RSA和证明书文件格式

作者: 今後次 | 来源:发表于2021-09-26 01:47 被阅读0次

RSA和证明书文件格式
RSA加密 iOS以及java
openssl的RSA使用
网络安全(II)
熏蒸、植检、动卫检
0013.HTTPSClient
证明
RSA+Base64之RSA
centOS KEY免密码登录
初识RSA

因为工作中要使用RSA公开密钥算法来处理各种公钥私钥和证书，所以有必要整理和记住它们的格式。
实际上在使用时也会有很多后缀。每个后缀的意思不理解的话，很难立马区分出来。

关于文件后缀的注意点

.DER和.PEM的后缀表明的不是文件内容，而是编码格式。
- 内容都是二进制，但是并不是单单的MD5字符串，还带有格式。.DER和.PEM就是表明使用的是什么格式。
.DER
- 使用ASN.1结构（ISO和ITU-T定义）来序列化的二进制文件。
- 使用 openssl命令带 -inform der来生成。
.PEM
- 跟.DER一样的ASN.1结构数据经过Base64转换后文件
- 文件开头有-- BEGIN-- 的话，可以认为就是.PEM
- 使用openssl命令时的默认参数
.CRT .CER .KEY .CSR的后缀表明的是文件内容，不是编码格式。
.p12的后缀表明的是PKCS#12个人信息交换文件格式。

生成密钥和公钥

RSA密钥生成

> openssl genrsa 1024 > private-key.pem
Generating RSA private key, 1024 bit long modulus
..................++++++
........................................++++++
e is 65537 (0x10001)

不带参数情况，默认生成PEM格式文件，所以后缀是.pem

RSA公钥生成

> openssl rsa -in private-key.pem -pubout -out public-key.pem
writing RSA key

文件内容查看方法

密钥查看方法

> openssl rsa -in private-key.pem -text -noout
Private-Key: (1024 bit)
modulus:
    00:e4:56:a1:6b:90:ce:f5:54:37:61:ca:a4:be:9a:
    e5:62:0f:70:d7:7f:89:f4:40:82:2e:3e:d6:ab:b2:
    7d:d2:fb:51:b1:72:6b:62:a0:f2:5d:0f:34:c2:1b:
    dd:a2:53:52:18:eb:ea:fa:e2:5d:ad:db:c2:10:cf:
    ac:66:01:7c:27:55:49:14:d9:ae:6d:d2:99:a1:2d:
    e2:d4:ed:45:bc:18:d6:17:7c:08:3d:5b:05:12:52:
    c5:14:1c:00:37:50:c7:28:e0:87:7f:d2:05:a3:38:
    34:fc:2a:92:6d:7d:53:21:7d:2e:45:cd:d1:54:b7:
    54:0a:b3:2e:5d:0c:db:c2:1f
publicExponent: 65537 (0x10001)
privateExponent:
    00:d3:d8:37:ec:f7:2d:bb:d8:c5:85:1a:20:1c:a2:
    d2:fc:56:7d:07:c2:51:38:66:7d:20:f0:b5:f4:18:
    26:ba:8e:e6:ad:2e:0d:c9:34:af:87:7d:2b:22:87:
    fd:e9:b3:49:f0:cb:38:78:49:7a:46:6a:23:b3:bb:
    29:24:7e:6e:32:c3:3d:a0:fc:a9:23:51:79:b4:59:
    f7:dd:9e:57:ca:52:cb:cd:e1:fe:8c:9a:3c:18:22:
    a0:36:be:c2:8b:44:44:32:7f:4b:c6:34:ad:1a:dc:
    e3:9b:a2:fa:86:c8:9f:d0:da:38:ee:88:d5:f5:33:
    45:2b:7e:0e:eb:e8:5d:da:61
prime1:
    00:f3:f4:3c:25:ed:78:93:12:30:04:ae:95:00:17:
    87:f4:43:87:e6:66:71:28:98:96:c3:d8:21:6d:8a:
    3f:a4:45:31:3d:fb:09:fb:4a:b3:38:6d:9a:ca:ba:
    bc:47:65:e2:84:20:52:a6:46:a9:42:7e:b8:82:69:
    2f:38:72:73:8f
prime2:
    00:ef:9d:00:81:5b:0f:59:7c:4f:88:d6:1b:d5:b2:
    a4:02:30:c4:e7:a2:73:b2:6d:59:31:e2:6d:d5:5a:
    c1:8e:22:ff:04:8d:15:e5:78:20:3a:75:d4:18:3c:
    aa:43:53:5e:95:72:9b:5f:df:a8:ba:25:6d:75:b4:
    3b:8d:dd:40:71
exponent1:
    08:27:df:26:e9:74:81:7e:37:2a:c0:e7:6c:54:5d:
    10:36:7d:c1:9f:25:23:55:4e:9d:07:89:be:8e:c3:
    a7:eb:44:45:2d:32:5d:3b:57:18:88:d9:86:f3:8d:
    3d:d9:d3:23:d5:ac:cd:b0:49:12:57:08:36:1b:ec:
    1f:37:fc:53
exponent2:
    78:a2:7f:d5:a0:65:ca:f4:b6:0a:3b:59:8a:2e:45:
    3a:41:19:71:51:2d:94:a0:4e:ee:b9:83:f8:8d:97:
    b3:1a:d5:6f:92:24:7b:02:0e:9f:c0:20:c7:0f:0b:
    dd:97:84:a0:13:32:3c:83:9b:2c:14:99:d6:4f:a6:
    48:17:23:51
coefficient:
    00:b5:74:c2:20:d1:57:16:f3:02:05:be:0a:78:f5:
    ea:52:05:e0:c6:b1:46:80:5c:7a:62:18:1f:d2:e9:
    61:34:6c:71:2e:97:e5:f7:b0:4e:0c:d7:c8:31:8e:
    e7:a8:cd:8b:51:49:70:73:60:ff:3b:41:76:46:c1:
    0a:28:93:97:ea

prime是素数的意思。使用prime1和prime2来生成秘钥。

公钥查看方法

> openssl rsa -pubin -in public-key.pem -text -noout
Modulus (1024 bit):
    00:e4:56:a1:6b:90:ce:f5:54:37:61:ca:a4:be:9a:
    e5:62:0f:70:d7:7f:89:f4:40:82:2e:3e:d6:ab:b2:
    7d:d2:fb:51:b1:72:6b:62:a0:f2:5d:0f:34:c2:1b:
    dd:a2:53:52:18:eb:ea:fa:e2:5d:ad:db:c2:10:cf:
    ac:66:01:7c:27:55:49:14:d9:ae:6d:d2:99:a1:2d:
    e2:d4:ed:45:bc:18:d6:17:7c:08:3d:5b:05:12:52:
    c5:14:1c:00:37:50:c7:28:e0:87:7f:d2:05:a3:38:
    34:fc:2a:92:6d:7d:53:21:7d:2e:45:cd:d1:54:b7:
    54:0a:b3:2e:5d:0c:db:c2:1f
Exponent: 65537 (0x10001)

证书查看方法
证明书用openssl x509命令来查看。

> openssl x509 -in public-key.crt -text -noout
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            b0:a6:d9:14:7e:56:22:56
        Signature Algorithm: sha1WithRSAEncryption
        ...

转换编码格式

PEM格式密钥 <=> DER格式密钥
> openssl rsa -in private-key.pem -out private-key.der -outform der
-in 指定需要变换前的秘钥
-out 指出需要变换后的秘钥
-outform 指定输出格式（-outform pem情况，不明确写也可以）
-inform 指定输入格式
反过来变换
> openssl rsa -in private-key.der -inform der -out private-key.pem
PEM格式公钥 <=> DER格式公钥
> openssl rsa -pubin -in public-key.pem -out public-key.der -outform der
> openssl rsa -pubin -in public-key.der -inform der -out public-key.pem
PEM格式证书 <=> DER格式证书
> openssl x509 -in public-key.crt -out public-key.der.crt -outform der
> openssl x509 -in public-key.der.crt -inform der -out public-key.crt

证书做成（带签名的公钥）

作成
> openssl req -new -key private-key.pem > my-request.csr
CSR查看方法

> openssl req -in my-request.csr -text -noout
Certificate Request:
    Data:
        Version: 0 (0x0)

CSR证书发行
> openssl x509 -req -in my-request.csr -CA ca-crt.pem -CAkey ca-private-key.pem -CAcreateserial -days 3650 -out public-key.crt

-CA ca-crt.pem 指定自身CA证明局
-CAkey ca-private-key.pem 指定自身CA证明局的秘钥
CA局の秘密鍵（上記 ca-crt.pemの中に書かれている公開鍵に対応する秘密鍵）
-CAcreateserial 指定序列号自动生成

从证书中抽取公钥

> openssl x509 -in public-key.crt -pubkey 
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkVqFrkM71VDdhyqS+muViD3DX
f4n0QIIuPtarsn3S+1GxcmtioPJdDzTCG92iU1IY6+r64l2t28IQz6xmAXwnVUkU
2a5t0pmhLeLU7UW8GNYXfAg9WwUSUsUUHAA3UMco4Id/0gWjODT8KpJtfVMhfS5F
zdFUt1QKsy5dDNvCHwIDAQAB
-----END PUBLIC KEY-----
-----BEGIN CERTIFICATE-----
MIICAzCCAWwCCQCgYvbe6d0oLzANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJK
UDEOMAwGA1UECBMFVG9reW8xEDAOBgNVBAcTB1NoaWJ1eWExFTATBgNVBAoTDFJp
cHBsZXggSW5jLjAeFw0xNTAxMDYwNjU1MjJaFw0yNTAxMDMwNjU1MjJaMEYxCzAJ
BgNVBAYTAkpQMQ4wDAYDVQQIEwVUb2t5bzEQMA4GA1UEBxMHU2hpYnV5YTEVMBMG
A1UEChMMUmlwcGxleCBJbmMuMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDk
VqFrkM71VDdhyqS+muViD3DXf4n0QIIuPtarsn3S+1GxcmtioPJdDzTCG92iU1IY
6+r64l2t28IQz6xmAXwnVUkU2a5t0pmhLeLU7UW8GNYXfAg9WwUSUsUUHAA3UMco
4Id/0gWjODT8KpJtfVMhfS5FzdFUt1QKsy5dDNvCHwIDAQABMA0GCSqGSIb3DQEB
BQUAA4GBAC/D6RWTTeshiWvrwwyU98aP47DVxzUhUbfR3HHaAe3r++/FlUlRsvZN
PPKjAjLdIOuzHPOPFbmOUzb+T8uPZp1P7oGe+g1MmjgyR9soKPETiLirCqa4sLfz
GTfdh3X/RrSfugcjHPJmfgtpLDml6K1ikulyPDH56l8/AKulJxLx
-----END CERTIFICATE-----

参数加上 -noout就只输出公钥。

> openssl x509 -in public-key.crt -pubkey -noout
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkVqFrkM71VDdhyqS+muViD3DX
f4n0QIIuPtarsn3S+1GxcmtioPJdDzTCG92iU1IY6+r64l2t28IQz6xmAXwnVUkU
2a5t0pmhLeLU7UW8GNYXfAg9WwUSUsUUHAA3UMco4Id/0gWjODT8KpJtfVMhfS5F
zdFUt1QKsy5dDNvCHwIDAQAB
-----END PUBLIC KEY-----

保存为PEM格式。
> openssl x509 -in public-key.crt -pubkey -noout > public-key-recovered.pem