windows 下 nginx 雙向認證自簽名證書配置

1. 創建根證書密鑰、服務器證書私鑰、客戶端證書私鑰：

openssl genrsa -out root.key 2048
openssl genrsa -out server.key 2048
openssl genrsa -out client.key 2048

3. 創建證書申請請求

openssl req -new -key root.key -out root.csr
openssl req -new -key server.key -out server.csr
openssl req -new -key client.key -out client.csr

注意這三個csr文件，除了 COMMON NAME 不同，其他必填內容要相同。root.csr 的Common Name填root，server.csr和client.csr的都可以填成localhost或者本機ip：192.168.xx.yy。

4. 創建根證書，用根證書籤發服務器證書和客戶端證書

openssl x509 -req -in root.csr -signkey root.key -out root.crt
openssl x509 -req -days 365 -in server.csr -CA root.crt -CAkey root.key -set_serial 01 -out server.crt
openssl x509 -req -days 365 -in client.csr -CA root.crt -CAkey root.key -set_serial 01 -out client.crt

5. 配置nginx支持雙向認證：

編輯nginx.conf文件：

ssl_certificate      C://nginx-1.16.1//ssl//CA2//server.crt;
ssl_certificate_key  C://nginx-1.16.1//ssl//CA2//server.key;
ssl_client_certificate C://nginx-1.16.1//ssl//CA2//root.crt;
ssl_verify_client on; #雙向認證

6. 重啓 nginx

注意在 windows 目錄下一定要在 nginx.exe 所在目錄下執行命令，否則會報錯。

ngxin -s reload

7. 測試

這裏使用 openssl 的 s_client 命令進行測試，注意命令執行後，TLS通道建立，命令行處於等待狀態，需要手動輸入 GET / 纔會返回nginx的web頁面。

C:\nginx-1.16.1\ssl\CA2>openssl s_client -connect localhost:443 -cert client.crt -key client.key -CAfile root.crt
CONNECTED(000003E4)
Can't use SSL_get_servername
depth=1 C = cn, ST = sh, L = sh, O = bt, OU = test, CN = root
verify return:1
depth=0 C = cn, ST = sh, L = sh, O = bt, OU = test, CN = localhost
verify return:1
---
Certificate chain
 0 s:C = cn, ST = sh, L = sh, O = bt, OU = test, CN = localhost
   i:C = cn, ST = sh, L = sh, O = bt, OU = test, CN = root
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDHTCCAgUCAQEwDQYJKoZIhvcNAQELBQAwUjELMAkGA1UEBhMCY24xCzAJBgNV
BAgMAnNoMQswCQYDVQQHDAJzaDELMAkGA1UECgwCYnQxDTALBgNVBAsMBHRlc3Qx
DTALBgNVBAMMBHJvb3QwHhcNMjAwNTExMDg1MDQ1WhcNMjEwNTExMDg1MDQ1WjBX
MQswCQYDVQQGEwJjbjELMAkGA1UECAwCc2gxCzAJBgNVBAcMAnNoMQswCQYDVQQK
DAJidDENMAsGA1UECwwEdGVzdDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvKhPBeQUERKSAiiy/Y5z1V6fLiss/ZiG
tLF7dOKvrtaqzGL6lGs2ybY5p1v7wtIw3AqTwup63YDyYtghnacu26DHMlsYDIaa
tamP3+uTvDKlCTnw57ShTPhkPukIKZevv0SFyt+lEAeVM0S+zdOTlb2anA5pbOjB
eoA79LB6iVR1Ltp6nvKShBfRMk4JEp6fjPdhMwN+mX42PPkWHwHBLiRjVvRWYbFD
+g4wHjXutZ1iRWxOJe/vC+QFKCldKo19pp3S8O3WgHixTsIoJW//7q+hRMvvd6Em
3VB+rYTpd4/76O+Blp+QZJ4SvfeHX702p+2ik+6/5M7YlnlQCGmCfwIDAQABMA0G
CSqGSIb3DQEBCwUAA4IBAQBqyJ1ZflMqy5QLwCEP8CZvD+SqGJpGUQCZjiZs/v1h
BepuKVrolQCPm55NVIuEAj6xZnysjG4wpY6I+brFcUB7I9MVXyg+pKwAVEBm6tvz
kG90w1zk/0lNmC+Eyi8ElbI8/+kVGLeFQyoIjMt3EEsCqX87wVBWyUdFwKZuCEJs
UvSDjTaL50T+6DXzshU1n4UcWq2dirZ8D3g8DnS/5T+AwdiDv9xqe7cuFyxB7ajA
/5bECrgKsFnebf/3xlgoQgMwGvUUEPVlT8AgX/NxGMFwV0m63s8PXz1PAGRfkUZn
fiPbxoP5mUxNndvQha3PB07Zb+WwESuNXeJERNW4WLEp
-----END CERTIFICATE-----
subject=C = cn, ST = sh, L = sh, O = bt, OU = test, CN = localhost

issuer=C = cn, ST = sh, L = sh, O = bt, OU = test, CN = root

---
Acceptable client certificate CA names
C = cn, ST = sh, L = sh, O = bt, OU = test, CN = root
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1:DSA+SHA224:DSA+SHA1:DSA+SHA256:DSA+SHA384:DSA+SHA512
Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1:DSA+SHA224:DSA+SHA1:DSA+SHA256:DSA+SHA384:DSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2407 bytes and written 2289 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 6BE6AB220D6C28BA7CDC37CB97C050169F7A80D7CE525FBE204FFBF695795846
    Session-ID-ctx:
    Master-Key: ACD8704793E4E6C1AAD4863F298E8074AE190395FBC6E352C91243C588A9F59D6DCE8D4EEFA8FB1217B0BAE6FCC585AC
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 91 67 91 07 f1 5c 29 83-8e 6a 41 9b 13 41 9f a7   .g...\)..jA..A..
    0010 - 21 19 77 08 93 95 0e 15-44 86 8a 7b 8c 9e 16 4e   !.w.....D..{...N
    0020 - 91 c1 cd d9 13 ba c7 4b-bc 8e 86 d1 4a c7 d4 16   .......K....J...
    0030 - cf 75 79 84 76 96 be 0a-5d d0 95 7d da d6 37 26   .uy.v...]..}..7&
    0040 - 65 b3 9d 12 19 fe f8 ba-1e 11 5b 79 76 67 6b 67   e.........[yvgkg
    0050 - 98 2a 67 58 e6 a8 27 25-59 f8 68 06 40 a8 81 96   .*gX..'%Y.h.@...
    0060 - 9f 39 d0 4b dd e0 41 cd-53 b5 8b 9d 67 f5 d5 04   .9.K..A.S...g...
    0070 - df 22 21 40 d2 6e 52 13-3e 1e 8b 53 6d 70 fb 1c   ."[email protected].>..Smp..
    0080 - 29 b8 06 17 1d ef da ed-20 26 68 a9 0f ab 9e a6   )....... &h.....
    0090 - 07 c4 38 19 b3 d5 bd 8f-b3 08 2f 54 77 1f f7 72   ..8......./Tw..r
    00a0 - d9 e5 dc 06 f4 8a f3 c9-54 c4 38 c7 20 93 58 c5   ........T.8. .X.
    00b0 - 27 c3 28 75 85 9b ac 8b-e4 52 da 07 4b 0f ce 7b   '.(u.....R..K..{
    00c0 - 9b 76 f4 b6 56 23 01 c8-0b e7 8c 3d 0a df d2 ed   .v..V#.....=....
    00d0 - b4 80 f2 6a 7a 89 07 9a-8b ef 52 e9 56 97 75 fe   ...jz.....R.V.u.
    00e0 - 68 29 a4 f0 4a 6b d2 3b-1f d4 dc 92 15 d5 8e 06   h)..Jk.;........
    00f0 - cf a9 ea 58 83 78 39 0a-34 7c 59 74 6e ff e5 99   ...X.x9.4|Ytn...
    0100 - 7c 0e e0 99 ef e6 10 74-1a b7 a6 92 d6 b5 5b dc   |......t......[.
    0110 - 09 35 fc fa 25 73 e4 b2-22 f2 ab 61 af ea 73 13   .5..%s.."..a..s.
    0120 - 85 d5 44 4d 79 b7 49 e6-09 58 23 89 fb 8d 0b 0c   ..DMy.I..X#.....
    0130 - 97 d8 11 8c 6a 42 c3 ce-99 64 bf ce a9 4e a2 a1   ....jB...d...N..
    0140 - 97 e4 cd e0 09 5e 5d be-c3 3c 24 52 2e 2d 50 12   .....^]..<$R.-P.
    0150 - d6 13 2e d0 7d fa 31 c5-4b 64 9d 72 99 15 28 6e   ....}.1.Kd.r..(n
    0160 - 4c 24 1e c9 ab 57 a3 aa-e3 41 cf 51 bc 2f b1 db   L$...W...A.Q./..
    0170 - e5 75 50 68 37 d3 cf 9c-2e 99 e1 52 dc 95 08 b4   .uPh7......R....
    0180 - 82 13 79 1d a2 f2 67 ce-d7 fb c4 2b 65 60 26 1d   ..y...g....+e`&.
    0190 - a7 08 1a 56 0b 17 2e 52-91 c0 04 f3 c1 02 d4 ac   ...V...R........
    01a0 - 89 1f 5c 19 59 80 ca 27-5c c7 d3 05 03 d4 3d 06   ..\.Y..'\.....=.
    01b0 - 53 c7 9d 0b 90 7e d8 67-fa ed 3a 61 c7 9b 9c f0   S....~.g..:a....
    01c0 - e6 b1 93 a1 ea 29 67 dd-22 ce a7 40 15 33 26 3a   .....)g."[email protected]&:
    01d0 - e7 05 55 4a f9 7a 4f 56-1a d0 63 f5 43 b3 16 0e   ..UJ.zOV..c.C...
    01e0 - 60 94 29 e3 bb 88 22 fd-a4 19 d8 43 44 3b 8d 47   `.)..."....CD;.G
    01f0 - 50 9f 8b 1f b6 2d f3 e9-ba b0 68 3b 22 0e 20 5a   P....-....h;". Z
    0200 - b4 97 d3 b2 3b 0c 1e 6f-2a a7 49 e6 ec 66 2c 63   ....;..o*.I..f,c
    0210 - 2c f2 3e 9e 31 37 d3 29-24 8d 1f bc 80 c1 d3 b6   ,.>.17.)$.......
    0220 - 51 4e b0 6e ca 49 74 c4-71 b3 fc 73 c7 45 42 7f   QN.n.It.q..s.EB.
    0230 - 01 6d 11 24 de fc 06 de-86 3c 61 8e 82 cc 10 ac   .m.$.....<a.....
    0240 - c2 59 71 04 4c 75 7b 9d-4a 16 10 04 35 c3 dc a9   .Yq.Lu{.J...5...
    0250 - d8 98 a3 99 0c 38 27 fc-32 dc 6d 28 79 d8 67 ef   .....8'.2.m(y.g.
    0260 - 33 af 3b f3 c2 7c 50 06-48 30 c2 22 16 7e 0f f2   3.;..|P.H0.".~..
    0270 - 70 9b 47 6f 02 27 c9 67-6c db 14 00 ab 13 8c a4   p.Go.'.gl.......
    0280 - fd 31 a1 af 48 60 a9 9d-fc 23 ef 12 1f 25 73 db   .1..H`...#...%s.
    0290 - da 5d 5e 85 21 0b c6 11-24 89 c2 ed 13 c6 0c f5   .]^.!...$.......
    02a0 - dc 97 27 f7 a7 02 2f 98-52 23 02 56 97 3b aa 95   ..'.../.R#.V.;..
    02b0 - 54 f5 26 89 c0 8b 14 af-bc af e9 ec 61 b4 4f 3b   T.&.........a.O;
    02c0 - cb f0 0a 31 90 7c b4 44-d8 de e2 f8 bf 3b 47 21   ...1.|.D.....;G!
    02d0 - 4a c2 57 e2 66 d6 9d 9e-e3 3f 2e 60 62 0f d8 07   J.W.f....?.`b...
    02e0 - c8 46 79 03 15 97 d2 ca-24 a1 22 b2 77 32 3d 8f   .Fy.....$.".w2=.
    02f0 - 50 f7 eb f1 1a 48 d9 ab-50 3e fc e4 97 5e 2d 39   P....H..P>...^-9
    0300 - 95 a3 da f9 77 33 4e 91-20 78 fc 97 cf 10 18 f4   ....w3N. x......
    0310 - 35 b4 a2 63 78 84 62 09-e6 08 d0 02 36 d1 91 be   5..cx.b.....6...
    0320 - 78 36 29 75 3b 30 a8 17-5e 6b 62 ac 1d da 87 d9   x6)u;0..^kb.....
    0330 - e6 2d 84 53 40 ca 46 e9-bb d8 01 7a ae dd 11 0e   [email protected]....
    0340 - 05 dd bb 38 bc 64 42 ef-b5 d2 25 a1 f9 60 bc 81   ...8.dB...%..`..
    0350 - 7e af de 8f 4b cd 96 d5-dd 99 a9 f5 bb b2 de d3   ~...K...........
    0360 - 2c 0f 7f e6 61 df 74 cd-4f 0b d8 d4 10 b7 5c ef   ,...a.t.O.....\.
    0370 - 8a 81 94 ff 60 5a 19 c5-cd cf 16 79 6c aa 78 95   ....`Z.....yl.x.
    0380 - af 17 5f 1c 2d 61 dc a7-ff 8b db 0f c1 1d 5d 00   .._.-a........].
    0390 - 00 9b 57 78 09 e7 22 c8-5c 24 9f 93 b6 aa e2 be   ..Wx..".\$......
    03a0 - fa ff f2 96 e2 c9 02 56-12 fa db bc 7a 34 0e ad   .......V....z4..
    03b0 - ff 5a f5 e7 0b 59 5c 30-c6 52 18 ae 6f 5a 73 cd   .Z...Y\0.R..oZs.
    03c0 - eb 82 fa f8 2d 2b 59 89-22 54 69 8d 51 b9 08 fa   ....-+Y."Ti.Q...
    03d0 - 61 40 60 4c 1c 59 a3 c0-b1 30 77 ca a1 37 62 73   a@`L.Y...0w..7bs

    Start Time: 1589187204
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
GET /
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
closed

C:\nginx-1.16.1\ssl\CA2>

8. 問題

我創建好證書配置好nginx之後，用curl命令測試一直失敗，提示“ 400 沒有證書可用”， 這是因爲咱們客戶端證書也是自籤的，curl 在使用時認爲它不合法，把它忽略掉了，導致 tls 協商時沒法提供客戶端證書。

C:\nginx-1.16.1\ssl\CA2>curl  -k --cert client.crt --key client.key --cacert root.crt  https://localhost
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx/1.16.1</center>
</body>
</html>

直接使用 openssl s_client 命令就沒這個問題。

9. 參考：

https://www.jianshu.com/p/2b2d1f511959?utm_campaign=haruki

http://blog.808inorganic.com/2017/01/using-openssl-sserver-and-openssl.html

https://www.jianshu.com/p/cc6b804a4d80