生成的证书问题 about proxyee HOT 9 CLOSED

@cainwise
生成java支持的公钥和私钥

openssl genrsa -des3 -out ca.key 2048
openssl rsa -in ca.key -pubout -outform DER -out ca_pub.der
openssl pkcs8 -topk8 -nocrypt -inform PEM -outform DER -in ca.key -out ca_private.pem

再通过CA私钥生成CA证书

openssl req -sha256 -new -x509 -days 365 -key ca.key -out ca.crt \
    -subj "/C=CN/ST=GD/L=SZ/O=lee/OU=study/CN=proxyeeRoot"

可以参考下我写的一篇博客OpenSSL创建带SAN扩展的证书并进行CA自签

from proxyee.

@monkeyWie 很感谢您的回复 但是执行下面语句：
openssl rsa -in ca_private.pem -pubout -outform DER -out ca_pub.der
错误异常：
unable to load Private Key
10457:error:0906D06C:PEM routines:PEM_read_bio:no start line:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/pem/pem_lib.c:648:Expecting: ANY PRIVATE KEY

我的系统是mac
openssl版本是：OpenSSL 0.9.8zh 14 Jan 2016

from proxyee.

@cainwise
不好意思，生成公钥这步弄错了，是直接用ca.key来生成DER编码的公钥，2L已更新。

from proxyee.

@monkeyWie
按照2L的格式来生成密钥

抛出的堆栈信息如下：
警告: An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
java.io.IOException: 你的主机中的软件中止了一个已建立的连接。
at sun.nio.ch.SocketDispatcher.read0(Native Method)
at sun.nio.ch.SocketDispatcher.read(SocketDispatcher.java:43)
at sun.nio.ch.IOUtil.readIntoNativeBuffer(IOUtil.java:223)
at sun.nio.ch.IOUtil.read(IOUtil.java:192)
at sun.nio.ch.SocketChannelImpl.read(SocketChannelImpl.java:380)
at io.netty.buffer.PooledUnsafeDirectByteBuf.setBytes(PooledUnsafeDirectByteBuf.java:288)
at io.netty.buffer.AbstractByteBuf.writeBytes(AbstractByteBuf.java:1106)
at io.netty.channel.socket.nio.NioSocketChannel.doReadBytes(NioSocketChannel.java:373)
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:123)
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645)
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580)
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459)
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)
at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)
at java.lang.Thread.run(Thread.java:748)

from proxyee.

@monkeyWie
采用你git上面的证书ok
但是手动生成的都会出现5L的问题

1. 生成java支持的公钥和私钥

openssl genrsa -out ca.key 2048
openssl rsa -in ca.key -pubout -outform DER -out ca_pub.der
openssl pkcs8 -topk8 -nocrypt -inform PEM -outform DER -in ca.key -out ca_private.pem

2. 再通过CA私钥生成CA证书

openssl req -sha256 -new -x509 -days 365 -key ca.key -out ca.crt \
    -subj "/C=CN/ST=GD/L=SZ/O=lee/OU=study/CN=proxyeeRoot"

from proxyee.

@cainwise
会不会是openssl版本的问题，我这是Linux下，版本OpenSSL 1.0.1e-fips，测试没问题。

from proxyee.

@monkeyWie
是

openssl req -sha256 -new -x509 -days 365 -key ca.key -out ca.crt \
    -subj "/C=CN/ST=GD/L=SZ/O=lee/OU=study/CN=proxyeeRoot"

CN=proxyeeRoot 中的proxyeeRoot写错了需要大写ProxyeeRoot

from proxyee.

@cainwise
额，那问题是已经解决了吗？现在代码已经可以读取CA证书里的-sub内容来动态生成ssl证书了。

from proxyee.

@monkeyWie
问题解决了

from proxyee.