### 使用Python生成和签署HTTPS SSL/TLS证书 #### 创建根证书颁发机构 (CA) 为了创建自签名的根证书，可以使用 `cryptography` 库来简化操作： ```python from cryptography import x509 from cryptography.hazmat.primitives.asymmetric import rsa from cryptography.x509.oid import NameOID import datetime from cryptography.hazmat.primitives import hashes, serialization def create_ca(): private_key = rsa.generate_private_key( public_exponent=65537, key_size=2048, ) subject = issuer = x509.Name([ x509.NameAttribute(NameOID.COUNTRY_NAME, u"US"), x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u"California"), x509.NameAttribute(NameOID.LOCALITY_NAME, u"San Francisco"), x509.NameAttribute(NameOID.ORGANIZATION_NAME, u"My Company"), x509.NameAttribute(NameOID.COMMON_NAME, u"My CA"), ]) cert = x509.CertificateBuilder().subject_name( subject ).issuer_name( issuer ).public_key( private_key.public_key() ).serial_number( x509.random_serial_number() ).not_valid_before( datetime.datetime.utcnow() ).not_valid_after( datetime.datetime.utcnow() + datetime.timedelta(days=365 * 10) ).add_extension( x509.BasicConstraints(ca=True, path_length=None), critical=True, ).sign(private_key, hashes.SHA256()) with open("ca.key", "wb") as f: f.write(private_key.private_bytes( encoding=serialization.Encoding.PEM, format=serialization.PrivateFormat.TraditionalOpenSSL, encryption_algorithm=serialization.BestAvailableEncryption(b"passphrase"), # 设置密码 )) with open("ca.crt", "wb") as f: f.write(cert.public_bytes(serialization.Encoding.PEM)) create_ca() ``` 这段代码定义了一个函数用于创建并保存一个有效期十年的自签名根证书及其对应的私钥[^1]。 #### 发布服务器证书请求(CSR) 和 签署服务器证书 接着为Web服务器创建CSR，并通过之前建立好的CA对其进行签名： ```python def generate_csr_and_sign_server_cert(ca_key_path="ca.key", ca_cert_path="ca.crt"): server_private_key = rsa.generate_private_key( public_exponent=65537, key_size=2048, ) csr_builder = x509.CertificateSigningRequestBuilder().subject_name(x509.Name([ x509.NameAttribute(NameOID.COUNTRY_NAME, 'CN'), x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, 'Beijing'), x509.NameAttribute(NameOID.LOCALITY_NAME, 'Haidian District'), x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'My Organization Ltd.'), x509.NameAttribute(NameOID.COMMON_NAME, '*.example.com'), # 替换成自己的域名 ])).add_extension( x509.SubjectAlternativeName([x509.DNSName('*.example.com')]), # 添加SAN支持通配符子域 critical=False, ) csr = csr_builder.sign(server_private_key, hashes.SHA256()) with open("server.csr", "wb") as f: f.write(csr.public_bytes(serialization.Encoding.PEM)) with open(ca_key_path, "rb") as key_file: ca_privkey = serialization.load_pem_private_key(key_file.read(), password=b'passphrase') with open(ca_cert_path, "rb") as crt_file: ca_certificate = x509.load_pem_x509_certificate(crt_file.read()) builder = x509.CertificateBuilder().subject_name( csr.subject ).issuer_name( ca_certificate.subject ).public_key( csr.public_key() ).serial_number( x509.random_serial_number() ).not_valid_before( datetime.datetime.today() ).not_valid_after( datetime.datetime.today() + datetime.timedelta(days=365*5) ).add_extension( x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_certificate.public_key()), critical=False ).add_extension( x509.KeyUsage(digital_signature=True, content_commitment=False, key_encipherment=True, data_encipherment=False, key_agreement=False, encipher_only=False, decipher_only=False), critical=True ).add_extension( x509.ExtendedKeyUsage([x509.OID_SERVER_AUTH]), critical=True ).add_extension( x509.BasicConstraints(ca=False, path_length=None), critical=True ).add_extension( x509.SubjectAlternativeName([x509.DNSName(u'*.example.com')]), critical=False ) signed_cert = builder.sign(private_key=ca_privkey, algorithm=hashes.SHA256()) with open("server.crt", "wb") as f: f.write(signed_cert.public_bytes(serialization.Encoding.PEM)) generate_csr_and_sign_server_cert() ``` 上述脚本实现了两步过程：第一步构建了带有特定主题名称（Subject）和扩展字段（Extensions）的CSR；第二部分读取已有的CA密钥与证书作为发行者信息完成对新申请的服务器证书的正式签发工作[^2]. #### 验证生成的证书有效性 最后可以通过如下方式验证所生成证书的有效性: ```bash openssl verify -CAfile ca.crt server.crt ``` 这将返回一条消息确认该证书是由指定的CA有效发布的。如果没有报错则说明一切正常[^3].