当前位置：首页 > news >正文

Web安全：TLS/SSL证书详解

news 2026/5/13 12:04:36

Web安全：TLS/SSL证书详解

1. TLS概述

TLS（Transport Layer Security）是用于在两个通信应用程序之间提供保密性和数据完整性的协议。

2. TLS握手过程

1. ClientHello: 客户端支持的TLS版本、加密套件、随机数 2. ServerHello: 服务器选择的加密套件、随机数、证书 3. 证书验证: 客户端验证服务器证书 4. 密钥交换: DH/ECDH或RSA密钥交换 5. Finished: 双方确认握手完成

3. Go语言TLS配置

3.1 生成自签名证书

import "crypto/tls" import "crypto/rand" import "crypto/x509" import "math/big" import "time" func generateSelfSignedCert() ([]byte, []byte, error) { // 生成CA ca := &x509.Certificate{ SerialNumber: big.NewInt(time.Now().Unix()), NotBefore: time.Now(), NotAfter: time.Now().AddDate(1, 0, 0), KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, IsCA: true, } caPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048) if err != nil { return nil, nil, err } caBytes, err := x509.CreateCertificate(rand.Reader, ca, ca, &caPrivateKey.PublicKey, caPrivateKey) if err != nil { return nil, nil, err } // 生成服务器证书 cert := &x509.Certificate{ SerialNumber: big.NewInt(time.Now().Unix()), NotBefore: time.Now(), NotAfter: time.Now().AddDate(1, 0, 0), DNSNames: []string{"localhost"}, KeyUsage: x509.KeyUsageDigitalSignature, } certPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048) if err != nil { return nil, nil, err } certBytes, err := x509.CreateCertificate(rand.Reader, cert, ca, &certPrivateKey.PublicKey, caPrivateKey) if err != nil { return nil, nil, err } // 编码为PEM格式 certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certBytes}) keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(certPrivateKey)}) return certPEM, keyPEM, nil }

3.2 服务器TLS配置

import "crypto/tls" import "net/http" func createTLSConfig(certFile, keyFile string) (*tls.Config, error) { cert, err := tls.LoadX509KeyPair(certFile, keyFile) if err != nil { return nil, err } return &tls.Config{ Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12, CurvePreferences: []tls.CurveID{ tls.CurveP256, tls.X25519, }, CipherSuites: []uint16{ tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, }, }, nil } func serveHTTPS(addr, certFile, keyFile string) error { cfg, err := createTLSConfig(certFile, keyFile) if err != nil { return err } server := &http.Server{ Addr: addr, TLSConfig: cfg, } return server.ListenAndServeTLS(certFile, keyFile) }

3.3 客户端TLS配置

import "crypto/tls" import "crypto/x509" func createClientTLSConfig(caFile string) (*tls.Config, error) { caCert, err := os.ReadFile(caFile) if err != nil { return nil, err } certPool := x509.NewCertPool() certPool.AppendCertsFromPEM(caCert) return &tls.Config{ RootCAs: certPool, InsecureSkipVerify: false, // 生产环境必须验证证书 MinVersion: tls.VersionTLS12, }, nil } func createHTTPSClient(caFile string) (*http.Client, error) { cfg, err := createClientTLSConfig(caFile) if err != nil { return nil, err } return &http.Client{ Transport: &http.Transport{ TLSClientConfig: cfg, }, }, nil }

4. Let's Encrypt证书

4.1 使用certbot

# 安装certbot sudo apt-get install certbot python3-certbot-nginx # 获取证书 sudo certbot certonly --standalone -d example.com -d www.example.com # 自动续期 sudo certbot renew --dry-run

4.2 ACME协议自动化

import "github.com/go-acme/lego/v4/certificate" import "github.com/go-acme/lego/v4/lego" import "github.com/go-acme/lego/v4/providers/http/middleware" func obtainCertificate(domain string) (*certificate.Resource, error) { config := lego.NewConfig(&Account{ Email: "your-email@example.com", Key: yourPrivateKey, }) client, err := lego.NewClient(config) if err != nil { return nil, err } cert, err := client.Certificate.Obtain(certificate ObtainRequest{ Domains: []string{domain}, ChallengeProviderHTTP: middleware.NewHTTPProvider(), }) if err != nil { return nil, err } return cert, nil }

5. 证书监控

5.1 证书过期检查

import "crypto/x509" import "os" import "time" func checkCertExpiry(certFile string) (time.Duration, error) { certPEM, err := os.ReadFile(certFile) if err != nil { return 0, err } block, _ := pem.Decode(certPEM) cert, err := x509.ParseCertificate(block.Bytes) if err != nil { return 0, err } remaining := cert.NotAfter.Sub(time.Now()) return remaining, nil }