背景
由於ios將在2017年1月1日起強制實施ATS安全策略，所有通訊必須使用https傳輸，本文只針對自制證書，但目前尚不確定自制證書是否能通過appstore審核。
1、必須支持傳輸層安全(TLS)協議1.2以上版本
2、證書必須使用SHA256或更高的哈希算法簽名
3、必須使用2048位以上RSA密鑰或256位以上ECC算法等等
4、證書必須是V3版本
以上是幾個注意點。主要針對ios的ATS策略
環境
linux: CentOS6.8
tomcat: Apache Tomcat/7.0.63
OpenSSL: OpenSSL 1.1.0c
OpenSSL升級(如果需要)
我使用的是阿里雲服務器，linux自帶OpenSSL，只需要做一次升級，關於全新安裝請自行搜索。
1.查看版本 openssl version -a 2.更新zlib yum install -y zlib 3.下載(注意cd到自己需要的路徑下) wget https://www.openssl.org/source/openssl-1.1.0c.tar.gz 4.解壓安裝 tar zxf openssl-1.1.0c.tar.gz cd openssl-1.1.0c ./config --prefix=/usr/local/openssl make make install //重命名原來的openssl mv /usr/bin/openssl /usr/bin/openssl.ori mv /usr/include/openssl /usr/include/openssl.ori
執行上面一個命令的時候可能會報錯，如下，我暫時沒管他好像也沒影響。后來又發現把下面的步驟執行完后，再執行mv /usr/include/openssl /usr/include/openssl.ori
是可以成功的，但是是不是必須把下面執行完后再執行一次上面語句沒有驗證過（再執行一次對后面生成證書沒影響）[root@localhost openssl-1.1.0c]# mv /usr/include/openssl /usr/include/openssl.ori
mv: 無法獲取"/usr/include/openssl" 的文件狀態(stat): 沒有那個文件或目錄
//將安裝好的openssl命令軟連到對應位置 ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl ln -s /usr/local/openssl/include/openssl /usr/include/openssl //在/etc/ld.so.conf文件中寫入openssl庫文件的搜索路徑 echo /usr/local/openssl/lib >> /etc/ld.so.conf ldconfig -v openssl version -a
由於chrome必須要添加subjectAltName才能導入證書生效，不然會報錯ERR_CERT_COMMON_NAME_INVALID
所以必須進入/usr/local/openssl/ssl/openssl.cnf
把req_extensions這個注釋放開
req_extensions = v3_req # The extensions to add to a certificate request
然后添加如下內容[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = kb.example.com
DNS.2 = helpdesk.example.org
DNS.3 = systems.example.net
IP.1 = 192.168.0.100
IP.2 = 192.168.0.168
IP.3 = 192.168.0.169
IP.4 = 192.168.0.106
創建證書目錄
//進入tmp目錄 cd /tmp //創建ca目錄，存放證書相關文件 mkdir ca //進入ca cd ca 制作根證書
1. 創建根證書密鑰文件(自己做CA) root.key openssl genrsa -des3 -out root.key 2048 輸出內容為:
Generating RSA private key, 2048 bit long modulus .....................................................................................................................+++ ..........................+++ e is 65537 (0x010001) Enter pass phrase for root.key: ← 輸入一個新密碼 Verifying – Enter pass phrase for root.key: ← 重新輸入一遍密碼 2. 創建根證書的申請文件 root.csr openssl req -new -key root.key -out root.csr 輸出內容為:
Enter pass phrase for root.key: ← 輸入前面創建的密碼 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank. —– Country Name (2 letter code) [AU]:US ← 國家代號，美國輸入US State or Province Name (full name) [Some-State]:Houston ← 省的全名，拼音 Locality Name (eg, city) []:Houston ← 市的全名，拼音 Organization Name (eg, company) [Internet Widgits Pty Ltd]: hp ← 公司英文名 Organizational Unit Name (eg, section) []: hp← 可以不輸入 我輸入的公司名稱 Common Name (eg, YOUR name) []: ← 此時不輸入,和后面的需要輸入ip或者域名不一樣，這里不能輸入，輸入了好像證書有問題 Email Address []:admin@hp.com ← 電子郵箱，可隨意填 Please enter the following ‘extra’ attributes to be sent with your certificate request A challenge password []: ← 可以不輸入 An optional company name []: ← 可以不輸入 3. 創建一個自當前日期起為期十年的根證書 root.crt
openssl x509 -req -days 3650 -sha256 -extfile /usr/local/openssl/ssl/openssl.cnf -extensions v3_ca -signkey root.key -in root.csr -out root.crt 輸出內容為:
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./emailAddress=admin@mycompany.com Getting Private key Enter pass phrase for root.key: ← 輸入前面創建的密碼 4.根據CA證書生成truststore JKS文件 root.truststore //這一步只針對雙向認證，單向不需要 keytool -keystore root.truststore -keypass 123456 -storepass 123456 -alias ca -import -trustcacerts -file /tmp/ca/root.crt 鍵入回事后，提示是否信息此證書，輸入yes, 則生成truststore成功 制作service服務器端證書
1.創建服務器證書密鑰 server.key openssl genrsa -des3 -out server.key 2048 輸出內容為:
Generating RSA private key, 2048 bit long modulus ...........................+++ ...............+++ e is 65537 (0x010001) Enter pass phrase for server.key: ← 輸入前面創建的密碼 Verifying - Enter pass phrase for server.key: ← 重新輸入一遍密碼 運行時會提示輸入密碼,此密碼用於加密key文件(參數des3便是指加密算法,當然也可以選用其他你認為安全的算法.),以后每當需讀取此文件(通過openssl提供的命令或API)都需輸入口令.如果覺得不方便,也可以去除這個口令,但一定要采取其他的保護措施! 去除key文件口令的命令: openssl rsa -in server.key -out server.key 2.創建服務器證書的申請文件 server.csr openssl req -new -key server.key -out server.csr 輸出內容為:
Enter pass phrase for server.key: ← 輸入前面創建的密碼 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank. —– Country Name (2 letter code) [AU]:US ← 國家名稱，美國輸入US State or Province Name (full name) [Some-State]:Houston ← 省名，拼音 Locality Name (eg, city) []:Houston ← 市名，拼音 Organization Name (eg, company) [Internet Widgits Pty Ltd]:hp ← 公司英文名 Organizational Unit Name (eg, section) []:hp ← 可以不輸入 我輸入的公司名稱 Common Name (eg, YOUR name) []:nova.scs.hpicorp.net(15.99.72.165) ← 域名(或者IP)，若填寫不正確，瀏覽器會報告證書無效，但並不影響使用 Email Address []:admin@hp.com ← 電子郵箱，可隨便填 Please enter the following ‘extra’ attributes to be sent with your certificate request A challenge password []: ← 可以不輸入 An optional company name []: ← 可以不輸入
創建完后可以用命令openssl req -text -noout -in server.csr 驗證一下是否有如下信息
[root@localhost ca]# openssl req -text -noout -in server.csr
Certificate Request:
Data:
Version: 1 (0x0)
Subject: C = US, ST = Houston, L = Houston, O = hp, OU = hp, CN = 192.168.0.168, emailAddress = aaa
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:be:f8:d1:da:8f:fb:0c:24:a2:61:f6:f6:b2:85:
d9:e8:be:f9:07:73:5a:4d:96:c2:99:e7:ec:6f:3e:
a2:d0:58:f5:0a:4a:91:f9:6a:5a:51:28:10:b4:86:
cb:e6:6c:61:75:90:90:5c:93:81:dc:38:11:eb:0d:
1b:87:ea:f0:8f:73:6a:8e:37:92:03:19:b3:e2:5f:
77:3a:98:bf:00:99:e0:e2:dd:ca:44:4f:b3:59:ec:
8d:f6:bc:54:f5:b2:15:d0:e6:51:66:8b:9b:1d:06:
15:db:5b:25:b9:d5:99:5b:78:64:20:72:7e:2c:be:
54:9b:31:d7:b0:51:95:71:87:38:7d:bc:db:30:8a:
9f:b6:8e:09:4c:40:df:3a:fd:15:4d:c1:81:f8:7b:
28:e2:0d:2e:d0:92:db:19:1d:b4:fe:ca:e9:75:05:
e2:f8:72:49:a3:8d:80:4b:19:c3:05:9d:48:d4:fc:
51:c7:c4:82:d3:b1:b2:8b:00:50:74:b8:8f:af:16:
7d:6e:52:92:36:9a:53:18:e9:f7:62:04:cc:fa:17:
78:5a:bd:0f:c9:f3:d2:83:10:26:21:af:26:df:09:
38:92:34:f0:5b:7c:9e:8b:a1:c8:af:b6:4d:08:7f:
f6:fd:a3:77:b8:51:35:df:c6:e3:53:b7:fa:4d:1d:
53:d9
Exponent: 65537 (0x10001)
Attributes:
Requested Extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 Subject Alternative Name:
DNS:kb.example.com, DNS:helpdesk.example.org, DNS:systems.example.net, IP Address:192.168.0.100, IP Address:192.168.0.168, IP Address:192.168.0.169, IP Address:192.168.0.106
Signature Algorithm: sha256WithRSAEncryption
39:1e:18:ec:c3:06:10:6d:49:75:03:ec:29:68:ae:cd:ad:e7:
c0:45:51:2a:ff:1d:06:fc:08:22:a3:61:d9:3e:92:b1:d4:5e:
d9:ff:42:58:94:0c:35:cc:b4:89:f1:6c:2d:d2:ca:76:30:f0:
95:e0:eb:1b:37:a8:d4:a4:a4:80:c8:19:76:6f:ad:e8:12:e1:
a1:9b:6b:28:ae:45:6d:3a:57:35:ff:36:9f:81:41:ca:4e:da:
9f:59:f2:61:12:bd:ef:8d:c9:ed:7f:48:78:03:39:fa:46:de:
e0:d7:ae:c1:fc:df:5f:21:b8:17:05:84:69:51:af:a0:0c:cb:
7d:fd:3b:b5:a8:ab:83:33:d7:fd:aa:c4:93:e3:dc:72:df:0d:
c3:2f:b2:61:af:a9:c0:cc:e2:b8:8d:09:5a:57:2f:26:4a:ec:
b4:b0:79:05:07:2c:a0:48:cc:a0:fb:70:93:d8:33:22:e2:58:
27:5d:48:dd:2b:ca:1d:c1:82:93:80:f8:87:f2:99:b7:6e:be:
a4:0b:34:a5:45:7b:f7:df:59:95:ce:0d:c5:0b:1c:b0:63:5f:
f5:61:d4:db:cc:a7:57:fe:28:b5:1a:f5:13:c3:0c:04:82:d2:
d1:b8:e0:23:c8:c5:c9:60:5c:b9:df:8f:85:1b:1a:fe:ed:c4:
1f:4d:3d:fd
3.創建自當前日期起有效期為期十年的服務器證書 server.crt openssl x509 -req -days 3650 -sha256 -extfile /usr/local/openssl/ssl/openssl.cnf -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in server.csr -out server.crt 輸出內容為:
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=www.mycompany.com/emailAddress=admin@mycompany.com Getting CA Private Key Enter pass phrase for root.key: ← 輸入前面創建的密碼 4.導出.p12文件 server.p12 openssl pkcs12 -export -in /tmp/ca/server.crt -inkey /tmp/ca/server.key -out /tmp/ca/server.p12 -name "server" 根據命令提示，輸入server.key密碼，創建p12密碼。 5.將.p12 文件導入到keystore JKS文件 server.keystore
keytool -importkeystore -v -srckeystore /tmp/ca/server.p12 -srcstoretype pkcs12 -srcstorepass nova123456 -destkeystore /tmp/ca/server.keystore -deststoretype jks -deststorepass nova123456
這里srcstorepass后面的nova123456為server.p12的密碼deststorepass后的nova123456為keyStore的密碼
制作client客戶端證書
1.創建客戶端證書密鑰文件 client.key openssl genrsa -des3 -out client.key 2048 輸出內容為:
Generating RSA private key, 2048 bit long modulus ...............................+++ .........................+++ e is 65537 (0x010001) Enter pass phrase for client.key: ← 輸入一個新密碼 Verifying – Enter pass phrase for client.key: ← 重新輸入一遍密碼 2.創建客戶端證書的申請文件 client.csr openssl req -new -key client.key -out client.csr 輸出內容為:
Enter pass phrase for client.key: ← 輸入上一步中創建的密碼 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank. —– Country Name (2 letter code) [AU]:CN ← 國家名稱，中國輸入CN State or Province Name (full name) [Some-State]:BeiJing ← 省名稱，拼音 Locality Name (eg, city) []:BeiJing ← 市名稱，拼音 Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名 Organizational Unit Name (eg, section) []: ← 可以不填 Common Name (eg, YOUR name) []:Lenin ← 自己的英文名，可以隨便填 Email Address []:admin@mycompany.com ← 電子郵箱，可以隨便填 Please enter the following ‘extra’ attributes to be sent with your certificate request A challenge password []: ← 可以不填 An optional company name []: ← 可以不填 3.創建一個自當前日期起有效期為十年的客戶端證書 client.crt openssl x509 -req -days 3650 -sha256 -extfile /usr/local/openssl/ssl/openssl.cnf -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in client.csr -out client.crt 輸出內容為:
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=www.mycompany.com/emailAddress=admin@mycompany.com Getting CA Private Key Enter pass phrase for root.key: ← 輸入上面創建的密碼 4.導出.p12文件 client.p12 openssl pkcs12 -export -in /tmp/ca/client.crt -inkey /tmp/ca/client.key -out /tmp/ca/client.p12 -name "client" 根據命令提示，輸入client.key密碼，創建p12密碼。 - 解釋
| 名稱 | |
|---|---|
| crt證書 | 只含有公鑰 |
| p12證書 | 是包含證書(含公鑰)和私鑰 |
| JKS(Java key store) | 存放密鑰的容器。.jks .keystore .truststore等 |
| KeyStore | 服務器的密鑰存儲庫，存服務器的公鑰私鑰證書 |
| TrustStore | 服務器的信任密鑰存儲庫，存CA公鑰 |
- 單向認證需要文件
| 名稱 | |
|---|---|
| root.crt | 客戶端使用的CA根證書 |
| server.keystore | 服務端證書存放的容器 |
- 雙向認證需要文件
| 名稱 | |
|---|---|
| root.crt | 客戶端使用的CA根證書 |
| client.p12 | 客戶端證書包含私鑰 |
| root.truststore | CA公鑰存放到受信賴的容器 |
| server.keystore | 服務端證書存放的容器 |
單向認證
客戶端只需要安裝root.crt這個CA根證書
服務器端配置server.keystore
配置Tomcat
1.關閉tomcat tomcat的bin目錄下執行 shutdown.sh 2.將keystore文件(server.keystore) 放在web服務器上
cp /tmp/ca/server.keystore /你的tomcat根目錄/conf
3.修改server.xml配置文件
cd /你的tomcat根目錄/conf vi server.xml 找到下面被注釋的代碼，刪除注釋符並修改內容(vi命令操作)
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" keystoreFile="/你的tomcat根目錄/conf/server.keystore" keystorePass="123456" clientAuth="false" sslEnabledProtocols="TLSv1.2" ciphers="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" /> 4.啟動tomcat tomcat的bin目錄下執行 startup.sh 5.訪問https服務 https://localhost:8443/ https://192.168.1.1:8443/ 你的IP 雙向認證
客戶端需要安裝root.crt這個CA根證書，client.p12這個客戶端證書
服務器端配置server.keystore，root.truststore
配置Tomcat
1.關閉tomcat tomcat的bin目錄下執行 shutdown.sh 2.將keystore文件(server.keystore) 放在web服務器上
cp /tmp/ca/server.keystore /你的tomcat根目錄/conf
將truststore文件(root.truststore) 放在web服務器上
cp /tmp/ca/root.truststore /你的tomcat根目錄/conf
3.修改server.xml配置文件
cd /你的tomcat根目錄/conf vi server.xml 找到下面被注釋的代碼，刪除注釋符並修改內容(vi命令操作)
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" keystoreFile="/你的tomcat根目錄/conf/server.keystore" keystorePass="123456" truststoreFile="/你的tomcat根目錄/conf/root.truststore" truststorePass="123456" clientAuth="true" sslEnabledProtocols="TLSv1.2" ciphers="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" /> 注意！clientAuth為true。這里和單向的不同。 4.啟動tomcat tomcat的bin目錄下執行 startup.sh 5.訪問https服務 https://localhost:8443/ https://192.168.1.1:8443/ 你的IP 完成。可以讓你的前端通過https協議訪問你的接口了，注意此時的接口是8443.
ios開發
請參考下面文章
https請求之iOS客戶端---AFNetworking
參考文章
1.SSL證書生成方法
2.Tomcat6配置使用SSL雙向認證（使用openssl生成證書）
3.Linux下生成https自簽名證書，解決蘋果發布問題重新整理
4.用tomcat配置https自簽名證書，解決 ios7.1以上系統, 蘋果inHouse發布
作者：易明INM
鏈接：https://www.jianshu.com/p/045f95c008a0
來源：簡書
簡書著作權歸作者所有，任何形式的轉載都請聯系作者獲得授權並注明出處。