本次实验所使用操作系统为Ubuntu20.04，通过openssl工具生成所有的ssl证书。

1、生成自签CA证书

CA证书的作用是签发服务器和客户端证书，并且用于校验客户端的证书。

# 生成CA的私钥文件
root@k8s-master1:~/ssl# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..................................................................................................................................+++++
.........................................+++++
e is 65537 (0x010001)
root@k8s-master1:~/ssl# 
# 生成CA证书，-subj参数可以免去交互式
root@k8s-master1:~/ssl# openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=CN/O=People's Republic of China/CN=China CA"
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# ls
ca.crt  ca.key
root@k8s-master1:~/ssl# 
# 通过openssl工具查看CA证书的内容
root@k8s-master1:~/ssl# openssl x509 -text -noout -in ca.crt 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:91:a9:4f:4b:b5:22:65:8f:f9:f4:13:10:a6:03:c6:f3:80:fd:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = People's Republic of China, CN = China CA
        Validity
            Not Before: Oct 27 12:08:35 2022 GMT
            Not After : Oct 24 12:08:35 2032 GMT
        Subject: C = CN, O = People's Republic of China, CN = China CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:dd:00:26:20:9a:f2:ed:94:e5:30:99:fe:38:ae:
                    ...
                    ...
                    7d:56:26:48:35:a6:97:ac:1d:4c:23:dd:39:76:89:
                    31:5b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                42:19:EB:18:05:C7:A0:AB:E5:6C:93:9C:FC:EB:F6:E1:5F:93:E2:E1
            X509v3 Authority Key Identifier: 
                keyid:42:19:EB:18:05:C7:A0:AB:E5:6C:93:9C:FC:EB:F6:E1:5F:93:E2:E1

            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         1c:e3:a5:45:c3:b6:1e:16:d2:d7:58:93:3d:0c:79:8f:6a:b0:
         ...
         ...
         6f:e6:d5:0e:71:92:ca:65:cd:1a:4b:7c:2b:f3:08:dd:bc:f7:
         dc:dd:c1:a3
root@k8s-master1:~/ssl# 

2、生成自签服务器证书

-subj 参数很重要，其中/CN要填写具体的域名，要与nginx的server_name匹配上。

chrome浏览器对证书很严格，证书必须要有SAN（Subject Alternative Name）。
v3_req表示生成是X.509 v3和SAN的证书，-extfile和-extensions这两个参数是可选的，如果没有这两个参数，那证书就是没有SAN的，推荐加上这两个参数。

# 生成服务器的私钥文件
root@k8s-master1:~/ssl# openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................+++++
..............................................+++++
e is 65537 (0x010001)
root@k8s-master1:~/ssl# 
# 生成服务器的证书签发文件，即csr后缀的文件
root@k8s-master1:~/ssl# openssl req -new -key server.key -out server.csr -subj "/C=CN/O=People's Republic of China/CN=example.com"
root@k8s-master1:~/ssl# 
# 使用CA签发服务器证书
root@k8s-master1:~/ssl# openssl x509 -req -in server.csr -out server.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -extfile <(sed "/\[ v3_req \]/ a\subjectAltName = @alt_names" /etc/ssl/openssl.cnf <(printf "\n[alt_names]\nDNS.1=example.com\nDNS.2=www.example.com")) -extensions v3_req
Signature ok
subject=C = CN, O = People's Republic of China, CN = example.com
Getting CA Private Key
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# ls
ca.crt  ca.key  ca.srl  server.crt  server.csr  server.key
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# openssl x509 -text -noout -in server.crt 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:be:cf:e7:ce:18:b5:3c:04:a1:da:74:d0:8e:7c:a5:e9:08:7d:3d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = People's Republic of China, CN = China CA
        Validity
            Not Before: Oct 27 12:12:32 2022 GMT
            Not After : Oct 24 12:12:32 2032 GMT
        Subject: C = CN, O = People's Republic of China, CN = example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:63:3f:85:f0:99:8a:13:f8:62:3d:d3:5f:60:
                    ...
                    ...
                    3f:a2:b3:a1:8a:d4:b3:48:b9:b4:18:b5:10:a0:b1:
                    61:ab
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:example.com, DNS:www.example.com
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment
    Signature Algorithm: sha256WithRSAEncryption
         42:f0:fa:93:b9:75:5b:6a:63:4f:a9:c5:c2:c8:5a:e9:ca:9e:
         ...
         ...
         10:10:94:72:92:56:bf:e6:91:97:1f:b0:54:2c:6e:37:22:59:
         9f:bd:c2:67
root@k8s-master1:~/ssl# 

3、配置nginx，开启ssl双向认证

nginx ssl双向认证配置文件的关键内容如下。

server {
        listen       443 ssl;
        listen       [::]:443 ssl;
        server_name  example.com www.example.com;

        # 服务器证书所在路径
        ssl_certificate "/etc/nginx/ssl/server.crt";
        ssl_certificate_key "/etc/nginx/ssl/server.key";
        ssl_protocols TLSv1.2 TLSv1.3;

        # 开启ssl双向认证
        ssl_verify_client on; 
        # 使用ca.crt校验客户端证书，由该ca.crt签发的证书才可以通过校验
        ssl_client_certificate "/etc/nginx/ssl/ca.crt";

        location / {
                return 200 "success";
        }
}

4、生成客户端证书

客户端证书步骤跟服务器证书一样，只是参数不一样。

# 生成客户端的私钥文件
root@k8s-master1:~/ssl# openssl genrsa -out client.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..............+++++
..........................................................................+++++
e is 65537 (0x010001)
root@k8s-master1:~/ssl# 
# 生成客户端的证书签发文件
root@k8s-master1:~/ssl# openssl req -new -key client.key -out client.csr -subj "/C=CN/O=People's Republic of China/CN=Private certificate assigned to Tom"
root@k8s-master1:~/ssl# 
# 使用CA签发客户端证书
root@k8s-master1:~/ssl# openssl x509 -req -in client.csr -out client.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650
Signature ok
subject=C = CN, O = People's Republic of China, CN = Private certificate assigned to Tom
Getting CA Private Key
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# ls
ca.crt  ca.key  ca.srl  client.crt  client.csr  client.key  server.crt  server.csr  server.key
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# openssl x509 -text -noout -in client.crt 
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            30:be:cf:e7:ce:18:b5:3c:04:a1:da:74:d0:8e:7c:a5:e9:08:7d:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = People's Republic of China, CN = China CA
        Validity
            Not Before: Oct 27 12:24:28 2022 GMT
            Not After : Oct 24 12:24:28 2032 GMT
        Subject: C = CN, O = People's Republic of China, CN = Private certificate assigned to Tom
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c1:ed:df:46:b9:8b:3a:e9:3e:ed:09:29:a6:56:
                    ...
                    ...
                    3b:87:22:39:87:8b:ce:bd:e4:f4:28:94:a4:83:95:
                    a2:df
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         46:04:fe:6a:b1:c9:9b:df:f6:8e:ac:c4:e2:dd:a1:75:1a:f4:
         ...
         ...
         ef:94:84:c5
root@k8s-master1:~/ssl# 

5、使用curl测试ssl双向认证

curl没有使用客户端证书去请求，会报400错误。如果使用的客户端证书不是由特定CA签发的，也同样会报400错误。

root@k8s-master1:~/ssl# curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1
* Added www.example.com:443:127.0.0.1 to DNS cache
* Hostname www.example.com was found in DNS cache
*   Trying 127.0.0.1:443...
* TCP_NODELAY set
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to www.example.com (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
...
...
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; O=People's Republic of China; CN=example.com
*  start date: Oct 27 12:12:32 2022 GMT
*  expire date: Oct 24 12:12:32 2032 GMT
*  issuer: C=CN; O=People's Republic of China; CN=China CA
*  SSL certificate verify result: certificate signature failure (7), continuing anyway.
} [5 bytes data]
> GET / HTTP/1.1
> Host: www.example.com
> User-Agent: curl/7.68.0
> Accept: */*
> 
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [265 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [265 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< Server: nginx
< Date: Thu, 27 Oct 2022 12:39:16 GMT
< Content-Type: text/html
< Content-Length: 230
< Connection: close
< 
{ [230 bytes data]
100   230  100   230    0     0  20909      0 --:--:-- --:--:-- --:--:-- 20909
* Closing connection 0
} [5 bytes data]
* TLSv1.3 (OUT), TLS alert, close notify (256):
} [2 bytes data]
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# curl -k https://www.example.com/ --resolve www.example.com:443:127.0.0.1
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx</center>
</body>
</html>
root@k8s-master1:~/ssl# 
root@k8s-master1:~/ssl# 

--cert和--key参数指定客户端证书，服务器校验证书没问题就能正常访问。
也可以将客户端证书转换成PC浏览器用的证书格式，命令如下。

openssl pkcs12 -export -clcerts -out client.p12 -in client.crt -inkey client.key

温馨提示：不需要密码就按回车键。

root@k8s-master1:~/ssl# curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1 --cert ./client.crt --key ./client.key
* Added www.example.com:443:127.0.0.1 to DNS cache
* Hostname www.example.com was found in DNS cache
*   Trying 127.0.0.1:443...
* TCP_NODELAY set
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to www.example.com (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
...
...
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; O=People's Republic of China; CN=example.com
*  start date: Oct 27 12:12:32 2022 GMT
*  expire date: Oct 24 12:12:32 2032 GMT
*  issuer: C=CN; O=People's Republic of China; CN=China CA
*  SSL certificate verify result: certificate signature failure (7), continuing anyway.
} [5 bytes data]
> GET / HTTP/1.1
> Host: www.example.com
> User-Agent: curl/7.68.0
> Accept: */*
> 
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1097 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1097 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 27 Oct 2022 12:46:20 GMT
< Content-Type: application/octet-stream
< Content-Length: 7
< Connection: keep-alive
< 
{ [7 bytes data]
100     7  100     7    0     0    583      0 --:--:-- --:--:-- --:--:--   583
* Connection #0 to host www.example.com left intact
root@k8s-master1:~/ssl# 

6、命令汇总

生成自签CA证书

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=CN/O=People's Republic of China/CN=China CA"

生成服务器证书

openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/C=CN/O=People's Republic of China/CN=example.com"
openssl x509 -req -in server.csr -out server.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -extfile <(sed "/\[ v3_req \]/ a\subjectAltName = @alt_names" /etc/ssl/openssl.cnf <(printf "\n[alt_names]\nDNS.1=example.com\nDNS.2=www.example.com")) -extensions v3_req

生成客户端证书

openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr -subj "/C=CN/O=People's Republic of China/CN=Private certificate assigned to Tom"
openssl x509 -req -in client.csr -out client.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650

curl命令

curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1
curl -k https://www.example.com/ --resolve www.example.com:443:127.0.0.1
curl -k -vo /dev/null https://www.example.com/ --resolve www.example.com:443:127.0.0.1 --cert ./client.crt --key ./client.key