详解Nginx SSL快速双向认证配置(脚本)

server {
 listen 80;
 listen 443 ssl http2;
 server_name example.com;

 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 # 只有Nginx >= 1.13.0 版本才支持TLSv1.3协议
 # ssl_protocols TLSv1.3;
 # Nginx低于1.13.0版本用这个配置
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_prefer_server_ciphers on; 
 ssl_dhparam dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
 ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
 ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
 ssl_session_timeout 10m;
 ssl_session_cache shared:SSL:10m;
 ssl_session_tickets off; # Requires nginx >= 1.5.9
 ssl_stapling on; # Requires nginx >= 1.3.7
 ssl_stapling_verify on; # Requires nginx => 1.3.7
 resolver 223.5.5.5 114.114.114.114 valid=300s;
 resolver_timeout 5s; 
 # 启用HSTS的配置，如果你的域名下还有非标准端口访问的http应用，请勿启用HSTS
 # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
 # 下面这个配置会拒绝Frame标签内容，请确认你的网站没有frame / iframe
 add_header X-Frame-Options DENY;
 add_header X-Content-Type-Options nosniff;
 add_header X-XSS-Protection "1; mode=block";

 # 为了let's encrypt续期用，不用let's encrypt不需要这个location
 location /.well-known {
  root /usr/share/nginx/html;
 }

  ... SNIP ...

 # 强制http跳转为https
 if ($scheme != "https") {
  return 301 https://$http_host$request_uri;
 }
}

# tree /etc/nginx/ssl_certs/
/etc/nginx/ssl_certs/
├── create_ca_cert.sh
├── create_client_cert.sh
├── revoke_cert.sh

0 directories, 3 files

#!/bin/bash -e

# 创建CA根证书
# 非交互式方式创建以下内容:
# 国家名(2个字母的代号)
C=CN
# 省
ST=Shannxi
# 市
L=Xian
# 公司名
O=My Company
# 组织或部门名
OU=技术部
# 服务器FQDN或颁发者名
CN=www.example.com
# 邮箱地址
emailAddress=admin@example.com

mkdir -p ./demoCA/{private,newcerts}
touch ./demoCA/index.txt
[ ! -f ./demoCA/seria ] && echo 01 > ./demoCA/serial
[ ! -f ./demoCA/crlnumber ] && echo 01 > ./demoCA/crlnumber
[ ! -f ./demoCA/cacert.pem ] && openssl req -utf8 -new -x509 -days 36500 -newkey rsa:2048 -nodes -keyout ./demoCA/private/cakey.pem -out ./demoCA/cacert.pem -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${emailAddress}"
[ ! -f ./demoCA/private/ca.crl ] && openssl ca -crldays 36500 -gencrl -out "./demoCA/private/ca.crl"

#!/bin/bash -e

show_help() {
  echo "$0 [-h|-?|--help] [--ou ou] [--cn cn] [--email email]"
  echo "-h|-?|--help  显示帮助"
  echo "--ou      设置组织或部门名，如: 技术部"
  echo "--cn      设置FQDN或所有者名，如: 冯宇"
  echo "--email     设置FQDN或所有者邮件，如: fengyu@example.com"
}

while [[ $# -gt 0 ]]
do
  case $1 in
    -h|-\?|--help)
      show_help
      exit 0
      ;;
    --ou)
      OU="${2}"
      shift
      ;;    
    --cn)
      CN="${2}"      
      shift
      ;;
    --email)
      emailAddress="${2}"      
      shift
      ;;
    --)
      shift
      break
    ;;
    *)
      echo -e "Error: $0 invalid option '$1'\nTry '$0 --help' for more information.\n" >&2
      exit 1
    ;;
  esac
shift
done

# 创建客户端证书
# 非交互式方式创建以下内容:
# 国家名(2个字母的代号)
C=CN
# 省
ST=Shannxi
# 市
L=Xian
# 公司名
O=My Company
# 组织或部门名
OU=${OU:-测试部门}
# 服务器FQDN或授予者名
CN=${CN:-demo}
# 邮箱地址
emailAddress=${emailAddress:-demo@example.com}

mkdir -p "${CN}"

[ ! -f "${CN}/${CN}.key" ] && openssl req -utf8 -nodes -newkey rsa:2048 -keyout "${CN}/${CN}.key" -new -days 36500 -out "${CN}/${CN}.csr" -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${emailAddress}"
[ ! -f "${CN}/${CN}.crt" ] && openssl ca -utf8 -batch -days 36500 -in "${CN}/${CN}.csr" -out "${CN}/${CN}.crt"
[ ! -f "${CN}/${CN}.p12" ] && openssl pkcs12 -export -clcerts -CApath ./demoCA/ -inkey "${CN}/${CN}.key" -in "${CN}/${CN}.crt" -certfile "./demoCA/cacert.pem" -passout pass: -out "${CN}/${CN}.p12"

#!/bin/bash -e

# 吊销一个签证过的证书

openssl ca -revoke "${1}/${1}.crt"
openssl ca -gencrl -out "./demoCA/private/ca.crl"

Generating a 2048 bit RSA private key
.......................+++
........................................................................................................+++
writing new private key to './demoCA/private/cakey.pem'
-----
Using configuration from /usr/ssl/openssl.cnf

demoCA/
├── cacert.pem
├── crlnumber
├── crlnumber.old
├── index.txt
├── newcerts
├── private
│  ├── ca.crl
│  └── cakey.pem
└── serial

2 directories, 7 files

 ssl_client_certificate ssl_certs/demoCA/cacert.pem;
 ssl_crl ssl_certs/demoCA/private/ca.crl;
 ssl_verify_client on;

 ./create_client_cert.sh --ou 财务部 --cn 财务经理 --email cy@example.com
Generating a 2048 bit RSA private key
................................+++
.............................................................................+++
writing new private key to '财务经理/财务经理.key'
-----
Using configuration from /usr/ssl/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
    Serial Number: 1 (0x1)
    Validity
      Not Before: Jun 14 16:03:46 2018 GMT
      Not After : May 21 16:03:46 2118 GMT
    Subject:
      countryName        = CN
      stateOrProvinceName    = Shannxi
      organizationName     = My Company
      organizationalUnitName  = \U8D22\U52A1\U90E8
      commonName        = \U8D22\U52A1\U7ECF\U7406
      emailAddress       = cy@example.com
    X509v3 extensions:
      X509v3 Basic Constraints:
        CA:FALSE
      Netscape Comment:
        OpenSSL Generated Certificate
      X509v3 Subject Key Identifier:
        B5:91:0B:1F:FC:25:3B:2A:F9:EF:39:39:51:E3:1F:64:78:8A:C3:75
      X509v3 Authority Key Identifier:
        keyid:86:55:76:15:A3:F5:58:CB:8F:39:A3:56:8E:FF:18:97:AE:27:60:0F

Certificate is to be certified until May 21 16:03:46 2118 GMT (36500 days)

Write out database with 1 new entries
Data Base Updated

tree 财务经理/
财务经理/
├── 财务经理.crt
├── 财务经理.csr
├── 财务经理.key
└── 财务经理.p12

0 directories, 4 files

Using configuration from /usr/ssl/openssl.cnf
Revoking Certificate 01.
Data Base Updated
Using configuration from /usr/ssl/openssl.cnf

service nginx reload