X.509数字证书服务端与客户端双向验证

 未分类  Add comments
3 月 212020
 

服务端未启用证书时的接口请求

[root@ip-172-31-47-53 ~]# curl -I http://api.iot.com
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Thu, 19 Mar 2020 07:53:35 GMT
Content-Type: text/html
Content-Length: 169
Last-Modified: Wed, 18 Mar 2020 02:03:48 GMT
Connection: keep-alive
ETag: "5e718184-a9"
Accept-Ranges: bytes

[root@ip-172-31-47-53 ~]#
[root@ip-172-31-47-53 ~]# curl http://api.iot.com
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Welcome to CentOS</title>
</head>
<body>
<h1>Welcome to CentOS</h1>
</body>
</html>
[root@ip-172-31-47-53 ~]#

服务端启用证书时的接口请求

服务器配置

    server {
        listen       443 ssl http2 default_server;
        listen       [::]:443 ssl http2 default_server;
        server_name  api.iot.com;
        root         /usr/share/nginx/html;

        ssl_certificate "/etc/pki/nginx/server.crt";
        ssl_certificate_key "/etc/pki/nginx/private/server.key";
        #ssl_client_certificate "/etc/pki/nginx/ca.crt";
        #ssl_verify_client on;
        #ssl_verify_depth 2;
        #ssl_session_cache shared:SSL:1m;
        #ssl_session_timeout  10m;
        #ssl_ciphers HIGH:!aNULL:!MD5;
        #ssl_prefer_server_ciphers on;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

服务端证书配置(去除私钥密码以解决nginx启动报错)

[root@ip-172-31-47-53 ~]# cat ca/intermediate/certs/api.iot.com.cert.pem > /etc/pki/nginx/server.crt
[root@ip-172-31-47-53 ~]# cat ca/intermediate/certs/ca-chain.cert.pem >> /etc/pki/nginx/server.crt
[root@ip-172-31-47-53 ~]# openssl rsa -in ca/intermediate/private/api.iot.com.key.pem -out /etc/pki/nginx/private/server.key
Enter pass phrase for ca/intermediate/private/api.iot.com.key.pem:
writing RSA key
[root@ip-172-31-47-53 ~]#

检查配置

[root@ip-172-31-47-53 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@ip-172-31-47-53 ~]#

重新加载配置

[root@ip-172-31-47-53 ~]# systemctl restart nginx

客户端发起HEAD请求

[root@ip-172-31-47-53 ~]# curl -k -v -I https://api.iot.com
* About to connect() to api.iot.com port 443 (#0)
*   Trying 18.163.8.203...
* Connected to api.iot.com (18.163.8.203) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*       subject: CN=api.iot.com,OU=IT,O=YSWL,L=Shenzhen,ST=Guangdong,C=CN
*       start date: Mar 19 06:48:39 2020 GMT
*       expire date: Mar 19 06:48:39 2021 GMT
*       common name: api.iot.com
*       issuer: CN=YSWM Intermediate CA,OU=YSWM Certificate Authority,O=YSWM,ST=Guangdong,C=CN
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: api.iot.com
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.16.1
Server: nginx/1.16.1
< Date: Thu, 19 Mar 2020 08:21:44 GMT
Date: Thu, 19 Mar 2020 08:21:44 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 169
Content-Length: 169
< Last-Modified: Wed, 18 Mar 2020 02:03:48 GMT
Last-Modified: Wed, 18 Mar 2020 02:03:48 GMT
< Connection: keep-alive
Connection: keep-alive
< ETag: "5e718184-a9"
ETag: "5e718184-a9"
< Accept-Ranges: bytes
Accept-Ranges: bytes

< 
* Connection #0 to host api.iot.com left intact
[root@ip-172-31-47-53 ~]#

客户端发起GET请求

[root@ip-172-31-47-53 ~]# curl -k https://api.iot.com
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Welcome to CentOS</title>
</head>
<body>
<h1>Welcome to CentOS</h1>
</body>
</html>
[root@ip-172-31-47-53 ~]#

启用客户端证书验证

    server {
        listen       443 ssl http2 default_server;
        listen       [::]:443 ssl http2 default_server;
        server_name  api.iot.com;
        root         /usr/share/nginx/html;

        ssl_certificate "/etc/pki/nginx/server.crt";
        ssl_certificate_key "/etc/pki/nginx/private/server.key";
        ssl_client_certificate "/etc/pki/nginx/ca.crt";
        ssl_verify_client on;
        ssl_verify_depth 2;
        #ssl_session_cache shared:SSL:1m;
        #ssl_session_timeout  10m;
        #ssl_ciphers HIGH:!aNULL:!MD5;
        #ssl_prefer_server_ciphers on;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

准备客户端验证CA证书链文件

[root@ip-172-31-47-53 ~]# cat ca/intermediate/certs/ca-chain.cert.pem > /etc/pki/nginx/ca.crt

检查配置文件并重启nginx服务

[root@ip-172-31-47-53 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@ip-172-31-47-53 ~]# systemctl restart nginx

不指定客户端证书的HEAD请求
错误：* NSS: client certificate not found (nickname not specified)

[root@ip-172-31-47-53 ~]# curl -k -v -I https://api.iot.com
* About to connect() to api.iot.com port 443 (#0)
*   Trying 18.163.8.203...
* Connected to api.iot.com (18.163.8.203) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate not found (nickname not specified)
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*       subject: CN=api.iot.com,OU=IT,O=YSWL,L=Shenzhen,ST=Guangdong,C=CN
*       start date: Mar 19 06:48:39 2020 GMT
*       expire date: Mar 19 06:48:39 2021 GMT
*       common name: api.iot.com
*       issuer: CN=YSWM Intermediate CA,OU=YSWM Certificate Authority,O=YSWM,ST=Guangdong,C=CN
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: api.iot.com
> Accept: */*
> 
< HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
< Server: nginx/1.16.1
Server: nginx/1.16.1
< Date: Thu, 19 Mar 2020 08:31:16 GMT
Date: Thu, 19 Mar 2020 08:31:16 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 237
Content-Length: 237
< Connection: close
Connection: close

< 
* Closing connection 0
[root@ip-172-31-47-53 ~]#

指定客户端证书的HEAD请求

准备客户端私钥

[root@ip-172-31-47-53 ~]# openssl rsa -in ca/intermediate/private/device.key.pem -out device.key.pem
Enter pass phrase for ca/intermediate/private/device.key.pem:
writing RSA key
[root@ip-172-31-47-53 ~]#

客户端HEAD请求成功

[root@ip-172-31-47-53 ~]# openssl rsa -in ca/intermediate/private/device.key.pem -out device.key.pem
Enter pass phrase for ca/intermediate/private/device.key.pem:
writing RSA key
[root@ip-172-31-47-53 ~]# curl -Ivk --cert ./ca/intermediate/certs/device.cert.pem --key ./device.key.pem https://api.iot.com
* About to connect() to api.iot.com port 443 (#0)
*   Trying 18.163.8.203...
* Connected to api.iot.com (18.163.8.203) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate from file
*       subject: CN=IOTHS0000238,OU=IT,O=MENGNIU,L=Shenzhen,ST=Guangdong,C=CN
*       start date: Mar 19 07:24:28 2020 GMT
*       expire date: Sep 15 07:24:28 2020 GMT
*       common name: IOTHS0000238
*       issuer: CN=YSWM Intermediate CA,OU=YSWM Certificate Authority,O=YSWM,ST=Guangdong,C=CN
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*       subject: CN=api.iot.com,OU=IT,O=YSWL,L=Shenzhen,ST=Guangdong,C=CN
*       start date: Mar 19 06:48:39 2020 GMT
*       expire date: Mar 19 06:48:39 2021 GMT
*       common name: api.iot.com
*       issuer: CN=YSWM Intermediate CA,OU=YSWM Certificate Authority,O=YSWM,ST=Guangdong,C=CN
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: api.iot.com
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.16.1
Server: nginx/1.16.1
< Date: Thu, 19 Mar 2020 08:37:24 GMT
Date: Thu, 19 Mar 2020 08:37:24 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 169
Content-Length: 169
< Last-Modified: Wed, 18 Mar 2020 02:03:48 GMT
Last-Modified: Wed, 18 Mar 2020 02:03:48 GMT
< Connection: keep-alive
Connection: keep-alive
< ETag: "5e718184-a9"
ETag: "5e718184-a9"
< Accept-Ranges: bytes
Accept-Ranges: bytes

< 
* Connection #0 to host api.iot.com left intact
[root@ip-172-31-47-53 ~]#

客户端GET请求成功

[root@ip-172-31-47-53 ~]# curl -vk --cert ./ca/intermediate/certs/device.cert.pem --key ./device.key.pem https://api.iot.com
* About to connect() to api.iot.com port 443 (#0)
*   Trying 18.163.8.203...
* Connected to api.iot.com (18.163.8.203) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate from file
*       subject: CN=IOTHS0000238,OU=IT,O=MENGNIU,L=Shenzhen,ST=Guangdong,C=CN
*       start date: Mar 19 07:24:28 2020 GMT
*       expire date: Sep 15 07:24:28 2020 GMT
*       common name: IOTHS0000238
*       issuer: CN=YSWM Intermediate CA,OU=YSWM Certificate Authority,O=YSWM,ST=Guangdong,C=CN
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*       subject: CN=api.iot.com,OU=IT,O=YSWL,L=Shenzhen,ST=Guangdong,C=CN
*       start date: Mar 19 06:48:39 2020 GMT
*       expire date: Mar 19 06:48:39 2021 GMT
*       common name: api.iot.com
*       issuer: CN=YSWM Intermediate CA,OU=YSWM Certificate Authority,O=YSWM,ST=Guangdong,C=CN
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: api.iot.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: nginx/1.16.1
< Date: Thu, 19 Mar 2020 12:09:49 GMT
< Content-Type: text/html
< Content-Length: 169
< Last-Modified: Wed, 18 Mar 2020 02:03:48 GMT
< Connection: keep-alive
< ETag: "5e718184-a9"
< Accept-Ranges: bytes
< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Welcome to CentOS</title>
</head>
<body>
<h1>Welcome to CentOS</h1>
</body>
</html>
* Connection #0 to host api.iot.com left intact
[root@ip-172-31-47-53 ~]#

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)