好的,我正在尝试使用客户端证书来验证一个python客户端到Nginx服务器的身份。以下是我目前所做的尝试:
已创建本地CA
openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
已创建服务器密钥和证书
openssl genrsa -des3 -out server.key 1024
openssl rsa -in server.key -out server.key
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
使用类似的过程创建客户端密钥和证书
openssl genrsa -des3 -out client.key 1024
openssl rsa -in client.key -out client.key
openssl req -new -key client.key -out client.csr
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
将这些行添加到我的nginx配置中
server {
listen 443;
ssl on;
server_name dev.lightcloud.com;
keepalive_timeout 70;
access_log /usr/local/var/log/nginx/lightcloud.access.log;
error_log /usr/local/var/log/nginx/lightcloud.error.log;
ssl_certificate /Users/wombat/Lightcloud-Web/ssl/server.crt;
ssl_certificate_key /Users/wombat/Lightcloud-Web/ssl/server.key;
ssl_client_certificate /Users/wombat/Lightcloud-Web/ssl/ca.crt;
ssl_verify_client on;
location / {
uwsgi_pass unix:///tmp/uwsgi.socket;
include uwsgi_params;
}
}
已创建PEM客户端文件
cat client.crt client.key ca.crt > client.pem
创建了测试python脚本
import ssl
import http.client
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
context.load_verify_locations("ca.crt")
context.load_cert_chain("client.pem")
conn = http.client.HTTPSConnection("localhost", context=context)
conn.set_debuglevel(3)
conn.putrequest('GET', '/')
conn.endheaders()
response = conn.getresponse()
print(response.read())
现在我从服务器得到400 SSL证书错误。我做错了什么?
1条答案
按热度按时间nwo49xxi1#
看起来我的问题是我没有正确地创建CA,也没有以正确的方式签署密钥。CA证书需要签名,如果你假装是顶级CA,你自己签署你的CA证书。
然后使用ca命令对请求进行签名