<

1.HTTP #

1.1 HTTP服务器 # 

tcp.port == 7788

let http = require('http');
http.createServer(function (req, res) {
    let buffer = Buffer.from('hello');
    console.log(buffer);
    res.end(buffer);
}).listen(7788, () => console.log('listening 7788'));

1.2 HTTP三大风险 #

2. HTTPS #

风险 对策 方法
信息窃听 信息加密 对称加密 AES
密钥传递 密钥协商 非对称加密(RSA和ECC)
信息篡改 完整性校验 散列算法(MD5和SHA)
身份冒充 CA权威机构 散列算法(MD5和SHA)+RSA签名

3. 加密算法 #

3.1 对称加密 AES #

3.2 非对称加密 #

3.3 哈希算法 #

5.hashkey

3.4 签名 #

verify3

3.5 数字证书 #

certification3

3.6 密钥交换 #

3.7 ECC # 

let basic = 3;//共享basic
let a = 5;
let basicA = basic * a;//15
let b = 7;
let basicB = basic * b;//21

console.log(a * basicB);//105
console.log(b * basicA);//105

4. 加密过程 #

4.1 ClientHello #

1.clienthello.png

4.2 ServerHello #

serverres

serverhello

4.3 Certificate #

4.certificate.png

4.4 ServerKeyExchange #

5.serverkeyexchange.png

4.5 Server Hello Done #

6.serverhellodone.png

4.6 ClientKeyExchange #

clientkeyexchange

4.7 ChangeCipherSpec #

ChangeCipherSpec

4.8 EncryptedHandshakeMessage # 

加密(SHA(客户端随机数+服务器随机数))

EncryptedHandshakeMessage

4.9 New Session Ticket #

NewSessionTicket

11.NewSessionTicket

5.openssl #

5.1 查看版本 # 

openssl version -a

5.2 摘要算法 # 

openssl dgst -help

echo 123 > msg.txt
openssl dgst -md5  msg.txt
openssl dgst -sha1  msg.txt
openssl dgst -sha256  msg.txt

5.3 对称加密 # 

openssl enc -help

openssl  enc -e -aes128 -a -k 123456789  -in msg.txt  -out enc_msg.txt
openssl  enc -d -aes128 -a -k 123456789  -in enc_msg.txt  -out dec_msg.txt

openssl  enc -e -aes128 -a -pass pass:123456  -in msg.txt  -out enc_msg.txt -P
openssl  enc -d -aes128 -a -pass pass:123456  -in enc_msg.txt  -out dec_msg.txt

5.5 RSA非对称加密 #

5.5.1 RSA #

5.5.1.1 RSA生成公私钥 # 
openssl genrsa -help

//生成加密的私钥
openssl genrsa -aes256 -passout pass:123456 -out private.key 2048
//生成不加密的私钥
openssl genrsa  -out private.key 1024
//生成公钥
openssl rsa -pubout -in private.key  -out  public.key
5.5.1.2 RSA加解密 # 
openssl rsautl -help

//公钥加密
openssl rsautl -encrypt -inkey public.key  -pubin  -in msg.txt  -out enc.msg.txt 
//私钥解密
openssl rsautl -decrypt -inkey private.key -in enc.msg.txt   -out  dec.msg.txt
5.5.1.3 数字签名 # 
//摘要后使用RSA私钥签名，摘要算法sha256
openssl dgst -sign private.key -sha256 -out  sign.msg.txt  msg.txt
//使用RSA公钥验证签名
openssl dgst -verify  public.key -sha256 -signature sign.msg.txt  msg.txt

5.5.2 ECDSA #

5.5.2.1 生成公私钥 # 
//生成ecdsa私钥
openssl ecparam -genkey  -name secp256k1 -out ec.private.key
//提取 ecdsa 公钥
openssl ec -in ec.private.key -pubout -out ec.public.key
5.5.2.2 数字签名 # 
//使用ECDSA私钥进行签名 (sha256) 
openssl  dgst -sign ec.private.key  -sha256 -out sign.msg  msg.txt
//使用ECDSA公钥进行签名验证
openssl dgst -verify ec.public.key -sha256 -signature sign.msg  msg.txt

6.证书体系（PKI） #

6.1. 生成自签的根证书 # 

//1.生成CA私钥
openssl genrsa -out ca.private.key  2048
//2.根据CA私钥生成根证书
openssl req -new -x509 -key ca.private.key  -out ca.crt  -days 365  -subj /C=CN/ST=BeiJing/L=BeiJing/O=ca/OU=ca/CN=www.ca.com/emailAddress=ca@qq.com

6.2.服务器证书申请 # 

//1.生成服务器私钥
openssl genrsa -out server.private.key 2048
//2.创建证书签名申请CSR(certificate signing request)并且发送给CA
openssl req -new -key server.private.key -out server.csr -subj  /C=CN/ST=BeiJing/L=BeiJing/O=47.105.67.214/OU=47.105.67.214/CN=47.105.67.214/emailAddress=47.105.67.214@qq.com
//3.签发证书
openssl x509 -req -days 365  -CA ca.crt -CAkey ca.private.key -CAcreateserial  -in  server.csr  -out server.crt

7.nginx #

7.1 安装 # 

yum -y install gcc gcc-c++ pcre-devel zlib-devel

wget https://nginx.org/download/nginx-1.12.2.tar.gz
wget https://www.openssl.org/source/openssl-1.1.0h.tar.gz
tar zxf nginx-1.12.2.tar.gz
tar zxf openssl-1.1.0h
cd nginx-1.12.2

groupadd nginx
// -M 不要自动建立用户的登入目录 -s 不能登录的shell
useradd nginx  -M -s /sbin/nologin -g nginx

mkdir -p /usr/nginx
mkdir -p /usr/nginx/logs  
mkdir -p /usr/nginx/cache

./configure  --prefix=/usr/nginx   --with-http_ssl_module --with-openssl=/root/openssl-1.1.0h        --with-http_ssl_module --user=nginx --group=nginx

make 
make install

export PATH=/usr/nginx/sbin:$PATH
nginx -t
nginx -V
nginx
netstat -ntlp

7.2 布署证书 # 

    server {
        listen       443 ssl;
        server_name  localhost;

+       ssl_certificate      /root/server.crt;
+       ssl_certificate_key  /root/server.private.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }

8. tls安全 #

8.1 证书吊销 #

8.1 证书链 #

8.2 多域名证书与泛域名证书 #

8.2 安全的优化 #