Comments (1)
local openssl_pkey = require("resty.openssl.pkey")
local openssl_bignum = require("resty.openssl.bn")
local openssl_csr = require("resty.openssl.x509.csr")
local openssl_name = require("resty.openssl.x509.name")
local openssl_rand = require("resty.openssl.rand")
-- CA证书和私钥的PEM内容
local ca_cert_pem = [[
-----END CERTIFICATE-----
]]
local ca_pkey_pem = [[
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
]]
-- 加载CA证书和私钥
local ca_cert, err = openssl_x509.new(ca_cert_pem)
if not ca_cert then
ngx.log(ngx.ERR, "failed to load CA cert: ", err)
return
end
local ca_pkey, err = openssl_pkey.new(ca_pkey_pem)
if not ca_pkey then
ngx.log(ngx.ERR, "failed to load CA pkey: ", err)
return
end
local _M = {}
-- 创建证书
function _M:generateCert(domain)
-- 生成和签署 SSL 证书时
-- step1: 生成新的密钥对:为待签名的证书生成一个新的公钥和私钥。
-- 创建私钥
local pkey, err = openssl_pkey.new({ type = "RSA", bits = 2048 })
if not pkey then
ngx.log(ngx.ERR, "failed to create pkey: ", err)
return
end
-- step2 生成 CSR(证书签名请求):使用新生成的私钥和相关信息(如域名、组织信息等)生成 CSR。
local csr, err = openssl_csr.new()
if not csr then
ngx.log(ngx.ERR, "failed to create csr: ", err)
return
end
local subject = openssl_name.new({
{ C = "CN" },
{ ST = "Beijing" },
{ L = "Beijing" },
{ O = "Example Corp" },
{ CN = domain },
})
csr:set_subject_name(subject)
csr:set_pubkey(pkey)
-- step3 使用 CA 签署 CSR:用 CA 的私钥签署这个 CSR,生成最终的证书。
local openssl_x509 = require "resty.openssl.x509"
local resty_random = require "resty.openssl.rand"
local cert, err = openssl_x509.new()
if not cert then
ngx.log(ngx.ERR, "failed to create cert: ", err)
return
end
cert:set_serial_number(openssl_bignum.from_binary(openssl_rand.bytes(16)))
cert:set_subject_name(csr:get_subject_name())
cert:set_pubkey(csr:get_pubkey())
cert:set_issuer_name(ca_cert:get_subject_name())
cert:set_not_before(ngx.time())
cert:set_not_after(ngx.time() + 365 * 24 * 60 * 60) -- 一年有效期
cert:sign(ca_pkey)
-- 获取证书的PEM格式
local cert_pem, err = cert:to_PEM()
if not cert_pem then
ngx.log(ngx.ERR, "failed to get cert PEM: ", err)
return
end
-- 获取私钥的PEM格式
local pkey_pem, err = pkey:to_PEM("private")
if not pkey_pem then
ngx.log(ngx.ERR, "failed to get pkey PEM: ", err)
return
end
end
return _M
local cert_pem, key_pem = generateCert("www.test.com")
-- Save to files
-- local cert_file = io.open("generated_cert1.pem", "w")
-- cert_file:write(cert_pem)
-- cert_file:close()
-- local key_file = io.open("generated_key2.pem", "w")
-- key_file:write(pkey_pem)
-- key_file:close()
I am is ok
from lua-resty-openssl.
Related Issues (20)
- Is lua-resty-openssl-aux-module still required to run lua-resty-openssl in production? HOT 3
- Crash when signature with invalid JWK is attempted HOT 4
- Hot to get fingerprint? HOT 5
- 尝试解密微信支付AEAD_AES_256_GCM的加密文本遇到错误:cipher:final: EVP_CipherFinal_ex failed HOT 2
- about the return value of store:verify HOT 2
- It's better not bind `X509_STORE_set_flags` logic in `store:add(crl)` HOT 4
- sign CSR with exixsring root Keys. HOT 8
- Wrong parameter in dump_jwk used HOT 1
- module 'resty.openssl.x509' not found HOT 4
- Documentation for pkey:verify inconsistent HOT 1
- OpenSSL Version Compatibility Question HOT 5
- Remove private part from OKP keys when dumping as public JWK
- Public key construction creates alerts HOT 1
- nginx: [warn] [lua] http_connect.lua:21: failed to load module `resty.openssl.*`, mTLS isn't supported without lua-resty-openssl HOT 1
- nginx: [error] init_by_lua error: resty.openssl.auxiliary.nginx doesn't support Nginx version 1026000 HOT 4
- loop or previous error loading module 'resty.openssl.version' HOT 6
- How to verify a signature ? HOT 22
- resty.openssl.cipher - EVP_get_cipherbyname' (cannot convert 'table' to 'const char *') HOT 2
- EVP_PKEY_derive error on 32-bit systems due to incorrect type casting HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lua-resty-openssl.