openssl单双向认证

ssl生成

CA证书

创建私钥(ca.key)

openssl genrsa -out ca/ca.key

创建请求(ca.csr)

openssl req -new -out ca/ca.csr -key ca/ca.key -subj '/C=CN/ST=ZhengJiang/L=WenZhou/O=SimilarSu CA Corp'

自签署证书(ca.crt)

openssl x509 -req -in ca/ca.csr -out ca/ca.crt -signkey ca/ca.key -days 3650 -extensions v3_ca

将.crt 文件导入到JKS文件(ca.jks)

keytool -keystore ca/ca.jks -keypass cacajks -storepass cacajks -alias ca -import -trustcacerts -file ca/ca.crt

server端证书

创建私钥（server.key）

openssl genrsa -out server/server.key

创建请求(server.csr)

openssl req -new -out server/server.csr -key server/server.key -subj '/C=CN/ST=Zhengjiang/L=WenZhou/O=SimilarSu Server Corp/OU=dev/CN=localhost'

签署证书(server.crt)

openssl x509 -req -in server/server.csr -out server/server.crt -signkey server/server.key -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -days 3650  -extensions v3_ca

导出.p12格式(server.p12)

openssl pkcs12 -export -in server/server.crt -inkey server/server.key -out server/server.p12 -passout pass:serverp12

将.p12 文件导入到JKS文件(server.keystore)

keytool -importkeystore -v -srckeystore  server/server.p12 -srcstoretype pkcs12 -srcstorepass serverp12 -destkeystore server/server.jks -deststoretype jks -deststorepass serverp12

注意：srcstorepass与deststorepass需要相同

client端证书

创建私钥（client.key）

openssl genrsa -out client/client.key

创建请求(client.csr)

openssl req -new -out client/client.csr -key client/client.key -subj '/C=CN/ST=Zhengjiang/L=WenZhou/O=SimilarSu Server Corp/OU=dev/CN=client'

签署证书(client.crt)

openssl x509 -req -in client/client.csr -out client/client.crt -signkey client/client.key -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -days 3650  -extensions v3_ca

导出.p12格式(client.p12)

openssl pkcs12 -export -in client/client.crt -inkey client/client.key -out client/client.p12 -passout pass:clientp12

ssl配置

单向

服务端

server:
  ssl:
    key-store: classpath:ssl/server/server.jks
    key-password: serverp12

客户端

使用ca.crt(非必要)

双向

服务端

server:
  ssl:
    key-store: classpath:ssl/server/server.jks
    key-password: serverp12
    trust-store: classpath:ssl/ca/ca.jks
    trust-store-password: cacajks
    client-auth: need

客户端

使用ca.crt(非必要)
需倒入client.p12