Openssl+http Implementing HTTPS

OpenSSL detailed and implementation Httpsopenssl detailed and implementation of HTTPS

OpenSSL is a Secure Sockets Layer cipher library that includes key cryptographic algorithms, common key and certificate encapsulation management functions, and SSL protocols, and provides a rich set of applications for testing or other purposes.

Secret key algorithms and protocols:

• Symmetric encryption:
  Encryption and decryption using the same key, the original data into a fixed size block, the algorithm is different
  Too many keys, difficult to distribute secret keys
  Des,3des AES Blowfish twofish idea RC6 CAST5

• Public Key cryptography:
  Split public and private keys
  Public key: Extracted from the private key and can be made public to all; PubKey
  Private key: Created by the tool, the user retains his or her privacy; secret key
  Digital signature: (private key encrypted signature) The receiver confirms the sender's identity
  Secret to Exchange: The sender encrypts a symmetric key with the other's public key to send to the other party
  Data encryption: Less common public key for data encryption slow, RSA,DSA

  Sender:

  Receiving Party:

1. Decrypt the symmetric key with your own private key

2. Decrypt entire data with symmetric keys-confidentiality

3. Decrypting a signature with the sender's public key – verifying the sender's identity

4. Compute signatures compared to received signatures – ensuring data integrity
   There may be middlemen. To reliably get the other public key: CA

1. Calculate the signature of the data

2. Encrypt this code with your own private key

3. Generates a temporary symmetric key (one-time) that encrypts the entire segment of data (including encrypted signatures)

4. Encrypt temporary symmetric key with receiver's public key appended to data

One-way encryption: Extract data fingerprint, can only encrypt cannot decrypt fixed-length output, avalanche effect guaranteed data integrity algorithm: MD5 fixed 128-bit output SHA1 160,224,256,384,512

Secret Exchange: public key exchange
DH: It is very difficult to use the result of the high-order of the known large prime number to reverse the second order
Negotiate generate P,g native build x, send the results of p^x%g
Receiver native Generation Y (p^x%g) ^y each other (p^y%g) x Results the same
RSA ECDH ECDHE

Pki:public Key Infrastructure

• Visa agency: CA (Certificate authority)
  Registration Authority: RA
  Certificate Revocation list: CRL
  Certificate Access Library:

The structure of the certificate and the standard of the authentication protocol are defined

• Version number
  Serial number
  Signature Algorithm
  Issued by
  Validity period
  Principal Name
  Principal public key
  CRL Distribution Points
  Extended information
  Issuer Signature

SSL: Secure Socket Layer
TLS: Transport Layer Security

Data privacy
Data integrity
Security verification

OpenSSL: Open source project, three components

• OpenSSL: Multi-purpose command-line tools

• Libcrypto: Cryptographic Algorithm Library

• LIBSSL: Encryption module application library for SSL and TLS

# OpenSSL
Standard commands, Message digest commands, cryptographic commands

openssl enc
    -e：加密
    -d：解密
    -a：文本编码格式
    -salt：盐
    -in：要处理的文件
    -out：要输出的文件
]# openssl enc -e -rc4 -a -salt -in fstab -out fstab.en 加密

One-way encryption: Calculating signatures

FILE


FILE
FILE   md5加密

Generate User password:

openssl passwd -1 -salt SALT

Generate random Number:

rand [base64|hex#
    base64：
    hex：16进制编码
    #:长度
]# openssl rand -base64 10  使用时去掉尾部两个“==”
GyA/hYBNH20RAQ==

Https:http+openssl

Environment:
Web:centos 6.8,10.1.235.6
Ca:centos 7,10.1.235.7
Shutting down firewalls and SELinux

CentOS 7,10.1.235.7:
To establish a private CA:

Generate private key: Specify location
]# (Umask 077; OpenSSL genrsa-out/etc/pki/ca/private/cakey.pem 4096)
Generate Word Visa form:
]# OpenSSL req-new-x509-key/etc/pki/ca/private/cakey.pem-out/etc/pki/ca/cacert.pem-days 3650 
-new: Generate a new certificate signing request
-x509: Generate a self-signed format certificate for creating a private CA, other cases without
-key: The private key path used to generate the request
-out: The generated request file path, if the self-signed operation will generate a signed certificate directly
-days: The valid duration of the certificate
...
CountryName(2Letter code) [XX]:CN
StateorProvinceName(Fullname) []:beijing
LocalityName(eg, city) [DefaultCity]:beijing
OrganizationName(eg, company) [DefaultCompany Ltd]:class
Organizational UnitName(eg, section) []:ops
CommonName(Eg, yourname orYour server' s hostname) []:www.zjj.com
Email Address []:

Create the required files:
]# Touch/etc/pki/ca/{serial,index.txt}
]# echo >/etc/pki/ca/serial

CentOS 6.8,10.1.235.6:
Install the Configure HTTP service:

安装http及mod_ssl模块
]# yum install httpd mod_ssl
]# vi /etc/httpd/conf/httpd.conf
#ServerName www.example.com:80
取消注释更改 ServerName www.zjj.com:80

"/var/www/html"
#DocumentRoot "/var/www/html"
保存退出

To generate a certificate request:

]#mkdir/etc/httpd/SSL
]#CD/etc/httpd/SSL

Generate private key:
]# (umask077; OpenSSL genrsa-out Httpd.key2048)

To generate a certificate request:
]#OpenSSL req -new -key httpd. Key -out httpd. CSR
... Fill in the relevant content
Country Name(2Letter code)[XX]: CN
 State or Province Name(Full name)[]: Beijing
Locality Name(eg, city)[Default City]: Beijing
Organization Name(eg, company)[Default company LTD]: Class 
Organizational Unit Name(eg, section)[]: Ops
Common Name(eg, your name or your server ' s hostname)[]: www. Eva. com
Email Address []:
...

Send a request toCAHost:
]#SCP.. /SSL/httpd. CSRTen. 1. 235. 7:/

7，10.1.235.54
]# openssl  ca -in httpd.csr -out httpd.crt -days 365
    将证书发送至Web主机
]# scp httpd.crt  10.1.235.6:/etc/httpd/ssl

Web host configuration SSL, locate the following two lines, change the corresponding certificate and private key file:

]# vi /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

在虚拟主机标签内添加：
Documentroot /virtual
<Directory /virtual>
    Options None
    AllowOverRide None
</Directory>

]# mkdir /vitual
]# vi /virtual/index.html   创建首页文件
<center>from10.1.235.6</center>

Test:

在/etc/hosts文件中添加一条域名解析
10.1.235.6  www.eva.com

7上指定证书访问：未指定证书访问https会报错
/etc/pki/CA/cacert.pem https://www.eva.com
from10.1.235.6</center>

You can import a certificate as a trusted root certificate in Windows

This article is from the "mediocre" blog, please be sure to keep this source http://zzjasper.blog.51cto.com/9781564/1864578

Openssl+http Implementing HTTPS