Chinaunix首页 | 论坛 | 博客
  • 博客访问: 2339088
  • 博文数量: 321
  • 博客积分: 3440
  • 博客等级: 中校
  • 技术积分: 2992
  • 用 户 组: 普通用户
  • 注册时间: 2007-05-24 09:08
个人简介

我就在这里

文章分类

全部博文(321)

文章存档

2015年(9)

2014年(84)

2013年(101)

2012年(25)

2011年(29)

2010年(21)

2009年(6)

2008年(23)

2007年(23)

分类: 网络与安全

2013-04-06 19:54:39

1. 创建一个自签名的 SSL 证书


  1. #### 使用 OpenSSL 创建自签名证书


  2. ## 1.创建根证书的私钥
  3. openssl genrsa -out ca.key 1024

  4. ## 2.使用私钥创建根证书
  5. openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/C=CN/ST=Fujian/L=Xiamen/O=Your Company Name/OU=Your Root CA"

  6. ## 3.创建服务器私钥
  7. openssl genrsa -out server.key 1024

  8. ## 4.使用服务器私钥创建证书请求文件
  9. openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Fujian/L=Xiamen/O=Your Company Name/OU=youwebsite.org/CN=yourwebsite.org"

  10. ## 5.准备工作
  11. mkdir -p demoCA/newcerts
  12. touch demoCA/index.txt
  13. echo '01' > demoCA/serial

  14. ## 6.创建服务器证书并使用ca根证书签名
  15. openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key


  16. ## ---查看不同格式文件的内容命令语法
  17. # openssl rsa -noout -text -in ca.key
  18. # openssl x509 -noout -text -in ca.crt
  19. # openssl rsa -noout -text -in server.key
  20. # openssl req -noout -text -in server.csr
  21. # openssl x509 -noout -text -in server.crt

  22. ## 创建证书最简单方式
  23. # openssl req -new -x509 -days 365 -nodes -out cert.pem -keyout cert.key

2. python server


  1. import socket, ssl
  2. import time

  3. cacrtf="ca/ca.crt"
  4. crtf="ca/server.crt"
  5. keyf="ca/server.key"

  6. server_sc = socket.socket()
  7. server_sc.bind(('', 10023))
  8. server_sc.listen(5)

  9. newsocket, addr = server_sc.accept()
  10. sc = ssl.wrap_socket(newsocket,
  11.                      server_side=True,
  12.                      certfile=crtf,
  13.                      keyfile=keyf,
  14.                      ca_certs=cacrtf)

  15. data = sc.read()
  16. print data
  17. sc.write('Back time: ' + str(time.time()))

  18. sc.close()
  19. server_sc.close()

3. python client


  1. import socket, ssl, pprint
  2. import time

  3. cacrtf="ca/ca.crt"
  4. crtf="ca/server.crt"
  5. keyf="ca/server.key"

  6. socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  7. ssl_socket = ssl.wrap_socket(socket, ca_certs=cacrtf, cert_reqs=ssl.CERT_REQUIRED)
  8. ssl_socket.connect(('127.0.0.1', 10023))

  9. print repr(ssl_socket.getpeername())
  10. print ssl_socket.cipher()
  11. print pprint.pformat(ssl_socket.getpeercert())

  12. ssl_socket.write("Time: %s\r\n" % time.time())

  13. data = ssl_socket.read()
  14. print data

  15. ssl_socket.close()

4. ruby server


  1. require 'socket'
  2. require 'openssl'

  3. $cacrtf="ca/ca.crt"
  4. $crtf="ca/server.crt"
  5. $keyf="ca/server.key"

  6. server = TCPServer.new('127.0.0.1', 10024)
  7. ctx = OpenSSL::SSL::SSLContext.new()
  8. ctx.cert= OpenSSL::X509::Certificate.new(File.open($crtf))
  9. ctx.key = OpenSSL::PKey::RSA.new(File.open($keyf))
  10. ssl_server = OpenSSL::SSL::SSLServer.new(server, ctx)

  11. sc = ssl_server.accept

  12. p sc.gets
  13. sc.puts "Back Time: #{Time.now}"

  14. sc.close
  15. ssl_server.close

5. ruby client


  1. require 'socket'
  2. require 'openssl'

  3. $cacrtf="ca/ca.crt"
  4. $crtf="ca/server.crt"
  5. $keyf="ca/server.key"

  6. socket = TCPSocket.new('127.0.0.1', 10024)
  7. context = OpenSSL::SSL::SSLContext.new
  8. context.cert= OpenSSL::X509::Certificate.new(File.open($cacrtf)) # $cacrtf or $crtf
  9. ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, context)
  10. ssl_socket.sync_close = true
  11. ssl_socket.connect
  12. p ssl_socket.ssl_version

  13. ssl_socket.puts "Time: #{Time.now}"
  14. p ssl_socket.gets

  15. ssl_socket.close


end.
阅读(1939) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~