☰

创建证书颁发机构证书

tag-icon • tag-icon openssl ipsec strongswan
创建证书颁发机构证书

我有以下生成证书的 ipsec 命令，但我没有安装 ipsec，因此正在寻找 openssl 等效命令。有人可以帮忙吗？

创建证书颁发机构证书

ipsec pki --gen --type rsa --size 4096 --outform pem > server-root-key.pem

ipsec pki --self --ca --lifetime 3650 \
--in server-root-key.pem \
--type rsa --dn "C=GB, O=Self Signed, CN=VPN Server Root CA" \
--outform pem > server-root-ca.pem

创建 VPN 服务器证书

ipsec pki --gen --type rsa --size 4096 --outform pem > vpn-server-key.pem

ipsec pki --pub --in vpn-server-key.pem \
--type rsa | ipsec pki --issue --lifetime 1825 \
--cacert /etc/swanctl/x509ca/server-root-ca.pem \
--cakey /etc/swanctl/private/server-root-key.pem \
--dn "C=GB, O=Self signed, CN=vpnserver" \
--san vpnserver \
--san dns:18.130.12.85 \
--flag serverAuth --flag ikeIntermediate \
--outform pem > vpn-server-cert.pem

创建用户证书

ipsec pki --gen --type rsa --size 4096 --outform pem > vpn-$USER-key.pem

ipsec pki --pub --in vpn-$USER-key.pem \
--type rsa | ipsec pki --issue --lifetime 1825 \
--cacert /etc/swanctl/x509ca/server-root-ca.pem \
--cakey /etc/swanctl/private/server-root-key.pem \
--dn "C=GB, O=Self signed, CN=$USER" \
--san $USER \
--outform pem > vpn-$USER-cert.pem

答案1

我已经花了 3 个小时尝试获得它，因此它们在这里可以节省您的时间：

################### Create certificate authority cert
openssl req -new -x509 -days 3650 \
-newkey rsa:4096 -nodes \
-subj "/C=GB/O=Self Signed/CN=VPN Server Root CA" \
-keyout private/server-root-key.pem -out x509ca/server-root-ca.pem

################### Create vpn server cert
openssl req -new -newkey rsa:4096 -nodes \
-subj "/C=GB/O=Self Signed/CN=vpnserver" \
-keyout private/vpn-server-key.pem -out x509/vpn-server-cert.pem

openssl x509 -req -in x509/vpn-server-cert.pem -days 1095 \
-CA x509ca/server-root-ca.pem -CAkey private/server-root-key.pem -CAcreateserial \
-out x509/vpn-server-cert.pem \
-extensions req_ext -extfile <(
cat <<EOF
[req_ext]
subjectAltName = DNS:vpnserver,DNS:18.130.12.85
extendedKeyUsage = 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.8.2.2
EOF
)

################### Create user cert
ID=userN

openssl req -new -newkey rsa:4096 -nodes \
-subj "/C=GB/O=Self Signed/CN=${ID}" \
-keyout private/vpn-${ID}-key.pem -out x509/vpn-${ID}-cert.pem

openssl x509 -req -in x509/vpn-${ID}-cert.pem  -days 1095 \
-CA x509ca/server-root-ca.pem -CAkey private/server-root-key.pem -CAcreateserial \
-out x509/vpn-${ID}-cert.pem \
-extensions req_ext -extfile <(
cat <<EOF
[req_ext]
subjectAltName = DNS:${ID}
EOF
)

相关内容