8b:65:e7:62:b2:d5:c0:b2:1a:82:d1:e9:05:64:
68:10:c3:eb:34:83:30:b7:ce:8f:ec:66:58:77:c3:
d0:f6:fb:49:cc:dd:03:cf:e6:f4:17:d0:35:cb:8c:
53:00:c9:3c:c8:3b:1f:d1:e3:a7:25:44:18:65:86:
6c:9f:ce:74:0d:1c:70:2f:20:8e:1f:19:2e:db:c9:
af:f9:c5:f1:bb:26:e0:fd:80:8c:6a:7f:d3:c7:9c:
af:ba:58:64:1c:d9:c5:fd:e1:02:83:b0:e2:42:2a:
f3:05:bf:6d:32:db:5e:8d:39:55:e2:74:33:98:c9:
db:71:b6:57:13:51:b4:96:5d:a2:3f:7e:6c:6b:cd:
89:16:21:53:9b:cf:af:57:e9:4b:22:4e:fd:88:16:
45:d8:50:d5:e6:18:fa:3d:7d:15:08:93:57:18:36:
1b:4f:41:f2:81:bf:5c:a6:7b:d4:44:40:86:48:bb:
d4:7f:9b:f8:59:64:1e:29:78:a1:f2:8f:0d:c1:aa:
23:42:1d:85:12:49:46:2a:fc:6d:e7:97:5a:43:2f:
d3:c3:45:6c:aa:a8:xx:d2:01:cb:ec:05:0d:43:94:
ae:4f:89:9f:25:89:55:43:df:2a:97:b4:3f:69:3f:
5a:5a:28:d8:95:d3:00:4d:e6:48:24:c1:d0:6f:59:
d4:b0:79:c3:13:98:46:e8:cd:df:49:5d:92:04:58:
3f:3a:fa:6d:5b:e4:07:4f:54:bf:36:49:a9:1b:06:
5f:44:7a:12:15:73:54:29:26:76:99:11:3b:89:20:
94:0d:64:cb:7a:99:d8:d7:de:5c:75:b3:f3:5b:e8:
97:0b:b9
Exponent: 65537 (0x10001)
Attributes:
Requested Extensions:
X509v3 Subject Alternative Name:
DNS:unaprueba.com, IP Address:192.168.1.33, IP Address:127.0.0.1, IP Address:0.0.0.0
Signature Algorithm: sha256WithRSAEncryption
2b:45:05:8b:12:6f:f0:35:dc:bc:37:e7:cf:b5:4a:9f:cf:99:
09:27:c5:92:df:bb:1a:72:0b:62:62:aa:59:83:a6:fd:61:b5:
9c:47:8f:5c:d1:48:d1:a1:fa:2b:4f:12:32:d2:a9:4b:6d:73:
88:cd:bf:04:c7:d7:54:1e:96:bd:51:91:ae:9d:b2:72:1d:1c:
f7:32:4c:bf:09:c5:f9:62:51:7d:55:b7:1c:5c:b3:c0:15:41:
73:64:4a:29:15:0a:b8:9e:73:43:73:02:f8:2c:92:c0:60:5c:
03:dd:02:5f:cb:98:94:c0:e2:35:c9:06:51:2c:33:33:20:1d:
5d:a3:48:20:da:2c:92:2a:83:9d:08:f6:48:26:6d:27:9d:31:
cb:9c:be:ee:cf:09:de:29:3c:xx:aa:27:c4:79:02:4c:4a:1b:
39:04:22:f1:29:88:dc:cd:57:fa:53:98:44:21:7e:c0:fb:af:
90:ed:9b:79:90:aa:b1:79:b6:c0:f8:e6:97:13:a6:16:5f:a9:
28:c1:bb:13:58:16:7a:79:aa:b2:1b:60:d2:28:66:7b:f0:cd:
34:dc:40:cf:ec:cd:66:19:4e:00:e4:46:59:e5:37:45:93:34:
55:0e:50:b1:dd:67:f0:bf:5a:38:dd:71:72:7f:28:7e:00:3a:
50:53:aa:d4:1d:da:ff:ba:7c:6a:01:04:c1:09:6a:a4:ae:cc:
7b:27:88:43:da:c4:79:9e:ba:c2:ed:d0:8d:80:5f:a8:d2:df:
9e:72:28:11:1f:be:88:d6:ac:ec:12:c3:4d:49:c1:96:a0:b8:
6c:d2:bd:91:3f:5f:b8:4c:71:93:48:65:8f:b2:56:99:32:ca:
9c:b8:2d:60:8f:2f:80:b4:41:61:7f:53:cb:c7:14:c5:36:0b:
92:a0:08:8a:f1:21:c6:a7:20:3c:d2:36:86:27:9e:be:c1:ab:
88:c0:ab:6f:83:b5:c3:e4:1f:63:e0:64:33:e1:18:04:c9:46:
34:83:78:6c:3d:64:ec:45:fe:3f:8b:63:a8:42:de:87:dc:38:
18:cf:f1:ee:b4:4b:2b:ec:a8:9a:42:29:55:d9:75:38:35:20:
49:e7:1a:9e:af:10:91:d3:9d:a5:8c:b0:8a:55:22:76:a1:ea:
7d:69:bc:da:f6:48:ed:xx:cc:17:dd:45:6a:72:2c:43:9e:5d:
88:d0:c4:03:5e:5e:75:f5:60:8f:74:4d:4e:7d:d3:59:a0:27:
db:81:ec:7c:75:d4:9a:02:99:99:f2:de:cc:77:22:02:00:a5:
ce:05:46:aa:a9:b8:b1:0f:b2:2f:32:d8:75:01:a9:36:72:2f:
e4:5f:b5:65:c0:33:8e:fb
In В этом случае я вижу, что форма SAN включена.
Итак, я пытаюсь проверить информацию сертификата server.crt, я использую эту команду:
openssl x509 -in server.crt -text -noout
У меня есть этот результат :
Certificate:
Data:
Version: 1 (0x0)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = SP, ST = Spain, L = Valdepenias, O = Test, OU = Test, CN = Root CA
Validity
Not Before: Aug 2 11:54:33 2020 GMT
Not After : Aug 2 11:54:33 2021 GMT
Subject: C = ES, ST = N/A, L = N/A, O = Self-signed certificate, CN = Server
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (4096 bit)
Modulus:
00:c2:31:6b:58:ac:13:6f:0e:04:f1:a9:1b:6e:fe:
0d:b5:db:87:46:2e:22:e4:33:75:0a:30:00:43:75:
78:34:1d:4d:6c:a2:58:06:dc:d6:f3:95:fe:24:1b:
c4:de:f2:21:9f:40:40:93:c2:2d:95:f9:f7:ad:68:
dd:3e:9d:ea:db:65:67:a9:a8:9b:33:c8:bd:99:fa:
30:3c:b2:fc:fe:03:b1:1b:54:af:40:2d:0a:6e:41:
da:f4:2f:3a:8c:58:e1:60:8b:3f:1b:89:66:d7:88:
c1:0b:ab:77:a1:bf:88:cd:e9:1b:fe:f4:29:6c:c8:
1e:0e:39:60:a8:97:1f:0e:4a:05:09:7f:b1:d3:66:
42:0d:6a:9d:76:06:ae:9e:4e:de:22:56:95:4a:21:
bf:c1:b9:2b:fe:f5:d3:2c:ae:60:2d:21:5b:b3:5e:
b1:29:25:3a:2f:cf:xx:35:df:82:b9:f1:d6:ac:7e:
ce:23:f0:2f:7c:22:32:dc:a6:8f:bd:87:72:41:61:
98:8b:65:e7:62:b2:d5:c0:b2:1a:82:d1:e9:05:64:
68:10:c3:eb:34:83:30:b7:ce:8f:ec:66:58:77:c3:
d0:f6:fb:49:cc:dd:03:cf:e6:f4:17:d0:35:cb:8c:
53:00:c9:3c:c8:3b:1f:d1:e3:a7:25:44:18:65:86:
6c:9f:ce:74:0d:1c:70:2f:20:8e:1f:19:2e:db:c9:
af:f9:c5:f1:bb:26:e0:fd:80:8c:6a:7f:d3:c7:9c:
af:ba:58:64:1c:d9:c5:fd:e1:02:83:b0:e2:42:2a:
f3:05:bf:6d:32:db:5e:8d:39:55:e2:74:33:98:c9:
db:71:b6:57:13:51:b4:96:5d:a2:3f:7e:6c:6b:cd:
89:16:21:53:9b:cf:af:57:e9:4b:22:4e:fd:88:16:
45:d8:50:d5:e6:18:fa:3d:7d:15:08:93:57:18:36:
1b:4f:41:f2:81:bf:5c:a6:7b:d4:xx:40:86:48:bb:
d4:7f:9b:f8:59:64:1e:29:78:a1:f2:8f:0d:c1:aa:
23:42:1d:85:12:49:46:2a:fc:6d:e7:97:5a:43:2f:
d3:c3:45:6c:aa:a8:88:d2:01:cb:ec:05:0d:43:94:
ae:4f:89:9f:25:89:55:43:df:2a:97:b4:3f:69:3f:
5a:5a:28:d8:95:d3:00:4d:e6:48:24:c1:d0:6f:59:
d4:b0:79:c3:13:98:46:e8:cd:df:49:5d:92:04:58:
3f:3a:fa:6d:5b:e4:07:4f:54:bf:36:49:a9:1b:06:
5f:44:7a:12:15:73:54:29:26:76:99:11:3b:89:20:
94:0d:64:cb:7a:99:d8:d7:de:5c:75:b3:f3:5b:e8:
97:0b:b9
Exponent: 65537 (0x10001)
Signature Algorithm: sha256WithRSAEncryption
a3:8d:dc:e5:a5:d8:5c:0a:68:5c:e2:ed:f6:7c:24:65:40:ba:
05:8d:79:82:bf:c7:d4:dd:6e:83:1e:d1:15:99:f6:ed:c6:6f:
2c:f3:16:a0:87:6d:ed:28:24:a1:a8:1d:0c:0f:fd:af:89:2b:
c2:6c:7e:f4:d2:f1:88:ed:6c:49:b3:b2:ed:a2:a2:33:60:68:
d5:1a:2e:b3:27:6c:ac:75:f5:c5:10:5c:cf:53:26:c9:f0:c1:
23:36:b8:2d:3d:31:f5:3b:7f:4a:49:6f:cf:15:4a:8b:fc:31:
fd:50:5e:a9:bc:5b:40:a0:e7:ac:79:8a:55:18:1d:ab:02:80:
5a:78:36:1a:3a:0b:00:61:8f:88:19:a0:11:f0:b5:49:c6:5b:
b0:29:dd:0a:34:7b:0a:68:3a:72:bd:f0:d3:f8:0c:04:ab:82:
fd:ff:1c:56:b5:27:86:d0:5b:16:b5:70:2f:1c:03:49:de:45:
77:c5:00:5c:5c:0b:xx:9e:a9:c8:b3:1f:db:90:49:df:9a:55:
f7:85:0d:90:80:e4:43:e4:87:09:8b:8c:30:48:e7:b2:b3:2e:
f5:fe:a6:da:bd:1a:e0:a0:0e:09:ec:21:e0:3a:61:3d:59:09:
ba:1c:8d:a8:9c:a2:78:dc:f1:50:1b:87:55:e6:2a:b9:7c:03:
1a:61:6c:ee:21:34:e5:bc:52:b2:bf:2c:50:07:fd:92:e8:5c:
be:9c:82:f9:67:76:da:85:d9:c0:61:d5:96:fa:18:0d:ba:03:
d5:cc:e6:f8:6d:c5:ec:56:7c:ff:26:8d:82:02:80:9d:63:bb:
b8:fb:8c:44:2f:e9:9c:e8:79:ba:c4:fb:dd:40:bc:f7:a3:76:
31:e3:9d:06:15:ec:42:30:f0:e4:78:9c:22:e6:22:c6:54:b5:
5d:c0:0a:56:62:63:31:d9:34:19:bc:2c:54:14:56:28:20:aa:
9d:1c:56:4b:f8:e5:2b:10:8a:f9:42:52:08:da:14:d1:a3:39:
fc:d0:6d:81:ca:35:95:8c:34:41:2c:d2:a3:d6:ae:41:c9:6b:
9a:4e:df:29:31:0e:be:95:91:9a:ff:09:78:2f:d6:97:33:45:
39:7c:2b:83:ef:3a:9c:32:28:d7:75:06:bc:38:ef:e5:77:40:
68:da:c3:80:28:f4:68:82:1a:77:68:xx:8d:b3:59:ce:7f:9f:
57:6e:2c:5c:ba:52:df:0a:47:05:99:93:e8:95:bb:7b:c7:f1:
08:36:af:14:7b:8c:dd:35:fe:71:cf:27:db:d4:65:cb:10:cd:
45:46:2c:a8:d8:11:12:23:5d:40:93:c2:c2:f9:ef:fd:33:c5:
42:5c:e6:10:5b:ef:f5:97
Информация о SAN отсутствует в сертификате сервера, поэтому я предполагаю, что она создана неправильно, но я не уверен, правильный это сертификат или нет, но я предполагаю, что если Я хочу использовать сертификат сервера для sh стабилизации адресов, я должен иметь эту информацию в файле crt, а не только в файле csr.
Итак, мой вопрос, как я могу создать сервер. crt с информацией о SAN?
Спасибо.