golang實現(xiàn)openssl自簽名雙向認證的詳細步驟

更新時間：2024年03月04日 14:36:04 作者：赴前塵

這篇文章主要介紹了golang實現(xiàn)openssl自簽名雙向認證的詳細步驟,本文分步驟給大家介紹的非常詳細,對大家的學(xué)習(xí)或工作具有一定的參考借鑒價值,需要的朋友參考下吧

第一步：生成CA、服務(wù)端、客戶端證書

1. 生成CA根證書生成CA證書私鑰

openssl genrsa -out ca.key 4096

創(chuàng)建ca.conf 文件

[ req ]
default_bits       = 4096
distinguished_name = req_distinguished_name
[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = JiangSu
localityName                = Locality Name (eg, city)
localityName_default        = NanJing
organizationName            = Organization Name (eg, company)
organizationName_default    = Sheld
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = localhost

生成根證書簽發(fā)申請文件(csr文件)

openssl req \
  -new \
  -sha256 \
  -out ca.csr \
  -key ca.key \
  -config ca.conf

生成自簽發(fā)根證書(crt文件)

openssl x509 \
    -req \
    -days 3650 \
    -in ca.csr \
    -signkey ca.key \
    -out ca.pem

2. 生成服務(wù)端證書

生成服務(wù)端私鑰

openssl genrsa -out server.key 2048

創(chuàng)建 server.conf 文件

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext
[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = JiangSu
localityName                = Locality Name (eg, city)
localityName_default        = NanJing
organizationName            = Organization Name (eg, company)
organizationName_default    = Sheld
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = localhost    # 此處尤為重要，需要用該服務(wù)名字填寫到客戶端的代碼中
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1   = localhost
IP.1      = 127.0.0.1

生成服務(wù)端簽發(fā)申請文件(csr文件)

openssl req \
  -new \
  -sha256 \
  -out server.csr \
  -key server.key \
  -config server.conf

使用CA證書簽署服務(wù)器證書

openssl genrsa -out client.key 2048

3. 生成客戶端證書

生成客戶端私鑰

openssl genrsa -out client.key 2048

創(chuàng)建 client.conf 文件

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = JiangSu
localityName                = Locality Name (eg, city)
localityName_default        = NanJing
organizationName            = Organization Name (eg, company)
organizationName_default    = Sheld
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = localhost

生成客戶端端簽發(fā)申請文件(csr文件)

openssl req \
  -new \
  -sha256 \
  -out client.csr \
  -key client.key \
  -config client.conf

使用CA證書簽署客戶端器證書

openssl x509 \
    -req \
    -days 3650 \
    -CA ca.pem \
    -CAkey ca.key \
    -CAcreateserial \
    -in client.csr \
    -out client.pem

第二步：golang 服務(wù)端、客戶端代碼編寫

1. 項目目錄結(jié)構(gòu)

在這里插入圖片描述

2. 服務(wù)端代碼：server.go

package main
import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"net/http"
	"os"
)
type MyHandler struct {
}
func (h *MyHandler) ServeHTTP(w http.ResponseWriter,
	r *http.Request) {
	fmt.Fprint(w, "Hello, HTTPS!")
}
func main() {
	pool := x509.NewCertPool() // 創(chuàng)建證書池
	caCertPath := "./cert/ca.pem"
	caCrt, err := os.ReadFile(caCertPath) // 讀取本地CA證書文件
	if err != nil {
		fmt.Println("ReadFile err:", err)
		return
	}
	pool.AppendCertsFromPEM(caCrt) // 將證書添加到證書池中
	s := &http.Server{ // 創(chuàng)建 HTTP服務(wù)器實例，并設(shè)置服務(wù)器的監(jiān)聽地址（本例中是127.0.0.1:8088）、處理器（即上面定義的myhandler結(jié)構(gòu)體）、以及TLS配置。
		Addr:    "127.0.0.1:8088",
		Handler: &MyHandler{},
		TLSConfig: &tls.Config{
			ClientCAs:  pool,                           // 指定客戶端需要驗證的CA證書池（即上面創(chuàng)建的pool）
			ClientAuth: tls.RequireAndVerifyClientCert, // 要求客戶端在發(fā)送請求時必須攜帶證書
		},
	}
	err = s.ListenAndServeTLS("./cert/server.pem", "./cert/server.key")
	if err != nil {
		fmt.Println("ListenAndServeTLS err:", err)
	}
}

3. 客戶端代碼：client.go

package main
import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"io"
	"net/http"
	"os"
)
func main() {
	pool := x509.NewCertPool()    // 創(chuàng)建 x509.CertPool，用于存儲CA證書
	caCertPath := "./cert/ca.pem" // 從文件中讀取CA證書的內(nèi)容
	caCrt, err := os.ReadFile(caCertPath)
	if err != nil {
		fmt.Println("ReadFile err:", err)
		return
	}
	pool.AppendCertsFromPEM(caCrt)                                               // 將CA證書添加到CertPool中
	cliCrt, err := tls.LoadX509KeyPair("./cert/client.pem", "./cert/client.key") //加載客戶端證書和私鑰
	if err != nil {
		fmt.Println("Loadx509keypair err:", err)
		return
	}
	tr := &http.Transport{ // 創(chuàng)建一個http.Transport，并配置TLS相關(guān)信息
		TLSClientConfig: &tls.Config{
			RootCAs:      pool,                      // 設(shè)置根證書池
			Certificates: []tls.Certificate{cliCrt}, // 設(shè)置客戶端證書和私鑰
		},
	}
	client := &http.Client{Transport: tr}             // 創(chuàng)建一個http.Client，并設(shè)置Transport為上面創(chuàng)建的Transport對象
	resp, err := client.Get("https://127.0.0.1:8088") // 使用創(chuàng)建的Client發(fā)送GET請求
	if err != nil {
		fmt.Println("Http Get error:", err)
		return
	}
	defer resp.Body.Close()
	body, err := io.ReadAll(resp.Body) // 讀取并打印響應(yīng)體的內(nèi)容
	fmt.Println(string(body))
}