☰

缺少 openssl 替代名称

tag-icon • tag-icon ssl ssl-certificate openssl ssl-certificate-errors
缺少 openssl 替代名称

我生成了 CA，用这个文章，并将其存储在我的机器中。现在，我想创建一个服务器证书并在我的网络服务器中使用它。这是我的生成服务器证书代码：

#!/bin/bash
# USE: ./build.sh <CERTNAME> <EXPR_DAYS>

openssl genrsa -out $1.key 2048

openssl req -new -key $1.key -out $1.csr -config ssl.config

openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256

此代码正在生成证书，但是它缺少指定的替代名称在我的ssl.config文件中：

[ req ]
default_bits        = 2048
default_keyfile     = server-key.pem
distinguished_name  = subject
req_extensions      = extensions
x509_extensions     = extensions
string_mask         = utf8only
prompt              = no

[ subject ]
countryName         = US
stateOrProvinceName = NY
localityName        = New York
organizationName    = Company
commonName          = API
emailAddress        = [email protected]

[ extensions ]
basicConstraints            = CA:TRUE
keyUsage                    = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectKeyIdentifier        = hash
extendedKeyUsage            = serverAuth
subjectAltName              = @alternate_names

[ alternate_names ]
IP.1=1.2.3.4
IP.2=2.3.4.5

为了确认缺少替代名称，我运行：

$ openssl x509 -in cert.pem -noout -text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            79:d5:7d:02:10:fb:2e:55:1c:19:7d:13:d8:e4:cb:ee:91:16:36:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Some-State, O = Company
        Validity
            Not Before: Oct 13 10:38:26 2019 GMT
            Not After : Feb 27 10:38:26 2047 GMT
        Subject: C = US, ST = NY, L = New York, O = Company, CN = API, emailAddress = [email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                        XXXX
                Exponent: XXXX (XXX)
    Signature Algorithm: sha256WithRSAEncryption
            XXXX

如您所见，缺少替代名称部分。我期望看到：

X509v3 Subject Alternative Name: IP:1.2.3.4, IP:2.3.4.5

我做错了什么？

答案1

找到问题了。

这：

openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256

变成了这样：

openssl x509 -req -in $1.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out $1.pem -days $2 -sha256 -extensions v3_req -extfile ssl.config

相关内容