【网络工程】CDN 与 HTTPS：边缘 TLS、证书管理与安全

# 在源站部署 Cloudflare Origin CA 证书

# 1. 通过 Cloudflare API 生成 Origin CA 证书
curl -X POST "https://api.cloudflare.com/client/v4/certificates" \
  -H "X-Auth-Key: $CF_API_KEY" \
  -H "X-Auth-Email: admin@example.com" \
  -H "Content-Type: application/json" \
  -d '{
    "hostnames": ["example.com", "*.example.com"],
    "requested_validity": 5475,
    "request_type": "origin-rsa",
    "csr": "'"$(cat server.csr)"'"
  }'

# 2. 保存证书
# 将返回的 certificate 保存为 origin-cert.pem

# 3. 源站 Nginx 配置
cat > /etc/nginx/conf.d/origin-tls.conf << 'CONF'
server {
    listen 443 ssl;
    server_name example.com;
    
    # Cloudflare Origin CA 证书
    ssl_certificate     /etc/nginx/ssl/origin-cert.pem;
    ssl_certificate_key /etc/nginx/ssl/origin-key.pem;
    
    # 只允许 Cloudflare IP 访问（安全加固）
    # https://www.cloudflare.com/ips/
    allow 173.245.48.0/20;
    allow 103.21.244.0/22;
    allow 103.22.200.0/22;
    allow 103.31.4.0/22;
    allow 141.101.64.0/18;
    allow 108.162.192.0/18;
    allow 190.93.240.0/20;
    allow 188.114.96.0/20;
    allow 197.234.240.0/22;
    allow 198.41.128.0/17;
    deny all;
    
    location / {
        proxy_pass http://localhost:8080;
    }
}
CONF

# cdn_cert_manager.py — CDN 证书自动化管理
import json
import time
import subprocess
from datetime import datetime, timedelta

class CDNCertManager:
    """管理 CDN 边缘节点的证书生命周期"""
    
    def __init__(self, cdn_api_url, api_token):
        self.cdn_api_url = cdn_api_url
        self.api_token = api_token
        self.cert_store = {}  # domain -> cert_info
    
    def check_expiry(self):
        """检查所有证书的到期时间"""
        expiring_soon = []
        
        for domain, info in self.cert_store.items():
            days_left = (info['not_after'] - datetime.utcnow()).days
            
            if days_left <= 30:
                expiring_soon.append({
                    'domain': domain,
                    'days_left': days_left,
                    'serial': info['serial'],
                    'issuer': info['issuer'],
                })
                
                if days_left <= 0:
                    print(f"[CRITICAL] {domain} 证书已过期!")
                elif days_left <= 7:
                    print(f"[WARNING]  {domain} 证书将在 {days_left} 天后过期")
                else:
                    print(f"[INFO]     {domain} 证书将在 {days_left} 天后过期")
        
        return expiring_soon
    
    def renew_certificate(self, domain):
        """使用 ACME 续期证书"""
        print(f"Renewing certificate for {domain}...")
        
        # 使用 certbot 签发证书（DNS-01 验证）
        result = subprocess.run([
            'certbot', 'certonly',
            '--dns-cloudflare',
            '--dns-cloudflare-credentials', '/etc/letsencrypt/cloudflare.ini',
            '-d', domain,
            '-d', f'*.{domain}',
            '--preferred-challenges', 'dns-01',
            '--non-interactive',
            '--agree-tos',
        ], capture_output=True, text=True)
        
        if result.returncode != 0:
            raise Exception(f"Certificate renewal failed: {result.stderr}")
        
        # 读取新证书
        cert_path = f'/etc/letsencrypt/live/{domain}/fullchain.pem'
        key_path = f'/etc/letsencrypt/live/{domain}/privkey.pem'
        
        with open(cert_path) as f:
            cert_pem = f.read()
        with open(key_path) as f:
            key_pem = f.read()
        
        return cert_pem, key_pem
    
    def deploy_to_cdn(self, domain, cert_pem, key_pem):
        """将证书部署到 CDN 边缘节点"""
        import requests
        
        response = requests.put(
            f"{self.cdn_api_url}/certificates/{domain}",
            headers={
                'Authorization': f'Bearer {self.api_token}',
                'Content-Type': 'application/json',
            },
            json={
                'certificate': cert_pem,
                'private_key': key_pem,
            }
        )
        
        if response.status_code != 200:
            raise Exception(f"CDN deployment failed: {response.text}")
        
        result = response.json()
        print(f"Certificate deployed to {result['edge_nodes_count']} edge nodes")
        print(f"Propagation time: ~{result['estimated_propagation_seconds']}s")
        
        return result
    
    def verify_deployment(self, domain, expected_serial):
        """验证证书在边缘节点是否生效"""
        import ssl
        import socket
        
        # 测试多个 PoP 节点
        test_resolvers = {
            'US-East': '1.1.1.1',
            'EU-West': '1.0.0.1',
            'AP-East': '8.8.8.8',
        }
        
        results = {}
        for region, resolver in test_resolvers.items():
            try:
                context = ssl.create_default_context()
                with socket.create_connection((domain, 443), timeout=10) as sock:
                    with context.wrap_socket(sock, server_hostname=domain) as ssock:
                        cert = ssock.getpeercert()
                        serial = cert.get('serialNumber', '')
                        not_after = cert.get('notAfter', '')
                        
                        results[region] = {
                            'serial_match': serial == expected_serial,
                            'not_after': not_after,
                            'version': ssock.version(),
                        }
            except Exception as e:
                results[region] = {'error': str(e)}
        
        return results

#!/bin/bash
# cert-monitor.sh — 批量检查 CDN 证书到期时间

DOMAINS=(
    "www.example.com"
    "api.example.com"
    "cdn.example.com"
    "static.example.com"
)

ALERT_DAYS=30
CRITICAL_DAYS=7

check_cert() {
    local domain=$1
    
    # 获取证书信息
    cert_info=$(echo | openssl s_client -servername "$domain" \
        -connect "$domain:443" 2>/dev/null | \
        openssl x509 -noout -dates -subject -issuer -serial 2>/dev/null)
    
    if [ $? -ne 0 ]; then
        echo "[ERROR] $domain: 无法获取证书"
        return 1
    fi
    
    # 解析到期时间
    not_after=$(echo "$cert_info" | grep "notAfter" | cut -d= -f2)
    expiry_epoch=$(date -d "$not_after" +%s 2>/dev/null)
    now_epoch=$(date +%s)
    days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
    
    # 解析证书信息
    issuer=$(echo "$cert_info" | grep "issuer" | sed 's/issuer=//')
    serial=$(echo "$cert_info" | grep "serial" | cut -d= -f2)
    
    # 检查 TLS 版本
    tls_version=$(echo | openssl s_client -servername "$domain" \
        -connect "$domain:443" 2>/dev/null | grep "Protocol" | awk '{print $3}')
    
    # 输出结果
    if [ $days_left -le 0 ]; then
        echo "[CRITICAL] $domain: 证书已过期 ${days_left#-} 天"
    elif [ $days_left -le $CRITICAL_DAYS ]; then
        echo "[CRITICAL] $domain: 证书将在 $days_left 天后过期"
    elif [ $days_left -le $ALERT_DAYS ]; then
        echo "[WARNING]  $domain: 证书将在 $days_left 天后过期"
    else
        echo "[OK]       $domain: 证书有效期剩余 $days_left 天 (TLS $tls_version)"
    fi
    
    echo "           签发者: $issuer"
    echo "           到期日: $not_after"
    echo "           序列号: $serial"
}

echo "=== CDN Certificate Monitor ==="
echo "Date: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
echo ""

for domain in "${DOMAINS[@]}"; do
    check_cert "$domain"
    echo ""
done

# prometheus/rules/cert-alerts.yml
groups:
  - name: certificate_alerts
    rules:
      - alert: CertificateExpiringSoon
        expr: probe_ssl_earliest_cert_expiry - time() < 30 * 24 * 3600
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "证书即将过期: {{ $labels.instance }}"
          description: "{{ $labels.instance }} 的 TLS 证书将在 {{ $value | humanizeDuration }} 后过期"
      
      - alert: CertificateExpiryCritical
        expr: probe_ssl_earliest_cert_expiry - time() < 7 * 24 * 3600
        for: 10m
        labels:
          severity: critical
        annotations:
          summary: "证书即将过期（紧急）: {{ $labels.instance }}"
          description: "{{ $labels.instance }} 的 TLS 证书将在 {{ $value | humanizeDuration }} 后过期，请立即续期"

# 检查 OCSP Stapling 状态
echo | openssl s_client -servername www.example.com \
    -connect www.example.com:443 -status 2>/dev/null | \
    grep -A 5 "OCSP Response Status"

# 正常输出：
# OCSP Response Status: successful (0x0)
# OCSP Response Data:
#     OCSP Response Status: successful (0x0)
#     Cert Status: good
#     This Update: Jul 18 00:00:00 2025 GMT

# 如果输出 "OCSP response: no response sent"
# 说明 Stapling 未生效，需要检查：
# 1. ssl_trusted_certificate 路径是否正确
# 2. DNS 解析器是否可达
# 3. OCSP 服务器是否响应

#!/bin/bash
# rotate-ticket-key.sh — TLS Session Ticket Key 轮换

KEY_DIR="/etc/nginx/ssl"
CURRENT_KEY="$KEY_DIR/ticket-current.key"
PREVIOUS_KEY="$KEY_DIR/ticket-previous.key"

# 保留旧 key 用于解密已有 ticket
cp "$CURRENT_KEY" "$PREVIOUS_KEY"

# 生成新 key（48 字节）
openssl rand 48 > "$CURRENT_KEY"
chmod 600 "$CURRENT_KEY" "$PREVIOUS_KEY"

# 分发到所有边缘节点
for node in $(cat /etc/nginx/edge-nodes.txt); do
    scp "$CURRENT_KEY" "$PREVIOUS_KEY" "$node:$KEY_DIR/"
    ssh "$node" "nginx -s reload"
done

echo "Ticket key rotated at $(date)"

# RSA 2048 签名性能
$ openssl speed rsa2048
                  sign    verify    sign/s verify/s
rsa 2048 bits   0.000932s 0.000029s   1073.0  34892.2

# ECDSA P-256 签名性能
$ openssl speed ecdsap256
                              sign    verify    sign/s verify/s
256 bits ecdsa (nistp256)   0.000034s 0.000098s  29387.5  10255.0

# ECDSA 签名速度是 RSA 的 27 倍
# RSA 验证速度是 ECDSA 的 3.4 倍
# TLS 握手中服务端做签名（ECDSA 优势），客户端做验证（RSA 优势）
# 综合考虑：ECDSA 在 TLS 场景更优（签名是瓶颈）

# 查询 CT 日志中你的域名的所有证书
# 使用 crt.sh（CT 日志聚合器）
curl -s "https://crt.sh/?q=example.com&output=json" | \
    python3 -c "
import json, sys
certs = json.load(sys.stdin)
for c in sorted(certs, key=lambda x: x['not_before'], reverse=True)[:10]:
    print(f\"签发日期: {c['not_before']}  到期: {c['not_after']}\")
    print(f\"签发者: {c['issuer_name']}\")
    print(f\"域名: {c['common_name']}\")
    print()
"

# 监控是否有未授权的证书签发
# 如果发现不是你签发的证书 → 可能是 CA 被入侵或 DNS 劫持

# 1. 证书链不完整
$ curl -v https://www.example.com 2>&1 | grep -E "(SSL|certificate)"
# 错误: SSL certificate problem: unable to get local issuer certificate
# 原因: CDN 未部署中间证书
# 修复: 上传 fullchain.pem（包含中间证书）

# 2. 证书域名不匹配
$ echo | openssl s_client -servername www.example.com \
    -connect www.example.com:443 2>/dev/null | \
    openssl x509 -noout -text | grep -A1 "Subject Alternative Name"
# 如果 SAN 中没有 www.example.com → 证书域名不匹配

# 3. 混合内容（Mixed Content）
# HTTPS 页面加载 HTTP 资源 → 浏览器阻止
# 排查方法：
curl -s https://www.example.com | grep -i "http://"

# 4. HSTS 导致无法回退 HTTP
# 如果错误配置了 HSTS，用户无法通过 HTTP 访问
# 浏览器清除方法：
# Chrome: chrome://net-internals/#hsts → Delete domain
# Firefox: 清除历史记录 → 站点设置

# 5. TLS 版本不兼容
$ openssl s_client -servername www.example.com \
    -connect www.example.com:443 \
    -tls1_2 2>&1 | head -5
# 如果失败 → CDN 可能禁用了 TLS 1.2
# 影响: 旧设备（Android 4.x, IE 10）无法访问

#!/bin/bash
# cdn-tls-audit.sh — CDN HTTPS 完整诊断

DOMAIN="${1:-www.example.com}"

echo "=== CDN TLS Audit: $DOMAIN ==="
echo ""

# 1. 证书信息
echo "--- Certificate Info ---"
echo | openssl s_client -servername "$DOMAIN" \
    -connect "$DOMAIN:443" 2>/dev/null | \
    openssl x509 -noout -subject -issuer -dates -serial

echo ""

# 2. TLS 版本
echo "--- TLS Version ---"
for ver in tls1 tls1_1 tls1_2 tls1_3; do
    result=$(echo | openssl s_client -servername "$DOMAIN" \
        -connect "$DOMAIN:443" -"$ver" 2>&1 | grep "Protocol")
    if [ $? -eq 0 ]; then
        echo "  $ver: SUPPORTED ($result)"
    else
        echo "  $ver: NOT SUPPORTED"
    fi
done

echo ""

# 3. OCSP Stapling
echo "--- OCSP Stapling ---"
echo | openssl s_client -servername "$DOMAIN" \
    -connect "$DOMAIN:443" -status 2>/dev/null | \
    grep "OCSP Response Status"

echo ""

# 4. 安全头部
echo "--- Security Headers ---"
headers=$(curl -sI "https://$DOMAIN" 2>/dev/null)
for header in "Strict-Transport-Security" "X-Content-Type-Options" \
    "X-Frame-Options" "Content-Security-Policy" "Referrer-Policy"; do
    value=$(echo "$headers" | grep -i "$header" | head -1)
    if [ -n "$value" ]; then
        echo "  ✓ $value"
    else
        echo "  ✗ $header: MISSING"
    fi
done

echo ""

# 5. 证书链验证
echo "--- Certificate Chain ---"
echo | openssl s_client -servername "$DOMAIN" \
    -connect "$DOMAIN:443" -showcerts 2>/dev/null | \
    grep -E "s:|i:" | head -10

echo ""
echo "Audit complete."