openssl 常用命令

本文基本上是参考openssl cookbook
http://blog.ivanristic.com/2013/10/openssl-cookbook-v1.1-released.html
openss Comman-dLine-HowTo: https://www.madboa.com/geek/openssl/
#check openssl version 

点击(此处)折叠或打开

1. openssl version -a #verbose
   
2. openssl version

#generate a private RSA key AES-128 (AES-192,AES-256 could be used)

点击(此处)折叠或打开

1. openssl genrsa -aes128 -out fd.key 2048

#generate corresponding public key

点击(此处)折叠或打开

1. openssl rsa -in fd.key -pubout -out fd-public.key

#generate a private DSA key  AES-128 (AES-192,AES-256 could be used)

点击(此处)折叠或打开

1. openssl dsa -out dsa.key -aes128

#create a Certificate Signing Request

点击(此处)折叠或打开

1. openssl req -new -key fd.key -out fd.csr
2. openssl req -text -in fd.csr -noout       #check the CSR is correct
   

#create a brand-new CSR from an existing certificate

点击(此处)折叠或打开

1. openssl x509 -x509toreq -in fd.crt -out fd.csr -signkey fd.key

#self sign own certificates

点击(此处)折叠或打开

1. openssl x509 -req -days 365 -in fd.csr -signkey fd.key -out fd.crt

#create a self-signed certificate starting with a key alone

点击(此处)折叠或打开

1. openssl req -new -x509 -days 365 -key fd.key -out fd.crt

#examining certificate

点击(此处)折叠或打开

1. openssl x509 -text -in fd.crt -noout

#obtaining the list of supported suites

点击(此处)折叠或打开

1. openssl ciphers -v 'ALL:COMPLEMENTOFALL'
   
2. openssl ciphers -v -v 'ALL:COMPLEMENTOFALL'
   
3. openssl ciphers -v 'RC4'             #list only cipher suites that are based on RC4
   
4. openssl ciphers -v 'RC4+SHA'        #combine keywords select suites that use RC4 and SHA:
   
5. openssl ciphers -v 'RC4:AES'        #to choose all suites that use RC4 or AES ciphers:
   
6. openssl ciphers -v 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW'                #apache in httpd.conf SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
   
7. openssl ciphers -v 'DES-CBC-SHA:DES-CBC3-SHA:RC4-SHA:AES256-SHA:@STRENGTH'            #@STRENGTH sort these suite in strength descending order

最常见的给httpd配置ssl.
其实只需要建公钥，私钥，然后create csr,然后self sign 一下即可。