1
Certificate:
2
    Data:
3
        Version: 3 (0x2)
4
        Serial Number:
5
            0e:8b:7d:1a:3b:...:a1
6
        Signature Algorithm: sha256WithRSAEncryption
7
        Issuer: C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
8
        Validity
9
            Not Before: Mar  7 00:00:00 2024 GMT
10
            Not After : Mar  7 23:59:59 2025 GMT
11
        Subject: C = US, ST = California, O = GitHub, Inc., CN = github.com
12
        Subject Public Key Info:
13
            Public Key Algorithm: rsaEncryption
14
                RSA Public-Key: (2048 bit)
15
        X509v3 extensions:
16
            X509v3 Key Usage: critical
17
                Digital Signature, Key Encipherment
18
            X509v3 Extended Key Usage:
19
                TLS Web Server Authentication
20
            X509v3 Subject Alternative Name:
21
                DNS:github.com, DNS:www.github.com
22
            Authority Information Access:
23
                OCSP - URI:http://ocsp.digicert.com
24
                CA Issuers - URI:http://cacerts.digicert.com/...
25
            X509v3 CRL Distribution Points:
26
                Full Name:
27
                  URI:http://crl3.digicert.com/...crl
28
    Signature Algorithm: sha256WithRSAEncryption
29
         4a:3b:1c:...:f2

1
from cryptography import x509
2
from cryptography.hazmat.primitives import hashes
3
from cryptography.hazmat.primitives.asymmetric import rsa, padding
4
from cryptography.x509.oid import NameOID
5
import datetime
6
def verify_cert_chain(leaf_cert, intermediate_cert, root_cert):
7
    """验证证书链：leaf → intermediate → root"""
8
    now = datetime.datetime.now(datetime.timezone.utc)
9
    for cert in [leaf_cert, intermediate_cert, root_cert]:
10
        if now < cert.not_valid_before_utc or now > cert.not_valid_after_utc:
11
            raise ValueError(f"证书过期: {cert.subject}")
12
    intermediate_cert.public_key().verify(
13
        leaf_cert.signature,
14
        leaf_cert.tbs_certificate_bytes,
15
        padding.PKCS1v15(),
16
        leaf_cert.signature_hash_algorithm,
17
    )
18
    root_cert.public_key().verify(
19
        intermediate_cert.signature,
20
        intermediate_cert.tbs_certificate_bytes,
21
        padding.PKCS1v15(),
22
        intermediate_cert.signature_hash_algorithm,
23
    )
24
    if root_cert.issuer != root_cert.subject:
25
        raise ValueError("根证书不是自签名")
26
    print("证书链验证通过")

1
openssl req -newkey rsa:2048 -keyout private.key -out request.csr \
2
  -subj "/C=CN/ST=Beijing/O=MyOrg/CN=example.com"
3
openssl ecparam -name prime256v1 -genkey -noout -out private.key
4
openssl req -new -key private.key -out request.csr \
5
  -subj "/C=CN/ST=Beijing/O=MyOrg/CN=example.com"
6
cat > san.cnf << 'EOF'
7
[req]
8
distinguished_name = req_distinguished_name
9
req_extensions = v3_req
10
[req_distinguished_name]
11
CN = example.com
12
[v3_req]
13
subjectAltName = @alt_names
14
[alt_names]
15
DNS.1 = example.com
16
DNS.2 = www.example.com
17
DNS.3 = *.example.com
18
EOF
19
openssl req -new -key private.key -out request.csr -config san.cnf
20
openssl req -in request.csr -text -noout

1
Certificate Revocation List (CRL):
2
    Version: 2
3
    Issuer: C = US, O = DigiCert Inc, CN = DigiCert SHA2
4
    Last Update: Mar 15 00:00:00 2024 GMT
5
    Next Update: Mar 22 00:00:00 2024 GMT
6
    Revoked Certificates:
7
        Serial Number: 0E8B7D1A3B...A1
8
            Revocation Date: Mar 10 00:00:00 2024 GMT
9
        Serial Number: A1B2C3D4E5...F6
10
            Revocation Date: Mar 12 00:00:00 2024 GMT

1
echo | openssl s_client -connect github.com:443 -showcerts 2>/dev/null \
2
  | awk '/BEGIN CERT/,/END CERT/' > certs.pem
3
csplit -s -z certs.pem '/-----BEGIN CERTIFICATE-----/' '{1}'
4
openssl ocsp -issuer xx01 -cert xx00 \
5
  -url http://ocsp.digicert.com \
6
  -resp_text

1
sudo certbot certonly --nginx -d example.com -d www.example.com
2
sudo certbot certonly --standalone -d example.com
3
sudo certbot certonly --dns-cloudflare \
4
  -d example.com -d '*.example.com' \
5
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
6
sudo certbot certonly --manual --preferred-challenges dns \
7
  -d example.com -d '*.example.com'

1
sudo certbot renew --quiet

1
import josepy as jose
2
from cryptography.hazmat.primitives.asymmetric import ec
3
from cryptography.hazmat.primitives import serialization
4
from acme import client, messages
5
private_key = ec.generate_private_key(ec.SECP256R1())
6
key = jose.JWKRSA(key=private_key)  # 简化示例
7
net = client.ClientNetwork(key, account=None)
8
directory = messages.Directory.from_json(net.get(
9
    "https://acme-v02.api.letsencrypt.org/directory"
10
).json())
11
client_acme = client.ClientV2(directory, net=net)
12
registration = client_acme.new_account(
13
    messages.NewRegistration.from_data(
14
        email="admin@example.com",
15
        terms_of_service_agreed=True,
16
    )
17
)
18
print(f"账户注册成功: {registration.uri}")

1
// Go: 使用 lego 库自动化证书管理
2
// go get github.com/go-acme/lego/v4
3
package main
4
import (
5
    "fmt"
6
    "log"
7
    "os"
8
    "github.com/go-acme/lego/v4/certificate"
9
    "github.com/go-acme/lego/v4/lego"
10
    "github.com/go-acme/lego/v4/registration"
11
)
12
type MyUser struct {
13
    Email        string
14
    Registration *registration.Resource
15
    key          crypto.PrivateKey
16
}
17
func (u *MyUser) GetEmail() string                { return u.Email }
18
func (u *MyUser) GetRegistration() *registration.Resource { return u.Registration }
19
func (u *MyUser) GetPrivateKey() crypto.PrivateKey { return u.key }
20
func main() {
21
    // 创建用户和配置
22
    privateKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
23
    myUser := MyUser{
24
        Email: "admin@example.com",
25
        key:   privateKey,
26
    }
27
    config := lego.NewConfig(&myUser)
28
    config.CADirURL = lego.LEDirectoryProduction
29
    client, err := lego.NewClient(config)
30
    if err != nil {
31
        log.Fatal(err)
32
    }
33
    // 注册账户
34
    reg, err := client.Registration.Register(
35
        registration.RegisterOptions{TermsOfServiceAgreed: true},
36
    )
37
    myUser.Registration = reg
38
    // 获取证书
39
    request := certificate.ObtainRequest{
40
        Domains: []string{"example.com", "*.example.com"},
41
        Bundle:  true,
42
    }
43
    certificates, err := client.Certificate.Obtain(request)
44
    if err != nil {
45
        log.Fatal(err)
46
    }
47
    fmt.Printf("证书获取成功: %s\n", certificates.Domain)
48
}

1
ls /etc/ssl/certs/ | wc -l
2
openssl x509 -in /etc/ssl/certs/DigiCert_Global_Root_CA.pem -text -noout | head -20
3
sudo cp my-company-ca.pem /usr/local/share/ca-certificates/
4
sudo update-ca-certificates
5
sudo rm /usr/local/share/ca-certificates/my-company-ca.crt
6
sudo update-ca-certificates --fresh

1
<!-- Android: Network Security Config (推荐) -->
2
<?xml version="1.0" encoding="utf-8"?>
3
<network-security-config>
4
    <domain-config>
5
        <domain includeSubdomains="true">example.com</domain>
6
        <pin-set>
7
            <!-- 主公钥固定 -->
8
            <pin digest="SHA-256">base64EncodedHash==</pin>
9
            <!-- 备份公钥固定（防止主密钥丢失导致应用无法连接） -->
10
            <pin digest="SHA-256">backupBase64EncodedHash==</pin>
11
        </pin-set>
12
    </domain-config>
13
</network-security-config>

1
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
2
  | openssl x509 -text -noout
3
echo | openssl s_client -connect example.com:443 2>/dev/null \
4
  | openssl x509 -noout -dates
5
echo | openssl s_client -connect example.com:443 2>/dev/null \
6
  | openssl x509 -noout -ext subjectAltName
7
echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null
8
echo | openssl s_client -connect example.com:443 2>/dev/null \
9
  | openssl x509 -out remote-cert.pem
10
openssl ocsp -issuer intermediate.pem -cert leaf.pem \
11
  -url http://ocsp.digicert.com -resp_text

1
openssl req -newkey rsa:2048 -nodes \
2
  -keyout example.key -out example.csr \
3
  -subj "/C=CN/ST=Beijing/L=Beijing/O=MyOrg/CN=example.com"
4
openssl ecparam -name prime256v1 -genkey -noout -out example.key
5
openssl req -new -key example.key -out example.csr \
6
  -subj "/C=CN/ST=Beijing/L=Beijing/O=MyOrg/CN=example.com"
7
cat > san.cnf << 'EOF'
8
[req]
9
distinguished_name = dn
10
req_extensions = v3_req
11
prompt = no
12
[dn]
13
C = CN
14
ST = Beijing
15
O = MyOrg
16
CN = example.com
17
[v3_req]
18
subjectAltName = @alt_names
19
[alt_names]
20
DNS.1 = example.com
21
DNS.2 = www.example.com
22
DNS.3 = api.example.com
23
IP.1 = 192.168.1.1
24
EOF
25
openssl req -new -key example.key -out example.csr -config san.cnf
26
openssl req -in example.csr -verify -noout
27
openssl req -in example.csr -text -noout

1
openssl req -x509 -new -nodes \
2
  -newkey rsa:2048 -keyout ca.key \
3
  -sha256 -days 3650 \
4
  -out ca.crt \
5
  -subj "/C=CN/ST=Beijing/O=DevCA/CN=Development Root CA"
6
openssl ecparam -name prime256v1 -genkey -noout -out server.key
7
openssl req -new -key server.key -out server.csr \
8
  -subj "/C=CN/ST=Beijing/O=DevOrg/CN=localhost"
9
cat > server-ext.cnf << 'EOF'
10
basicConstraints = CA:FALSE
11
keyUsage = digitalSignature, keyEncipherment
12
extendedKeyUsage = serverAuth
13
subjectAltName = @alt_names
14
[alt_names]
15
DNS.1 = localhost
16
DNS.2 = *.localhost
17
IP.1 = 127.0.0.1
18
EOF
19
openssl x509 -req -in server.csr \
20
  -CA ca.crt -CAkey ca.key -CAcreateserial \
21
  -out server.crt -days 365 -sha256 \
22
  -extfile server-ext.cnf
23
openssl verify -CAfile ca.crt server.crt

1
check_cert() {
2
    local host="$1"
3
    echo "=== 证书检查: $host ==="
4
    cert=$(echo | openssl s_client -connect "$host:443" -servername "$host" 2>/dev/null)
5
    echo "$cert" | openssl x509 -noout -dates 2>/dev/null || echo "无法获取证书"
6
    echo "SAN:"
7
    echo "$cert" | openssl x509 -noout -ext subjectAltName 2>/dev/null || echo "无 SAN"
8
    echo "签名算法:"
9
    echo "$cert" | openssl x509 -noout -text 2>/dev/null | grep "Signature Algorithm" | head -1
10
    echo "OCSP Stapling:"
11
    echo "$cert" | openssl s_client -connect "$host:443" -status 2>/dev/null | grep "OCSP response"
12
    echo "---"
13
}
14
check_cert github.com
15
check_cert google.com

1
# 1. 生成 Root CA 私钥（RSA-2048）
2
openssl genrsa -out root-ca.key 2048
3

4
# 2. 创建自签名根证书（有效期 10 年）
5
openssl req -x509 -new -nodes \
6
  -key root-ca.key -sha256 -days 3650 \
7
  -out root-ca.crt \
8
  -subj "/C=CN/ST=Beijing/O=PKI Lab/CN=PKI Lab Root CA"
9

10
# 3. 查看根证书信息
11
openssl x509 -in root-ca.crt -noout -subject -issuer -dates

1
subject=C = CN, ST = Beijing, O = PKI Lab, CN = PKI Lab Root CA
2
issuer=C = CN, ST = Beijing, O = PKI Lab, CN = PKI Lab Root CA
3
notBefore=May  7 14:31:29 2026 GMT
4
notAfter=May  4 14:31:29 2036 GMT

1
# 1. 生成中间 CA 私钥
2
openssl genrsa -out int-ca.key 2048
3

4
# 2. 创建中间 CA 的 CSR（证书签名请求）
5
openssl req -new -key int-ca.key -out int-ca.csr \
6
  -subj "/C=CN/ST=Beijing/O=PKI Lab/CN=PKI Lab Intermediate CA"
7

8
# 3. 用 Root CA 签发中间 CA 证书（需要扩展配置）
9
cat > int-ca.ext << 'EOF'
10
basicConstraints = critical, CA:TRUE, pathlen:0
11
keyUsage = critical, digitalSignature, keyCertSign, cRLSign
12
subjectKeyIdentifier = hash
13
authorityKeyIdentifier = keyid:always, issuer
14
EOF
15

16
openssl x509 -req -in int-ca.csr \
17
  -CA root-ca.crt -CAkey root-ca.key -CAcreateserial \
18
  -out int-ca.crt -days 1825 -sha256 \
19
  -extfile int-ca.ext
20

21
# 4. 查看中间 CA 证书
22
openssl x509 -in int-ca.crt -noout -subject -issuer

1
Certificate request self-signature ok
2
subject=C = CN, ST = Beijing, O = PKI Lab, CN =PKI Lab Intermediate CA
3
subject=C = CN, ST = Beijing, O = PKI Lab, CN = PKI Lab Intermediate CA
4
issuer=C = CN, ST = Beijing, O = PKI Lab, CN = PKI Lab Root CA

1
# 1. 生成 ECC 私钥（P-256 曲线）
2
openssl ecparam -name prime256v1 -genkey -noout -out server.key
3

4
# 2. 创建终端证书 CSR
5
openssl req -new -key server.key -out server.csr \
6
  -subj "/C=CN/ST=Beijing/O=PKI Lab/CN=server.pkilab.local"
7

8
# 3. 用中间 CA 签发终端证书（含 SAN 扩展）
9
cat > server.ext << 'EOF'
10
basicConstraints = CA:FALSE
11
keyUsage = critical, digitalSignature, keyEncipherment
12
extendedKeyUsage = serverAuth
13
subjectKeyIdentifier = hash
14
authorityKeyIdentifier = keyid:always, issuer
15
subjectAltName = DNS:server.pkilab.local, DNS:*.pkilab.local, IP:127.0.0.1
16
EOF
17

18
openssl x509 -req -in server.csr \
19
  -CA int-ca.crt -CAkey int-ca.key -CAcreateserial \
20
  -out server.crt -days 365 -sha256 \
21
  -extfile server.ext
22

23
# 4. 查看终端证书
24
openssl x509 -in server.crt -noout -subject -issuer -dates

1
Certificate request self-signature ok
2
subject=C = CN, ST = Beijing, O = PKI Lab, CN = server.pkilab.local
3
issuer=C = CN, ST = Beijing, O = PKI Lab, CN = PKI Lab Intermediate CA
4
notBefore=May  7 14:31:29 2026 GMT
5
notAfter=May  7 14:31:29 2027 GMT

1
# 验证终端证书（指定 Root CA 和中间 CA）
2
openssl verify -CAfile root-ca.crt -untrusted int-ca.crt server.crt

1
server.crt: OK

1
# 1. 初始化 CA 数据库
2
touch index.txt
3
echo "01" > serial.txt
4
echo "01" > crlnumber.txt
5

6
# 2. 生成空的 CRL
7
cat > ca.cnf << 'EOF'
8
[ca]
9
default_ca = CA_default
10
[CA_default]
11
database = index.txt
12
serial = serial.txt
13
crlnumber = crlnumber.txt
14
default_crl_days = 365
15
default_md = sha256
16
EOF
17

18
openssl ca -gencrl -keyfile root-ca.key -cert root-ca.crt \
19
  -out root-ca.crl -config ca.cnf
20

21
# 3. 查看 CRL 内容
22
openssl crl -in root-ca.crl -text -noout | head -10

1
Certificate Revocation List (CRL):
2
        Version 2 (0x1)
3
        Signature Algorithm: sha256WithRSAEncryption
4
        Issuer: C = CN, ST = Beijing, O = PKI Lab, CN = PKI Lab Root CA
5
        Last Update: May  7 14:31:29 2026 GMT
6
        Next Update: May  7 14:31:29 2027 GMT
7
        CRL extensions:
8
            X509v3 CRL Number:
9
                1
10
No Revoked Certificates.