Channel: CodeSection,代码区,网络安全 - CodeSec
Viewing all articles
Browse latest Browse all 12749



2015年5月HTTP/2 标准协议正式发布后,已得到绝大部分的浏览器的支持,但截止发文时使用的网站占比还不到1/3。 本文目的是为了快速搭建一个本地 HTTP/2 服务,以供研发小伙伴开发测试,从而加深对 HTTP/2 的理解。

环境 OpenSSL : 1.0.2q Nginx : 1.15.7 步骤 生成本地根证书: # 使用AES256-bit编码加密生成4096位的根秘钥 openssl genrsa -aes256 -out rootCA.key 4096 Enter pass phrase for rootCA.key: password Verifying - Enter pass phrase for rootCA.key: password 复制代码

各参数可以查看 man ca 或者 查阅这里。

# 使用根秘钥生成根证书 openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem Enter pass phrase for rootCA.key: password You are about to be asked to enter information that will be incorporated ... ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:Lovecoding.org Organizational Unit Name (eg, section) []:Lovecoding CA Common Name (e.g. server FQDN or YOUR name) []:Lovecoding ROOT CA Email Address []: Generating a RSA private key 复制代码 生成本地自签证书 #生成自签秘钥 openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config server.csr.cnf #生成自签证书 openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 600 -sha256 -extfile v3.ext 复制代码

其中 server.csr.cnf :

[ req ] default_bits = 2048 prompt = no default_md = sha256 distinguished_name = req_distinguished_name [ req_distinguished_name ] C = CN ST = Beijing L = Beijing O = MyOrganization OU = MyOrganizationUnit emailAddress = lovecoding@example.com CN = localhost 复制代码

v3.ext :

authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage=digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName=@alt_names [alt_names] DNS.1=localhost 复制代码 配置nginx

将 server.crt 和 server.key 添加到nginx:

server { listen [::]:443 ssl http2 ipv6only=on; listen 443 ssl http2; ssl_certificate /etc/nginx/certs/server.crt; ssl_certificate_key /etc/nginx/certs/server.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_session_cache shared:SSL:1m; server_name localhost; ... 复制代码


sudo nginx -t sudo nginx -s reload 复制代码 信任自签证书


Mac OS : sudo security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain server.crt 复制代码 Ubuntu : sudo cp server.crt /usr/local/share/ca-certificates/server.crt sudo update-ca-certificates 复制代码




说明自签证书已有效,并支持 HTTP/2 服务。


本文介绍了本地快速搭建 HTTP/2 服务,希望对研发伙伴有所帮助。目前所有代码都已放到 local-http2 ,喜欢的同学可以 Star :)。 还有HTTP/3草案已出,感兴趣的可以了解一下。

参考 local-cert-generator OpenSSL Certificate Authority How to create csr using Openssl without prompt Adding trusted root certificates to the server

Viewing all articles
Browse latest Browse all 12749