ssl Firefox忽略我的自签名CA证书

piztneat  于 2021-06-20  发布在  其他
关注(0)|答案(1)|浏览(266)

我通过以下代码创建了一个CA证书：

  1. // Create a new certificate authority (CA) key pair
  2.         const caKeys = forge.pki.rsa.generateKeyPair(4096);
  4.         // Create a new certificate authority (CA) certificate
  5.         const cert = forge.pki.createCertificate();
  6.         cert.publicKey = caKeys.publicKey;
  7.         cert.signatureAlgorithm = forge.pki.oids.sha256WithRSAEncryption;
  8.         cert.serialNumber = "01";
  10.         // Set the subject of the CA certificate
  11.         cert.setSubject([
  12.                 { name: "countryName", value: "SK" },
  13.                 { name: "commonName", value: "Primantro-Canny-Root-CA" },
  14.         ]);
  16.         // Set validity period of the CA certificate
  17.         cert.validity.notBefore = new Date();
  18.         cert.validity.notAfter = new Date();
  19.         cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1); // 1 year validity
  21.         var attrs = [
  22.                 { name: "commonName", value: "name" },
  23.                 { name: "countryName", value: "AT" },
  24.                 { name: "organizationName", value: "Org"},
  25.                 { shortName: "OU", value: "OU" },
  26.         ];
  27.         cert.setSubject(attrs);
  28.         // alternatively set subject from a csr
  29.         //cert.setSubject(csr.subject.attributes);
  30.         cert.setIssuer(attrs);
  31.         cert.setExtensions([
  32.                 { name: "basicConstraints", cA: true },
  33.                 {
  34.                         name: "keyUsage",
  35.                         keyCertSign: true,
  36.                         digitalSignature: true,
  37.                         nonRepudiation: true,
  38.                         keyEncipherment: true,
  39.                         dataEncipherment: true,
  40.                 },
  41.                 {
  42.                         name: "extKeyUsage",
  43.                         serverAuth: true,
  44.                         clientAuth: true,
  45.                         codeSigning: true,
  46.                         emailProtection: true,
  47.                         timeStamping: true,
  48.                 },
  49.                 {
  50.                         name: "nsCertType",
  51.                         client: true,
  52.                         server: true,
  53.                         email: true,
  54.                         objsign: true,
  55.                         sslCA: true,
  56.                         emailCA: true,
  57.                         objCA: true,
  58.                 },
  59.                 {
  60.                         name: "subjectKeyIdentifier",
  61.                 },
  62.         ]);
  64.         // Sign the CA certificate with its own private key
  65.         cert.sign(caKeys.privateKey, forge.md.sha256.create());
  67.         // Save the CA private key to a file
  68.         const caPrivateKeyPem = forge.pki.privateKeyToPem(caKeys.privateKey);
  69.         fs.writeFileSync(keyPath, caPrivateKeyPem);
  71.         // Save the CA certificate to a file
  72.         const caPublicPem = forge.pki.publicKeyToPem(cert.publicKey);
  73.         fs.writeFileSync(pemPath, caPublicPem);
  75.         // Convert the certificate to CRT format
  76.         const crtCert = forge.pki.certificateToPem(cert);
  77.         fs.writeFileSync(crtPath, crtCert);
  79.         return { crt: crtCert, pem: caPublicPem, key: caPrivateKeyPem };

字符串
然后我使用返回的值为localhost创建一个ssl证书，代码如下：

  1. const ca = await localhostCA();
  3.         const caPrivateKeyPem = ca.key;
  4.         const caCertPem = ca.crt;
  6.         const caPrivateKey = forge.pki.privateKeyFromPem(caPrivateKeyPem);
  7.         const caCert = forge.pki.certificateFromPem(caCertPem);
  9.         // Create a new key pair for the server
  10.         const serverKeys = forge.pki.rsa.generateKeyPair(2048);
  11.         const serverCert = forge.pki.createCertificate();
  12.         serverCert.signatureAlgorithm = forge.pki.oids.sha256WithRSAEncryption;
  14.         // Set the subject of the server certificate
  15.         serverCert.publicKey = serverKeys.publicKey;
  16.         serverCert.setSubject([
  17.                 { name: "countryName", value: "SK" },
  18.                 { name: "stateOrProvinceName", value: "YourState" },
  19.                 { name: "localityName", value: "YourCity" },
  20.                 { name: "organizationName", value: "Example-Certificates" },
  21.                 { name: "commonName", value: "localhost.local" },
  22.         ]);
  24.         // Set the issuer to the Root CA
  25.         serverCert.setIssuer(caCert.subject.attributes);
  27.         // Set the validity period of the server certificate
  28.         serverCert.validity.notBefore = new Date();
  29.         serverCert.validity.notAfter = new Date();
  30.         serverCert.validity.notAfter.setFullYear(serverCert.validity.notBefore.getFullYear() + 1); // 1 year validity
  32.         // Set the extensions for the server certificate
  33.         serverCert.setExtensions([
  34.                 {
  35.                         name: "subjectAltName",
  36.                         altNames: [
  37.                                 { type: 2, value: "localhost" },
  38.                                 { type: 2, value: "fake1.local" },
  39.                                 { type: 2, value: "fake2.local" },
  40.                         ],
  41.                 },
  42.                 {
  43.                         name: "keyUsage",
  44.                         keyEncipherment: true,
  45.                         digitalSignature: true,
  46.                         nonRepudiation: true,
  47.                         keyAgreement: true,
  48.                 },
  49.         ]);
  51.         // Sign the server certificate with the Root CA private key
  52.         serverCert.sign(caPrivateKey, forge.md.sha256.create());
  54.         // Save the server private key to a file
  55.         const serverPrivateKeyPem = forge.pki.privateKeyToPem(serverKeys.privateKey);
  56.         // fs.writeFileSync("localhost.key", serverPrivateKeyPem);
  58.         // Save the server certificate request to a file (optional)
  59.         // const serverCertReqPem = forge.pki.certificationRequestToPem(
  60.         //         forge.pki.createCertificationRequest({ publicKey: serverKeys.publicKey })
  61.         // );
  62.         // fs.writeFileSync("localhost.csr", serverCertReqPem);
  64.         // Save the server certificate to a file
  65.         const serverCertPem = forge.pki.certificateToPem(serverCert);
  66.         // fs.writeFileSync("localhost.crt", serverCertPem);
  68.         return {
  69.                 cert: serverCertPem,
  70.                 key: serverPrivateKeyPem,
  71.                 ca: ca.crt,
  72.         };

型
然后我为节点的https服务器设置ssl证书，并在Firefox的证书管理器中的Authorities选项卡下导入CA证书。

  1. SEC_ERROR_UNKNOWN_ISSUER

型
我尝试用node-forge重新创建this tutorial，但显然没有成功。
当我将CA证书导入Windows存储时，Chrome可以正常工作并接受CA和SSL证书。但Firefox不接受。那么我如何使Firefox接受我自制的证书？

ssl

1条答案

按热度按时间
8iwquhpp

8iwquhpp1#

原来，证书是如此糟糕，他们基本上没有工作的任何地方。但我修复了它，这里的代码：

  1. function toPositiveHex(hexString) {
  2.         var mostSiginficativeHexAsInt = parseInt(hexString[0], 16);
  3.         if (mostSiginficativeHexAsInt < 8) {
  4.                 return hexString;
  5.         }
  7.         mostSiginficativeHexAsInt -= 8;
  8.         return mostSiginficativeHexAsInt.toString() + hexString.substring(1);
  9. }
  11. const caAttrs = [
  12.         {
  13.                 name: "commonName",
  14.                 value: "Company-CA",
  15.         },
  16.         {
  17.                 name: "countryName",
  18.                 value: "US",
  19.         },
  20.         {
  21.                 shortName: "OU",
  22.                 value: "Company-CA",
  23.         },
  24. ];
  25. const siteAttrs = [
  26.         {
  27.                 name: "commonName",
  28.                 value: "LocalWebsite",
  29.         },
  30.         {
  31.                 name: "countryName",
  32.                 value: "US",
  33.         },
  34.         {
  35.                 name: "organizationName",
  36.                 value: "LocalWebsite",
  37.         },
  38.         {
  39.                 shortName: "OU",
  40.                 value: "LocalWebsite",
  41.         },
  42. ];
  44. async function generateCA(options = {}) {
  45.         const keyPair = forge.pki.rsa.generateKeyPair(4096);
  47.         const cert = forge.pki.createCertificate();
  49.         cert.serialNumber = toPositiveHex(forge.util.bytesToHex(forge.random.getBytesSync(9))); // the serial number can be decimal or hex (if preceded by 0x)
  51.         cert.validity.notBefore = new Date();
  52.         cert.validity.notAfter = new Date();
  53.         cert.validity.notAfter.setDate(cert.validity.notAfter.getDate() + (options.days || 1024));
  55.         cert.setSubject(caAttrs);
  57.         cert.publicKey = keyPair.publicKey;
  59.         cert.setIssuer(caAttrs);
  60.         cert.setExtensions([
  61.                 { name: "basicConstraints", cA: true },
  62.                 {
  63.                         name: "keyUsage",
  64.                         keyCertSign: true,
  65.                         digitalSignature: true,
  66.                         nonRepudiation: true,
  67.                         keyEncipherment: true,
  68.                         dataEncipherment: true,
  69.                 },
  70.                 {
  71.                         name: "subjectKeyIdentifier",
  72.                         keyIdentifier: cert.generateSubjectKeyIdentifier().getBytes(),
  73.                 },
  74.         ]);
  76.         cert.sign(keyPair.privateKey, forge.md.sha256.create());
  78.         var pem = {
  79.                 private: forge.pki.privateKeyToPem(keyPair.privateKey),
  80.                 public: forge.pki.publicKeyToPem(keyPair.publicKey),
  81.                 cert: forge.pki.certificateToPem(cert),
  82.         };
  83.         return {
  84.                 crt: pem.cert,
  85.                 pem: pem.public,
  86.                 key: pem.private,
  87.         };
  88. }
  89. async function generateForLocalhost(options = {}) {
  90.         // Load the Root CA private key and certificate
  91.         const ca = await generateCA();
  93.         const caPrivateKey = forge.pki.privateKeyFromPem(ca.key);
  94.         const caCert = forge.pki.certificateFromPem(ca.crt);
  96.         var clientkeys = forge.pki.rsa.generateKeyPair(options.clientCertificateKeySize || 4096);
  97.         var cert = forge.pki.createCertificate();
  98.         cert.serialNumber = toPositiveHex(forge.util.bytesToHex(forge.random.getBytesSync(9)));
  99.         cert.validity.notBefore = new Date();
  100.         cert.validity.notAfter = new Date(new Date().setDate(new Date().getDate() + 7));
  102.         cert.setIssuer(caAttrs);
  103.         cert.setSubject(siteAttrs);
  104.         cert.setExtensions([
  105.                 {
  106.                         name: "subjectAltName",
  107.                         altNames: [
  108.                                 { type: 2, value: "localhost" },
  109.                                 { type: 7, ip: "127.0.0.1" },
  110.                                 { type: 7, ip: "192.168.0.193" },
  111.                         ],
  112.                 },
  113.                 {
  114.                         name: "keyUsage",
  115.                         keyEncipherment: true,
  116.                         digitalSignature: true,
  117.                         nonRepudiation: true,
  118.                         keyAgreement: true,
  119.                 },
  120.                 {
  121.                         name: "extKeyUsage",
  122.                         serverAuth: true,
  123.                         clientAuth: true,
  124.                         codeSigning: true,
  125.                         emailProtection: true,
  126.                         timeStamping: true,
  127.                 },
  128.                 {
  129.                         name: "authorityKeyIdentifier",
  130.                         keyIdentifier: caCert.generateSubjectKeyIdentifier().getBytes(),
  131.                 },
  132.         ]);
  134.         cert.publicKey = clientkeys.publicKey;
  136.         // Sign client cert with root cert
  137.         cert.sign(caPrivateKey, forge.md.sha256.create());
  139.         const pem = {};
  140.         pem.clientprivate = forge.pki.privateKeyToPem(clientkeys.privateKey);
  141.         pem.clientpublic = forge.pki.publicKeyToPem(clientkeys.publicKey);
  142.         pem.clientcert = forge.pki.certificateToPem(cert);
  144.         return {
  145.                 cert: pem.clientcert,
  146.                 key: pem.clientprivate,
  147.                 ca: ca.crt,
  148.         };
  149. }

字符串
有点不干净，所以按照你的喜好整理一下。

展开查看全部
赞(0）分享  回复(0）举报  2024-01-08
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com