使用 python/ruby 创建 ssl 服务端程序

1. 创建一个自签名的 SSL 证书

1. #### 使用 OpenSSL 创建自签名证书
   
2. 
   
3. 
   
4. ## 1.创建根证书的私钥
   
5. openssl genrsa -out ca.key 1024
   
6. 
   
7. ## 2.使用私钥创建根证书
   
8. openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/C=CN/ST=Fujian/L=Xiamen/O=Your Company Name/OU=Your Root CA"
   
9. 
   
10. ## 3.创建服务器私钥
    
11. openssl genrsa -out server.key 1024
    
12. 
    
13. ## 4.使用服务器私钥创建证书请求文件
    
14. openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Fujian/L=Xiamen/O=Your Company Name/OU=youwebsite.org/CN=yourwebsite.org"
    
15. 
    
16. ## 5.准备工作
    
17. mkdir -p demoCA/newcerts
    
18. touch demoCA/index.txt
    
19. echo '01' > demoCA/serial
    
20. 
    
21. ## 6.创建服务器证书并使用ca根证书签名
    
22. openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key
    
23. 
    
24. 
    
25. ## ---查看不同格式文件的内容命令语法
    
26. # openssl rsa -noout -text -in ca.key
    
27. # openssl x509 -noout -text -in ca.crt
    
28. # openssl rsa -noout -text -in server.key
    
29. # openssl req -noout -text -in server.csr
    
30. # openssl x509 -noout -text -in server.crt
    
31. 
    
32. ## 创建证书最简单方式
    
33. # openssl req -new -x509 -days 365 -nodes -out cert.pem -keyout cert.key

2. python server

1. import socket, ssl
   
2. import time
   
3. 
   
4. cacrtf="ca/ca.crt"
   
5. crtf="ca/server.crt"
   
6. keyf="ca/server.key"
   
7. 
   
8. server_sc = socket.socket()
   
9. server_sc.bind(('', 10023))
   
10. server_sc.listen(5)
    
11. 
    
12. newsocket, addr = server_sc.accept()
    
13. sc = ssl.wrap_socket(newsocket,
    
14.                      server_side=True,
    
15.                      certfile=crtf,
    
16.                      keyfile=keyf,
    
17.                      ca_certs=cacrtf)
    
18. 
    
19. data = sc.read()
    
20. print data
    
21. sc.write('Back time: ' + str(time.time()))
    
22. 
    
23. sc.close()
    
24. server_sc.close()

3. python client

1. import socket, ssl, pprint
   
2. import time
   
3. 
   
4. cacrtf="ca/ca.crt"
   
5. crtf="ca/server.crt"
   
6. keyf="ca/server.key"
   
7. 
   
8. socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   
9. ssl_socket = ssl.wrap_socket(socket, ca_certs=cacrtf, cert_reqs=ssl.CERT_REQUIRED)
   
10. ssl_socket.connect(('127.0.0.1', 10023))
    
11. 
    
12. print repr(ssl_socket.getpeername())
    
13. print ssl_socket.cipher()
    
14. print pprint.pformat(ssl_socket.getpeercert())
    
15. 
    
16. ssl_socket.write("Time: %s\r\n" % time.time())
    
17. 
    
18. data = ssl_socket.read()
    
19. print data
    
20. 
    
21. ssl_socket.close()

4. ruby server

1. require 'socket'
   
2. require 'openssl'
   
3. 
   
4. $cacrtf="ca/ca.crt"
   
5. $crtf="ca/server.crt"
   
6. $keyf="ca/server.key"
   
7. 
   
8. server = TCPServer.new('127.0.0.1', 10024)
   
9. ctx = OpenSSL::SSL::SSLContext.new()
   
10. ctx.cert= OpenSSL::X509::Certificate.new(File.open($crtf))
    
11. ctx.key = OpenSSL::PKey::RSA.new(File.open($keyf))
    
12. ssl_server = OpenSSL::SSL::SSLServer.new(server, ctx)
    
13. 
    
14. sc = ssl_server.accept
    
15. 
    
16. p sc.gets
    
17. sc.puts "Back Time: #{Time.now}"
    
18. 
    
19. sc.close
    
20. ssl_server.close

5. ruby client

1. require 'socket'
   
2. require 'openssl'
   
3. 
   
4. $cacrtf="ca/ca.crt"
   
5. $crtf="ca/server.crt"
   
6. $keyf="ca/server.key"
   
7. 
   
8. socket = TCPSocket.new('127.0.0.1', 10024)
   
9. context = OpenSSL::SSL::SSLContext.new
   
10. context.cert= OpenSSL::X509::Certificate.new(File.open($cacrtf)) # $cacrtf or $crtf
    
11. ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, context)
    
12. ssl_socket.sync_close = true
    
13. ssl_socket.connect
    
14. p ssl_socket.ssl_version
    
15. 
    
16. ssl_socket.puts "Time: #{Time.now}"
    
17. p ssl_socket.gets
    
18. 
    
19. ssl_socket.close

end.