話不多說,直接利用 Openssl 在兩台 uBuntu 之間建立雙向認證的 SSL/TLS 通信。
筆者使用的 Openssl 版本為 OpenSSL 1.1.1 11 Sep 2018
生成證書
執行以下腳本,會自動生成 CA 證書及利用這個 CA 證書頒發給 Server 和 Client 的證書
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# * Neither the name of the axTLS project nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
# Generate the certificates and keys for testing.
#
PROJECT_NAME="TLS Project"
# Generate the openssl configuration files.
cat > ca_cert.conf << EOF
[ req ]
distinguished_name = req_distinguished_name
prompt = no
[ req_distinguished_name ]
O = $PROJECT_NAME Dodgy Certificate Authority
EOF
cat > server_cert.conf << EOF
[ req ]
distinguished_name = req_distinguished_name
prompt = no
[ req_distinguished_name ]
O = $PROJECT_NAME
CN = 192.168.1.101
EOF
cat > client_cert.conf << EOF
[ req ]
distinguished_name = req_distinguished_name
prompt = no
[ req_distinguished_name ]
O = $PROJECT_NAME Device Certificate
CN = 192.168.1.33
EOF
mkdir ca
mkdir server
mkdir client
mkdir certDER
# private key generation
openssl genrsa -out ca.key 2048
openssl genrsa -out server.key 2048
openssl genrsa -out client.key 2048
# cert requests
openssl req -out ca.req -key ca.key -new \
-config ./ca_cert.conf
openssl req -out server.req -key server.key -new \
-config ./server_cert.conf
openssl req -out client.req -key client.key -new \
-config ./client_cert.conf
# generate the actual certs.
openssl x509 -req -in ca.req -out ca.crt \
-sha256 -days 5000 -signkey ca.key
openssl x509 -req -in server.req -out server.crt \
-sha256 -CAcreateserial -days 5000 \
-CA ca.crt -CAkey ca.key
openssl x509 -req -in client.req -out client.crt \
-sha256 -CAcreateserial -days 5000 \
-CA ca.crt -CAkey ca.key
openssl x509 -in ca.crt -outform DER -out ca.der
openssl x509 -in server.crt -outform DER -out server.der
openssl x509 -in client.crt -outform DER -out client.der
mv ca.crt ca.key ca/
mv server.crt server.key server/
mv client.crt client.key client/
mv ca.der server.der client.der certDER/
rm *.conf
rm *.req
rm *.srl
該腳本需要注意以下幾點:
- 加密位數為 2048 bits
- 簽名算法為 sha256WithRSAEncryption
- Server 的 CN 域和 Client 的 CN 域需要根據實際 IP 位址修改
腳本執行完後會自動生成以下 4 個目錄:
- ca
- certDER
- client
- server
Note:
雖然我的腳本代碼也是借鑒的大神的,但在 Client 去連接配接 Server 的時候一直會報如下錯誤:
error setting certificate
139829188207936:error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak:../ssl/ssl_rsa.c:310:
經過定位才發現,原來是之前腳本是采用的簽名算法為 sha1WithRSAEncryption,該算法較弱的緣故。是以在自己的腳本中将簽名算法由之前的
-sha1
修該為
-sha256
。
建立 TLS/SSL Server
在一台 uBuntu 上執行以下指令建立 TLS/SSL Server
openssl s_server -CAfile ./ca/ca.crt -cert ./server/server.crt -key ./server/server.key -port 20001 -verify 1 -tls1_2
各個參數意義如下:
- -CAfile:CA 證書目錄
- -cert:Server 證書目錄,由 CA 證書頒發
- -key:Server 私鑰目錄
- -port:服務端口
- -verify:校驗 Client 端提供的證書鍊的深度。當指定了該選項時,Server 端必須對 Clent 的證書進行校驗,換句話說就是 Client 必須提供證書,在換句話說就是雙向認證。
- -tls1_2:指定使用 TLS v1.2 版本。
更多參數的意義請參考官網文檔
指令執行成功後 Server 即開始偵聽指定端口
![](https://img.laitimes.com/img/9ZDMuAjOiMmIsIjOiQnIsIyZuBnLyMzNykTN3UmNidDNiRTNiZWMwQTYkN2M5YTMlhTMkN2Lc52YucWbp5GZzNmLn9Gbi1yZtl2Lc9CX6MHc0RHaiojIsJye.png)
建立 TLS/SSL Client
在另一台 uBuntu 上執行以下指令建立 TLS/SSL Client
各個參數意義如下:
- -CAfile:CA 證書目錄
- -cert:Client 證書目錄,由 CA 證書頒發
- -key:Client 私鑰目錄
- -connect:連接配接的 Server 的 IP 位址和端口
- -verify:校驗 Server 端提供的證書鍊的深度。當指定了該選項時,Client 端必須對 Server 的證書進行校驗,換句話說就是 Server 必須提供證書,在換句話說就是雙向認證。
更多參數的意義請參考官網文檔
指令執行成功後 Client 就可以輸入資料,同時 Server 端也能接收到資料。由于建立 TSL/SSL 連接配接的過程中的資訊太多,這裡就不說明。
TSL/SSL 抓包
通過抓包分析:
- NO 14491 包為 Server 将自己的證書發送給 Client
- NO 15447 包為 Client 将自己的證書發送給 Server