openssl3.2/test/certs - 033 - time stamping certificates

发布时间：2024年01月24日

文章目录

openssl3.2/test/certs - 033 - time stamping certificates

概述

笔记

/*!

\file my_openssl_linux_log_doc_033.txt
\note openssl3.2/test/certs - 033 - time stamping certificates
带时间戳的证书
自己调用openssl时, 如果也要动态参数文件(不落地), 也可以参照.sh的用法, 自己建立多个参数输入的管道, 拼好配置文件内容, 再将管道名称传给openssl作为参数
只要openssl命令行需要文件的场合, 我们都可以用程序中建立的有名管道传进去.
*/

// --------------------------------------------------------------------------------
// official bash script
// --------------------------------------------------------------------------------
// openssl3.2/test/certs - 033 - time stamping certificates
./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum ca-key ca-cert
openssl -v

./mkcert.sh genee -p timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-noncritxku ca-key ca-cert
openssl -v

./mkcert.sh genee -p critical,timeStamping,serverAuth -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-serverauth ca-key ca-cert
openssl -v

./mkcert.sh genee -p critical,timeStamping,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-anyextkeyusage ca-key ca-cert
openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,cRLSign server.example ee-key ee-timestampsign-CABforum-crlsign ca-key ca-cert
openssl -v

./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,keyCertSign server.example ee-key ee-timestampsign-CABforum-keycertsign ca-key ca-cert
openssl -v

./mkcert.sh genee -p critical,timeStamping server.example ee-key ee-timestampsign-rfc3161 ca-key ca-cert
openssl -v

./mkcert.sh genee -p timeStamping server.example ee-key ee-timestampsign-rfc3161-noncritxku ca-key ca-cert
openssl -v

./mkcert.sh genee -p critical,timeStamping -k digitalSignature server.example ee-key ee-timestampsign-rfc3161-digsig ca-key ca-cert

// --------------------------------------------------------------------------------
// openssl cmd line parse
// --------------------------------------------------------------------------------

// --------------------------------------------------------------------------------
// sh1
// --------------------------------------------------------------------------------
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem

// cfg_exp033_sh1_cmd2.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh1_cmd2.txt -out ee-key-req.pem

// cfg_exp033_sh1_cmd3.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = critical,digitalSignature
extendedKeyUsage = critical,timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-CABforum.pem -extfile cfg_exp033_sh1_cmd3.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req.pem

// --------------------------------------------------------------------------------
// sh2
// --------------------------------------------------------------------------------

// cfg_exp033_sh2_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh2_cmd1.txt -out ee-key-req-sh2.pem

// cfg_exp033_sh2_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = critical,digitalSignature
extendedKeyUsage = timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-noncritxku.pem -extfile cfg_exp033_sh2_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-req-sh2.pem

// --------------------------------------------------------------------------------
// sh3
// --------------------------------------------------------------------------------

// cfg_exp033_sh3_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh3_cmd1.txt -out ee-key-sh3-req.pem

// cfg_exp033_sh3_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = critical,digitalSignature
extendedKeyUsage = critical,timeStamping,serverAuth
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-serverauth.pem -extfile cfg_exp033_sh3_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh3-req.pem

// --------------------------------------------------------------------------------
// sh4
// --------------------------------------------------------------------------------

// cfg_exp033_sh4_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh4_cmd1.txt -out ee-key-sh4-cmd1-req.pem

// cfg_exp033_sh4_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = critical,digitalSignature
extendedKeyUsage = critical,timeStamping,2.5.29.37.0
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-anyextkeyusage.pem -extfile cfg_exp033_sh4_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh4-cmd1-req.pem

// --------------------------------------------------------------------------------
// sh5
// --------------------------------------------------------------------------------

// cfg_exp033_sh5_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh5_cmd1.txt -out ee-key-sh5_cmd1.pem

// cfg_exp033_sh5_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = critical,digitalSignature,cRLSign
extendedKeyUsage = critical,timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-crlsign.pem -extfile cfg_exp033_sh5_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh5_cmd1.pem

// --------------------------------------------------------------------------------
// sh6
// --------------------------------------------------------------------------------

// cfg_exp033_sh6_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh6_cmd1.txt -out ee-key-sh6-cmd1-req.pem

// cfg_exp033_sh6_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = critical,digitalSignature,keyCertSign
extendedKeyUsage = critical,timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-CABforum-keycertsign.pem -extfile cfg_exp033_sh6_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh6-cmd1-req.pem

// --------------------------------------------------------------------------------
// sh7
// --------------------------------------------------------------------------------

// cfg_exp033_sh7_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh7_cmd1.txt -out ee-key-sh7-cmd1-req.pem

// cfg_exp033_sh7_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false

extendedKeyUsage = critical,timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161.pem -extfile cfg_exp033_sh7_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh7-cmd1-req.pem

// --------------------------------------------------------------------------------
// sh8
// --------------------------------------------------------------------------------

// cfg_exp033_sh8_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh8_cmd1.txt -out ee-key-sh8-cmd1-req.pem

// cfg_exp033_sh8_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false

extendedKeyUsage = timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-noncritxku.pem -extfile cfg_exp033_sh8_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh8-cmd1-req.pem

// --------------------------------------------------------------------------------
// sh9
// --------------------------------------------------------------------------------

// cfg_exp033_sh9_cmd1.txt
string_mask=utf8only
[req]
prompt = no
distinguished_name = dn
[dn]
CN = server.example

openssl req -new -sha256 -key ee-key.pem -config cfg_exp033_sh9_cmd1.txt -out ee-key-sh9-cmd1-req.pem

// cfg_exp033_sh9_cmd2.txt
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
basicConstraints = CA:false
keyUsage = digitalSignature
extendedKeyUsage = critical,timeStamping
[alts]
subjectAltName = @alts
DNS=server.example
[alts]

openssl x509 -req -sha256 -out ee-timestampsign-rfc3161-digsig.pem -extfile cfg_exp033_sh9_cmd2.txt -CA ca-cert.pem -CAkey ca-key.pem -set_serial 2 -days 36525 -in ee-key-sh9-cmd1-req.pem

// --------------------------------------------------------------------------------
// openssl log
// --------------------------------------------------------------------------------
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -out ee-key.pem
openssl req -new -sha256 -key ee-key.pem -config /dev/fd/63