Linux Nine Yin canon of nine yin Bones claw fragment 1 (encryption and security)

CAs and certificates

1. KPI: Public Key System

Visa agency: CA

Registration Authority: RA

Certificate Revocation list: CRL

Certificate Access Library

509: Defines the structure of the certificate and the standard version number of the authentication protocol
Serial number
Signature Algorithm principal public key
Issuer CRL Distribution Point
Expiry date Extension Information
Principal Name Issuer Signature

Certificate Type:
Certificate of the Certification authority
Server
User Certificate

There are two ways to obtain a certificate:
? using a Certificate Authority
Generate a signing request (CSR)
Send CSR to CA
Receive signatures from CA
? self-signed certificate
Self-issued own public key Security ProtocolsSsl:secure Socket layertls:transport Layer Security Features: Confidentiality, authentication, integrity, replay protection (resend username and password, cross site check, dangerous) HTTPS protocol: is "HTTP protocol" and "SS A combination of L/TLS protocol ".

OpenSSL

Three components:

OpenSSL: Encryption module application library, SSL and TLS implemented, packet NSS

Libcrypto: Cryptographic algorithm Library, package Openssl-libs

LIBSSL: Encryption module Application Library, the implementation of SSL and TLS, packet NSS

OpenSSL command

Two modes of operation: interactive mode and Batch mode

Standard command:
ENC, CA, req, ...

Symmetric encryption

Tools: Oopenssl Enc,

Algorithm: 3DES, AES, Blowfish, Twofish

ENC command

Help: Man Enc

encryption: OpenSSL enc-e-des3-a-salt-in testfile-out testfile.cipher

ENC (symmetric encryption)

-DES3 (encryption algorithm)

-A (base64 encoded with visible characters for easy viewing)

decryption: OpenSSL enc-d (decryption)-des3-a-salt-in testfile.cipher-out testfile

One-way encryption:
Tools: Md5sum, Sha1sum, sha224sum,sha256sum ...
OpenSSL dgst

Generate User Password

passwd command:

Help: Man sslpasswd

OpenSSL passwd-1 (encrypted with MD5)-salt (add salt, impurities, not easy to crack)

Generate random numbers

OpenSSL rand-base64 | -hex NUM

NUM: Represents the number of bytes;-hex, each character is 16 binary, equivalent to 4-bit binary, the number of characters that appear is num*2

OpenSSL rand-base64 9 (a multiple of 3 does not have to add the = sign), generating a random number, suitable for when the passwordOpenSSL rand-base | tr-dc ' [: alnum:] ' generates a 12-bit random password and leaves only numbers and letters

generate key Pair child

Generate private key(umask 066;openssl genrsa-out private.key 1024)

private key Encryption(umask 066;openssl genrsa-out private.key-des 1024)

generate public key (OpenSSL rsa-in private.key-pubout-out Public.key) decrypts the encrypted key extracting the public key from the private key

OpenSSL rsa-in privatekeyfile-pubout-out publickeyfile

OpenSSL rsa-in test.key-pubout-out test.key.pub

Create a CA and request a certificate

First, create a CA

1. The ROOT CA creates its own CA

Generate private key

Self-signed certificate

Second, user or server

1. Generate Private key

2. Generate Certificate Request file

3. Send application documents to CA

Third, the CA issued the certificate

Certificate signing

Iv. Certificate sent to client

V. Application software Certificate of Use

Example: Requesting a certificate from a CA

1. Build the root CA and generate the private key

[Email protected] ~ #cd/etc/pki/077; OpenSSL Genrsa-outprivate4096  Private4096long  modulus ..... ++................................................................................................................. ++ is65537 (0x10001)

2. Self-signed certificate

[Email protected]/ETC/PKI/CA#OPENSSL req-newprivate/cakey.pem-out3650  IS is default' . ' The field would be a left blank. -----

3. User server

(1) Generate private key

077; OpenSSL genrsa-out 1024x768private1024x768long  Modulus ..... ++++++................................................................................. ++++++is65537 (0x10001)

(2) Generate certificate request file

 [[email protected]/etc/pki/ca#openssl req-new -key app.key-out   App.csrcountry Name ( 2   letter code) [XX]:CN State or province name (full name) []:beijinglocality name (eg, city) [Default city]:beijingorganization name ( eg, company) [Default company ltd]:mageduorganizational Unit Name (eg, section) []:m30common name (eg, your name or your s erver   " s hostname) []:www.magedu.com  email Address []:P lease Enter the following    '  

(3) Send application documents to CA

The suffix name of the app.crt file on Windows is now changed to CER to open the certificate

4.CA Issue Certificate

(1)

[Email protected]/etc/pki/ca#touch Index.txt

(2)

[Email protected]/etc/pki/ca#echo 0F > serial

(3)

[Email protected]/etc/pki/ca#openssl CA-in  APP.CSR-offfrom/etc/ pki/tls/Openssl.cnfcheck that the request matches the signaturesignature OK

Linux Nine Yin canon of nine yin Bones claw fragment 1 (encryption and security)