自制證書搭建https服務

第一步，自制CA證書和Server證書，私鑰

自制CA私鑰
openssl genrsa -des3 -out ca.key 4096
自制CA證書
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

自制Server私鑰，生成免密碼版本
openssl genrsa -des3 -out server.key 4096
openssl rsa -in server.key -out server.nosecret.key
製做csr文件
openssl req -new -key server.key -out server.csr
用CA證書私鑰對csr簽名（CA不能用X509，這點須要注意）生成Server證書
openssl ca -days 3650 -in server.csr -cert ca.crt -keyfile ca.key -out server.crt

第二步，配置web服務器，nginx配置方法以下

server {
    listen 443;
    server_name www.mydomain.com;

    ssl on;
    ssl_certificate ssl/server.crt;
    ssl_certificate_key ssl/server.nosecret.key;

    location /t {
            echo "Hello World";
    }
}

lighttpd配置以下(須要cat server.nosecret.key server.crt > server.pem)

$HTTP["host"] =~ "(^.*\.|)mydomain.com" {
        $SERVER["socket"] == ":443" {
                ssl.engine                  = "enable"
                ssl.pemfile                 = "/etc/lighttpd/server.pem"
                ssl.ca-file                 = "/etc/lighttpd/server.crt"
        }

        proxy.balance = "round-robin"
        proxy.server = (
                "/" => ((
                        "host"  =>      "127.0.0.1",
                        "port"  =>      9000
                ))
        )
}

第三步，驗證方法以下

瀏覽器使用需導入ca.crt到根證書，curl和wget命令行工具使用方法以下
curl -v --cacert ca.crt "https://www.mydomain.com/t"
wget --ca-certificate=ca.crt https://www.mydomain.com/t

不檢查證書
curl須要指定-k參數，wget須要帶參數-no-check-certificate

附，libcurl使用以下

function curlPost($url, $data = array(), $timeout = 30, $CA = true){

    $cacert = getcwd() . '/ca.crt'; //CA根證書  
    $SSL = substr($url, 0, 8) == "https://" ? true : false;

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout-2);
    if ($SSL && $CA) {
        curl_setopt($ch, CURLOPT_SSLVERSION, 3);
        curl_setopt($ch, CURLOPT_SSLCERTTYPE, 'PEM');//默認PEM
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);   // 只信任CA頒佈的證書  
        curl_setopt($ch, CURLOPT_SSLCERTPASSWD, true);   // 只信任CA頒佈的證書  

        curl_setopt($ch, CURLOPT_CAINFO, $cacert); // CA根證書（用來驗證的網站證書是不是CA頒佈）  
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); // 檢查證書中是否設置域名，而且是否與提供的主機名匹配  
    } else if ($SSL && !$CA) {
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // 信任任何證書  
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 1); // 檢查證書中是否設置域名  
    }
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Expect:')); //避免data數據過長問題  
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
    //curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data)); //data with URLEncode  

    $ret = curl_exec($ch);
    //var_dump(curl_error($ch));  //查看報錯信息  

    curl_close($ch);
    return $ret;
}

$ret = curlPost("https://www.mydomain.com/t");
echo $ret;

?>

查看證書內容，有效期，用途方法以下

openssl x509 -in ca.crt -noout -text 
openssl x509 -in ca.crt -noout -dates
openssl x509 -in ca.crt -noout -purpose