问题描述
我正在创建这样的证书:
I'm creating my certificates like this:
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -key rootCA.key -sha512 -days 36501 -out rootCA.pem \
-extensions v3_req
openssl genrsa -out client1.key 2048
openssl req -new -key client1.key -sha512 -days 36500 -out client1.csr \
-extensions v3_req
openssl x509 -req -days 36500 -CA rootCA.pem -CAkey rootCA.key \
-CAcreateserial -CAserial serial -in client1.csr -out client1.pem
openssl verify -verbose -CAfile rootCA.pem client1.pem
openssl pkcs12 -export -in client1.pem -inkey client1.key -out client1.p12 -name "client1"
我希望.p12证书使用sha512算法.我考虑过将-sha512选项添加到转换(最后一行)中，但是pkcs12似乎没有此选项.有什么想法吗?
I want the .p12 certificate to use sha512 algorithmn. I thought about adding the option -sha512 to the convertion (last line) but it seems like pkcs12 doesn't got this option. Any ideas?
推荐答案
PKCS#12支持以下用于私钥加密的加密算法.
PKCS#12 supports the following encryption algorithms for private key encryption.
- 带有SHA1的128位RC4
- 带有SHA1的40位RC4
- 具有SHA1(168位)的3键三重DES
- 2个具有SHA1(112位)的三重DES
- 带有SHA1的128位RC2
- 带有SHA1的40位RC2
默认情况下使用3键三重DES，因此如果您愿意，则无需提供-des3.
3 key triple DES is used by default so no need to give -des3 if you prefer it.
您可以使用以下命令从生成的pkcs12文件中输出一些信息:
You can output some info from the generated pkcs12 file with the following command:
openssl pkcs12 -in client1.p12 -noout -info
请注意，如果要使用sha-512哈希函数，则在生成x509客户端证书时，需要提供-sha512参数.
As a side note, when you generate the x509 client cert you need to give -sha512 argument if you want to use sha-512 hashing function.
验证是否实际使用了sha512哈希函数:
Verify whether sha512 hash function was actually used:
openssl x509 -in client1.pem -noout -text
如果没有，请使用-sha512重新创建
If not, then recreate it with -sha512
openssl x509 -sha512 -req -days 36500 -CA rootCA.pem -CAkey rootCA.key \
-CAcreateserial -CAserial serial -in client1.csr -out client1.pem
这篇关于如何使用sha512创建pkcs12证书的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！