通过OpenSSL创建自签名证书在Flask实现HTTPS_openssl生成的证书,如何让flask使用

方案一) 生成X.509 v3 certificate with SAN(Subject Alternative Names )

 注释:Starting with Chrome v58 they no longer accept certificates without SAN information. 

除了上面的提示以外, 我们要的不仅仅是生成SSL certificate,而是不得不构建一个带有根证书的SSL certificate chain,

在连接一个 HTTPS 网站的时候，服务器会发送证书链，但光有证书链，客户端/浏览器是不能完成证书校验的，(客户端/浏览器)必须有一张根证书才能迭代完成签名认证，

也就是说客户端必须信任根证书才能构建信任基础。(注意中间证书则是可省的，我们构建的SSL证书链就没有)

1) 创建根证书及密钥

#create a private key
#This creates a key, 2048 bits long, The -des3 parameter specifies to use the #Tripple DES algorithm to encrypt the key 
openssl genrsa -des3 -out rootCA.key 2048 

#Now to generate the root certificate:
#new: create a new request
#nodes: don’t encrypt the output key
#x509: specifies the kind of certificate to make
#key: the file with the private key to use
#sha256: this is the hashing algorithm. When you omit this it will default to the #SHA1 algorithm which will result in the browser generating a warning
#days: the number of days the certificate should be valid for. Use as high a number #as you feel comfortable with for your development environment
#out: the name of the file to write the certificate to.
 
 
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024  -out rootCA.pem

创建的过程中,会要求你题写基本信息到你的根证书里面。

我的如下:

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CMCM
Organizational Unit Name (eg, section) []:CM
Common Name (e.g. server FQDN or YOUR name) []:HL ROOT CA
Email Address []:499389897@qq.com

有了根证书,现在创建服务器用到的ssl证书。

2)创建服务器用的ssl证书及密钥

因为只有X.509 v3证书承载SAN信息，所以与创建X.509 v1证书时相比，它需要做更多的工作。

在同一目录下,先创建一个v3.ext文件,把下面信息放进去,alt_names下面换成你自己的域名。

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = acme-site.dev
DNS.2 = www.acme-site.dev

The first step is to create a private key for the SSL certificate and a certificate signing request. 

openssl req -new -nodes -out server.csr -newkey rsa:2048 -keyout server.key

同样创建服务器ssl证书也会要你填写一些基本信息,我填写如下:

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CMCM
Organizational Unit Name (eg, section) []:CM
Common Name (e.g. server FQDN or YOUR name) []:HL ROOT CA
Email Address []:499389897@qq.com
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3)关键步骤,根证书颁发信任给服务器ssl证书

openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext

方案二)

参考资料：

https://support.citrix.com/article/CTX135602_

新建文件req.conf，内容如下：

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = www.myser.com
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.myser.net
DNS.2 = myser.com
DNS.3 = myser.net

注：

CN 为www.myser.com

DNS.1 设定为域名 www.myser.net
DNS.2 设定为域名 myser.com
DNS.3 设定为域名 myser.net

生成私钥和自签名证书：

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.key -out server.crt -config req.conf -sha256

三)拿到证书后,配置服务器

修改Flask中ssl的配置,指定新的私钥文件(sever.key)和证书文件(sever.crt)，如下：

from flask import Flask, jsonify
import os
 
ASSETS_DIR = os.path.dirname(os.path.abspath(__file__))
app = Flask(__name__)
 
 
@app.route('/')
def index():
    return 'Flask is running!'
 
 
@app.route('/data')
def names():
    data = {"names": ["John", "Jacob", "Julie", "Jennifer"]}
    return jsonify(data)
 
 
if __name__ == '__main__':
    context = ('server.crt', 'server.key')#certificate and key files
    app.run(debug=True, ssl_context=context)

重启服务

chrome导入根证书,作为信任链之基础

chrome安装自签名证书文件server.crt

访问服务器，证书有效，一切正常，如下图

参考文章:

https://www.jianshu.com/p/35c31b865bb9

https://medium.com/@tbusser/creating-a-browser-trusted-self-signed-ssl-certificate-2709ce43fd15