abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-09-21 21:03:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

TLS 1.3 server auth only

Browse Source
This commit is contained in:
Zhi Guan
2022-07-20 16:42:32 +08:00
parent 48e0178837
commit 89f57327aa
25 changed files with 5208 additions and 1102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
demos/tlcp_client.sh Executable file
View File

@@ -0,0 +1,10 @@
#!/bin/bash
# 当服务器发送CertificateRequest而Client又没有用证书、密钥时，会SegFault
#../build/bin/tls12_client -host 127.0.0.1 -cacert cacert.pem -cert cert.pem -key key.pem -pass 123456
../build/bin/tlcp_client -host 127.0.0.1 -cacert cacert.pem # -cert cert.pem -key key.pem -pass 123456

22
demos/tlcp_server.sh Executable file
View File

@@ -0,0 +1,22 @@
#!/bin/bash
gmssl sm2keygen -pass 1234 -out cakey.pem
gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN CA -days 365 -key cakey.pem -pass 1234 -out cacert.pem -key_usage keyCertSign -key_usage cRLSign
gmssl certparse -in cacert.pem
gmssl sm2keygen -pass 1234 -out signkey.pem
gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -days 365 -key signkey.pem -pass 1234 -out signreq.pem
gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem
gmssl certparse -in signcert.pem
gmssl sm2keygen -pass 1234 -out enckey.pem
gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -days 365 -key enckey.pem -pass 1234 -out encreq.pem
gmssl reqsign -in encreq.pem -days 365 -key_usage keyEncipherment -cacert cacert.pem -key cakey.pem -pass 1234 -out enccert.pem
gmssl certparse -in enccert.pem
cat signcert.pem > cert.pem
cat enccert.pem >> cert.pem
sudo gmssl tlcp_server -cert cert.pem -key signkey.pem -pass 1234 -ex_key enckey.pem -ex_pass 1234 # -cacert cacert.pem

15
demos/tls12.sh Executable file
View File

@@ -0,0 +1,15 @@
#!/bin/bash -x
# server-authentication only
../build/bin/tls12_server -cert cert.pem -key key.pem -pass 123456 1>/dev/null 2>/dev/null &
sleep 3
../build/bin/tls12_client -host 127.0.0.1 -cacert cacert.pem
# mutual authentication, i.e. client certificate requested
../build/bin/tls12_server -cert cert.pem -key key.pem -pass 123456 -cacert cacert.pem 1>/dev/null 2>/dev/null &
sleep 3
../build/bin/tls12_client -host 127.0.0.1 -cacert cacert.pem -cert cert.pem -key key.pem -pass 123456

10
demos/tls12_client.sh Executable file
View File

@@ -0,0 +1,10 @@
#!/bin/bash
# 当服务器发送CertificateRequest而Client又没有用证书、密钥时，会SegFault
#../build/bin/tls12_client -host 127.0.0.1 -cacert cacert.pem -cert cert.pem -key key.pem -pass 123456
../build/bin/tls12_client -host 127.0.0.1 -cacert cacert.pem # -cert cert.pem -key key.pem -pass 123456

16
demos/tls12_server.sh Executable file
View File

@@ -0,0 +1,16 @@
#!/bin/bash
# 现在的错误是服务器想要让客户端发送证书，但是客户端没有发证书
# 如果要求客户端发送证书，那么服务器必须准备相应的CA证书
# 客户端的证书和CA证书有什么区别吗？可能没有区别，但是还应该生成一个
# 客户端的名字是什么呢？
#
# 服务器的证书需要设定服务器名字，也就是127.0.0.1或者localhost
# 这个名字和SNI是有关系的
# 客户端的名字可以任意定了，而且客户端的CA可以有所不同吧
../build/bin/tls12_server -cert cert.pem -key key.pem -pass 123456 #-cacert cacert.pem