nginx双向认证证书

http://www.360doc.com/content/14/0817/17/18924983_402625447.shtml

ca密匙
openssl genrsa -out cakey.pem 2048
ca请求证书
openssl req -new -key cakey.pem -out careq.csr -days 3650 -subj /C=CN/ST=HB/L=SJZ/O=CCIT/OU=CCIT/CN=fym/emailAddress=test@test.com  

ca签名
openssl x509 -req -in careq.csr -out ca.crt -signkey cakey.pem -days 3650
ca转换为der
openssl x509 -in ca.crt -out ca.der -outform DER


服务器证书
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out serverreq.csr -days 3650 -subj /C=CN/ST=HB/L=SJZ/O=CCIT/OU=CCIT/CN=fym/emailAddress=test@test.com  
openssl x509 -req -in serverreq.csr -out server.crt -days 3650 -CA ca.crt -CAkey cakey.pem -CAcreateserial

客户端证书
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out clientreq.csr -days 3650 -subj /C=CN/ST=HB/L=SJZ/O=CCIT/OU=CCIT/CN=fym/emailAddress=test@test.com  
openssl x509 -req -in clientreq.csr -out client.crt -days 3650 -CA ca.crt -CAkey cakey.pem -CAcreateserial
openssl x509 -in client.crt -out client.der -outform DER
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12



nginx.conf配置：

ssl_certificate      server.crt;
ssl_certificate_key  server.key;
ssl_client_certificate  client.crt;    

 

 

package main

import (
     "crypto/tls"
     "crypto/x509"
     "fmt"
     "io/ioutil"
     "net/http"
 )

func main() {
     pool := x509.NewCertPool()
     caCertPath := "D:\\soft\\nginx-1.6.3\\conf\\tttttttt\\ca.crt"

    caCrt, err := ioutil.ReadFile(caCertPath)
     if err != nil {
         fmt.Println("ReadFile err:", err)
         return
     }
     pool.AppendCertsFromPEM(caCrt)

    cliCrt, err := tls.LoadX509KeyPair("D:\\soft\\nginx-1.6.3\\conf\\tttttttt\\client.crt", "D:\\soft\\nginx-1.6.3\\conf\\tttttttt\\client.key")
     if err != nil {
         fmt.Println("Loadx509keypair err:", err)
         return
     }

    tr := &http.Transport{
         TLSClientConfig: &tls.Config{
             InsecureSkipVerify: true,
             //RootCAs:      pool,
             Certificates: []tls.Certificate{cliCrt},
         },
     }
     client := &http.Client{Transport: tr}
     resp, err := client.Get("https://127.0.0.1:88")
     if err != nil {
         fmt.Println("Get error:", err)
         return
     }
     defer resp.Body.Close()
     body, err := ioutil.ReadAll(resp.Body)
     fmt.Println("body:",string(body))
}

 

 

curl -k https://127.0.0.1:88 --cert client.crt --key client.key --cacert ca.crt