【网络工程】证书工程：PKI 体系、ACME 与自动化管理

# 查看远程服务器证书
echo | openssl s_client -connect example.com:443 \
  -servername example.com 2>/dev/null | \
  openssl x509 -noout -text

# 查看本地证书文件
openssl x509 -in cert.pem -noout -text

# 只看关键信息
openssl x509 -in cert.pem -noout \
  -subject -issuer -dates -serial \
  -ext subjectAltName

# 输出示例:
# subject=CN = example.com
# issuer=C = US, O = Let's Encrypt, CN = R3
# notBefore=Jan  1 00:00:00 2025 GMT
# notAfter=Mar 31 23:59:59 2025 GMT
# serial=0A:1B:2C:3D:4E:5F:6A:7B:8C:9D
# X509v3 Subject Alternative Name:
#     DNS:example.com, DNS:www.example.com

# 查看证书指纹（用于证书固定）
openssl x509 -in cert.pem -noout -fingerprint -sha256
# SHA256 Fingerprint=AB:CD:EF:...

# 验证证书链
openssl verify -CAfile chain.pem cert.pem
# cert.pem: OK

# 格式转换
# PEM → DER
openssl x509 -in cert.pem -outform DER -out cert.der

# DER → PEM
openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem

# PEM 证书 + 私钥 → PKCS#12
openssl pkcs12 -export -out cert.p12 \
  -inkey key.pem -in cert.pem -certfile chain.pem

# PKCS#12 → PEM
openssl pkcs12 -in cert.p12 -out all.pem -nodes

# 验证证书链的完整性
openssl verify -show_chain \
  -CAfile /etc/ssl/certs/ca-certificates.crt \
  -untrusted intermediate.pem \
  server.pem

# 检查服务器返回的证书链
openssl s_client -connect example.com:443 \
  -servername example.com -showcerts 2>/dev/null | \
  grep -E "s:|i:|depth"
# depth=0: 叶子证书
# depth=1: 中间 CA
# depth=2: 根 CA (有时不包含)

# 常见错误: 服务器没有发送中间 CA 证书
# → 部分客户端（特别是移动端）无法验证证书
# 检查方法:
openssl s_client -connect example.com:443 \
  -servername example.com 2>&1 | \
  grep "Verify return code"
# 21 (unable to verify the first certificate)
# → 缺少中间 CA 证书

# 各平台的根 CA 信任存储位置

# Linux (Debian/Ubuntu)
ls /etc/ssl/certs/
# 或
ls /usr/share/ca-certificates/

# Linux (RHEL/CentOS)
ls /etc/pki/tls/certs/

# macOS
# 系统偏好设置 → 钥匙串访问 → 系统根证书

# 查看系统信任的根 CA 数量
awk -v cmd='openssl x509 -noout -subject' \
  '/BEGIN/{close(cmd)};{print | cmd}' \
  /etc/ssl/certs/ca-certificates.crt 2>/dev/null | \
  wc -l
# 约 130-150 个根 CA

# Java 的信任存储 (cacerts)
keytool -list -keystore "$JAVA_HOME/lib/security/cacerts" \
  -storepass changeit 2>/dev/null | grep -c "trustedCertEntry"

# 生成 RSA 密钥对和 CSR
openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key -out server.csr \
  -subj "/CN=example.com"

# 生成 ECDSA 密钥对和 CSR（推荐）
openssl ecparam -genkey -name prime256v1 -out server.key
openssl req -new -key server.key -out server.csr \
  -subj "/CN=example.com"

# 带 SAN 的 CSR（多域名证书）
openssl req -new -key server.key -out server.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com,DNS:api.example.com"

# 查看 CSR 内容
openssl req -in server.csr -noout -text

# CSR 包含:
#   - 公钥（从密钥对中提取）
#   - 请求的 Subject（域名等）
#   - 请求的扩展（SAN 等）
#   - 请求者的签名（证明持有私钥）
# CSR 不包含私钥——私钥永远不应离开服务器

# 安装 Certbot
# Debian/Ubuntu
apt-get install certbot

# 方式一: Standalone 模式（临时启动 Web 服务器）
# 需要 80 端口空闲
certbot certonly --standalone \
  -d example.com -d www.example.com \
  --email admin@example.com --agree-tos

# 方式二: Webroot 模式（使用已有 Web 服务器）
certbot certonly --webroot \
  -w /var/www/html \
  -d example.com -d www.example.com

# 方式三: Nginx 插件（自动配置 Nginx）
certbot --nginx -d example.com

# 方式四: DNS 验证（通配符证书）
certbot certonly --manual \
  --preferred-challenges dns \
  -d "*.example.com" -d example.com

# 证书文件位置
ls /etc/letsencrypt/live/example.com/
# cert.pem       ← 服务器证书
# chain.pem      ← 中间 CA 证书
# fullchain.pem  ← cert.pem + chain.pem（Nginx 使用这个）
# privkey.pem    ← 私钥

# 查看证书信息
certbot certificates
# Certificate Name: example.com
# Domains: example.com www.example.com
# Expiry Date: 2025-04-01 (VALID: 89 days)
# Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem

# 手动续期
certbot renew --dry-run  # 测试续期
certbot renew            # 实际续期

# 自动续期（systemd timer 或 cron）
# certbot 安装时通常已配置自动续期
systemctl list-timers | grep certbot
# 或
cat /etc/cron.d/certbot

# 使用 Cloudflare DNS 插件自动验证
pip install certbot-dns-cloudflare

# 配置 Cloudflare API 凭证
cat > /etc/letsencrypt/cloudflare.ini << 'EOF'
dns_cloudflare_api_token = your-api-token-here
EOF
chmod 600 /etc/letsencrypt/cloudflare.ini

# 签发通配符证书
certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d "*.example.com" -d example.com

# 支持的 DNS 提供商插件:
# certbot-dns-cloudflare
# certbot-dns-route53 (AWS)
# certbot-dns-google (GCP)
# certbot-dns-digitalocean
# certbot-dns-dnspod (腾讯云)
# certbot-dns-aliyun (阿里云, 第三方)

# 创建 CA 目录结构
mkdir -p /opt/ca/{root,intermediate}/{certs,crl,newcerts,private,csr}
touch /opt/ca/root/index.txt /opt/ca/intermediate/index.txt
echo 1000 > /opt/ca/root/serial
echo 1000 > /opt/ca/intermediate/serial

# 1. 生成根 CA 密钥和证书
openssl genrsa -aes256 -out /opt/ca/root/private/ca.key 4096
# 输入密码保护私钥

openssl req -new -x509 -days 7300 \
  -key /opt/ca/root/private/ca.key \
  -out /opt/ca/root/certs/ca.crt \
  -subj "/C=CN/O=MyOrg/CN=MyOrg Root CA"

# 2. 生成中间 CA 密钥和 CSR
openssl genrsa -aes256 -out /opt/ca/intermediate/private/intermediate.key 4096

openssl req -new \
  -key /opt/ca/intermediate/private/intermediate.key \
  -out /opt/ca/intermediate/csr/intermediate.csr \
  -subj "/C=CN/O=MyOrg/CN=MyOrg Intermediate CA"

# 3. 用根 CA 签发中间 CA 证书
openssl x509 -req -days 3650 \
  -in /opt/ca/intermediate/csr/intermediate.csr \
  -CA /opt/ca/root/certs/ca.crt \
  -CAkey /opt/ca/root/private/ca.key \
  -CAcreateserial \
  -out /opt/ca/intermediate/certs/intermediate.crt \
  -extfile <(echo -e "basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,digitalSignature,keyCertSign,cRLSign")

# 4. 签发服务器证书
openssl genrsa -out /opt/ca/intermediate/private/server.key 2048

openssl req -new \
  -key /opt/ca/intermediate/private/server.key \
  -out /opt/ca/intermediate/csr/server.csr \
  -subj "/CN=myapp.internal"

openssl x509 -req -days 365 \
  -in /opt/ca/intermediate/csr/server.csr \
  -CA /opt/ca/intermediate/certs/intermediate.crt \
  -CAkey /opt/ca/intermediate/private/intermediate.key \
  -CAcreateserial \
  -out /opt/ca/intermediate/certs/server.crt \
  -extfile <(echo -e "subjectAltName=DNS:myapp.internal,DNS:*.myapp.internal\nextendedKeyUsage=serverAuth\nbasicConstraints=CA:FALSE")

# 5. 构建完整证书链
cat /opt/ca/intermediate/certs/server.crt \
    /opt/ca/intermediate/certs/intermediate.crt \
    > /opt/ca/intermediate/certs/server-fullchain.crt

# 验证
openssl verify -CAfile /opt/ca/root/certs/ca.crt \
  -untrusted /opt/ca/intermediate/certs/intermediate.crt \
  /opt/ca/intermediate/certs/server.crt
# server.crt: OK

# 安装 step CLI 和 step-ca
# https://smallstep.com/docs/step-ca/installation

# 初始化 CA
step ca init --name "MyOrg CA" \
  --dns ca.myorg.internal \
  --address :8443 \
  --provisioner admin

# 启动 CA 服务器
step-ca $(step path)/config/ca.json

# 签发证书
step ca certificate myapp.internal \
  server.crt server.key \
  --ca-url https://ca.myorg.internal:8443

# step-ca 支持 ACME 协议
# 内部服务可以用 certbot 对接私有 CA
certbot certonly --standalone \
  --server https://ca.myorg.internal:8443/acme/acme/directory \
  -d myapp.internal

# 安装 cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml

# 等待 Pod 就绪
kubectl -n cert-manager get pods -w

# ClusterIssuer 配置 (Let's Encrypt)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx

# Certificate 资源
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com-tls
  namespace: default
spec:
  secretName: example-com-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - example.com
  - www.example.com
  duration: 2160h    # 90 天
  renewBefore: 720h  # 到期前 30 天自动续期

# Ingress 中使用证书
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - example.com
    - www.example.com
    secretName: example-com-tls-secret
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 80

# 查看证书状态
kubectl get certificates
# NAME               READY   SECRET                    AGE
# example-com-tls    True    example-com-tls-secret    5m

# 查看证书详情
kubectl describe certificate example-com-tls

# 查看 CertificateRequest
kubectl get certificaterequest

# 手动触发续期
kubectl cert-manager renew example-com-tls

#!/bin/bash
# cert_monitor.sh — 批量检查证书过期时间
# 用法: ./cert_monitor.sh domains.txt

WARN_DAYS=30
CRIT_DAYS=7
DOMAINS_FILE="${1:?Usage: $0 domains.txt}"

echo "=== 证书过期检查 $(date '+%Y-%m-%d %H:%M') ==="

while IFS= read -r domain; do
  [[ -z "$domain" || "$domain" == \#* ]] && continue
  
  # 获取证书过期时间
  expiry=$(echo | timeout 5 openssl s_client \
    -connect "$domain:443" -servername "$domain" \
    2>/dev/null | \
    openssl x509 -noout -enddate 2>/dev/null | \
    cut -d= -f2)
  
  if [[ -z "$expiry" ]]; then
    echo "ERROR  $domain — 无法获取证书"
    continue
  fi
  
  # 计算剩余天数
  expiry_epoch=$(date -d "$expiry" +%s 2>/dev/null)
  now_epoch=$(date +%s)
  days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
  
  # 状态判断
  if [[ $days_left -lt 0 ]]; then
    echo "EXPIRED $domain — 已过期 $((-days_left)) 天"
  elif [[ $days_left -lt $CRIT_DAYS ]]; then
    echo "CRITICAL $domain — 还剩 ${days_left} 天 (到期: $expiry)"
  elif [[ $days_left -lt $WARN_DAYS ]]; then
    echo "WARNING  $domain — 还剩 ${days_left} 天 (到期: $expiry)"
  else
    echo "OK       $domain — 还剩 ${days_left} 天"
  fi
done < "$DOMAINS_FILE"

# Blackbox Exporter 配置
# /etc/blackbox_exporter/config.yml
modules:
  tls_check:
    prober: tcp
    timeout: 5s
    tcp:
      tls: true
      tls_config:
        insecure_skip_verify: false

# Prometheus 采集配置
# prometheus.yml
scrape_configs:
  - job_name: 'ssl_expiry'
    metrics_path: /probe
    params:
      module: [tls_check]
    static_configs:
      - targets:
        - example.com:443
        - api.example.com:443
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: blackbox-exporter:9115

# 生成 ECDSA 密钥对（推荐 P-256）
openssl ecparam -genkey -name prime256v1 | \
  openssl ec -out ecdsa.key

# 对比 RSA 和 ECDSA 的签名性能
openssl speed rsa2048 ecdsap256
# rsa 2048 bits:  sign: 1200/s  verify: 42000/s
# ecdsa P-256:    sign: 35000/s verify: 12000/s
# → ECDSA 签名快 29 倍（TLS 握手中服务器签名）
# → RSA 验证快 3.5 倍（TLS 握手中客户端验证）
# → 综合考虑，ECDSA 在握手中更高效

# Let's Encrypt 支持 ECDSA 证书
certbot certonly --standalone \
  -d example.com \
  --key-type ecdsa --elliptic-curve secp256r1

# 续期失败的常见原因和排查

# 1. 80 端口被占用（Standalone 模式）
ss -tlnp | grep :80
# → 需要临时停止 Web 服务器或使用 Webroot 模式

# 2. DNS 解析问题（DNS 验证模式）
dig _acme-challenge.example.com TXT
# → 检查 DNS API 权限和网络连通性

# 3. 防火墙阻断
# Let's Encrypt 的验证服务器需要访问你的 80/443 端口
# 检查是否有 IP 白名单限制

# 4. 续期后未重载服务
# certbot 支持 deploy hook
certbot renew --deploy-hook "systemctl reload nginx"

# 5. 配置 Cron 定时续期
# 每天凌晨 2 点检查并续期
0 2 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

# 验证续期流程
certbot renew --dry-run --verbose

# Nginx 零停机证书轮换
# 1. 更新证书文件（certbot renew 已完成）
# 2. 热重载 Nginx（不中断现有连接）
nginx -t && nginx -s reload

# 或使用 systemctl
nginx -t && systemctl reload nginx

# 验证新证书已生效
echo | openssl s_client -connect localhost:443 \
  -servername example.com 2>/dev/null | \
  openssl x509 -noout -dates
# 确认 notAfter 是新的日期