SSL/TLS 证书
概述
证书申请、配置、自动续期技能。
OpenSSL 基础
生成私钥
RSA 私钥
openssl genrsa -out private.key 2048 openssl genrsa -out private.key 4096
带密码保护
openssl genrsa -aes256 -out private.key 2048
ECDSA 私钥
openssl ecparam -genkey -name prime256v1 -out private.key
生成 CSR
交互式
openssl req -new -key private.key -out request.csr
非交互式
openssl req -new -key private.key -out request.csr
-subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=example.com"
带 SAN
openssl req -new -key private.key -out request.csr
-config <(cat <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
[req_distinguished_name] CN = example.com
[v3_req] subjectAltName = @alt_names
[alt_names] DNS.1 = example.com DNS.2 = www.example.com DNS.3 = api.example.com EOF )
自签名证书
一步生成
openssl req -x509 -nodes -days 365 -newkey rsa:2048
-keyout private.key -out certificate.crt
-subj "/CN=example.com"
从已有私钥
openssl req -x509 -key private.key -days 365 -out certificate.crt
查看证书
查看证书信息
openssl x509 -in certificate.crt -text -noout
查看 CSR
openssl req -in request.csr -text -noout
查看私钥
openssl rsa -in private.key -text -noout
验证证书链
openssl verify -CAfile ca.crt certificate.crt
检查远程证书
openssl s_client -connect example.com:443 -servername example.com
格式转换
PEM 转 DER
openssl x509 -in cert.pem -outform DER -out cert.der
DER 转 PEM
openssl x509 -in cert.der -inform DER -out cert.pem
PEM 转 PKCS12
openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pem
PKCS12 转 PEM
openssl pkcs12 -in cert.p12 -out cert.pem -nodes
Let's Encrypt
Certbot 安装
Debian/Ubuntu
apt install certbot python3-certbot-nginx
CentOS/RHEL
yum install certbot python3-certbot-nginx
申请证书
Nginx 插件
certbot --nginx -d example.com -d www.example.com
Apache 插件
certbot --apache -d example.com
Standalone
certbot certonly --standalone -d example.com
Webroot
certbot certonly --webroot -w /var/www/html -d example.com
DNS 验证（通配符）
certbot certonly --manual --preferred-challenges dns -d "*.example.com"
管理证书
查看证书
certbot certificates
续期测试
certbot renew --dry-run
手动续期
certbot renew
删除证书
certbot delete --cert-name example.com
自动续期
Cron
0 0 * * * certbot renew --quiet
Systemd timer
systemctl enable certbot.timer systemctl start certbot.timer
Nginx 配置
基础 HTTPS
server { listen 443 ssl http2; server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
}
HTTP 重定向
server { listen 80; server_name example.com; return 301 https://$server_name$request_uri; }
安全加固
ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off;
ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s;
add_header Strict-Transport-Security "max-age=63072000" always;
常见场景
场景 1：创建 CA
生成 CA 私钥
openssl genrsa -out ca.key 4096
生成 CA 证书
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650
-out ca.crt -subj "/CN=My CA"
签发证书
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key
-CAcreateserial -out server.crt -days 365 -sha256
场景 2：检查证书过期
#!/bin/bash DOMAIN=$1 DAYS=30
EXPIRY=$(echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null |
openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s) NOW_EPOCH=$(date +%s) DIFF=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
if [ $DIFF -lt $DAYS ]; then echo "WARNING: ${DOMAIN} 证书将在 ${DIFF} 天后过期" fi
场景 3：批量续期
#!/bin/bash certbot renew --deploy-hook "systemctl reload nginx"
故障排查
问题 排查方法
证书不信任 检查证书链、CA
域名不匹配 检查 CN、SAN
证书过期 检查有效期、续期
握手失败 检查协议、密码套件
测试 SSL
openssl s_client -connect example.com:443
检查证书链
openssl s_client -connect example.com:443 -showcerts
SSL Labs 测试
curl https://api.ssllabs.com/api/v3/analyze?host=example.com