前几天总算抽空把咕了快一年的自建灵车CA的教程写完了：使用 Pico HSM 和 step-ca 自建一个CA
为了安全 Step-CA 默认签出的证书只有24小时的有效期，这对于我们来说是完全没有必要的，先来把它修改到7天
编辑step-ca/config/ca.json
ca.json 1 2 3 4 5 6 7 8 9 { "type" : "ACME" , "name" : "acme" , "claims" : { "maxTLSCertDuration" : "336h" , "minTLSCertDuration" : "24h" , "defaultTLSCertDuration" : "168h" } }
开启CRL功能
编辑 step-ca/config/ca.json
ca.json 1 2 3 4 5 "insecureAddress" : ":9001" , "crl" : { "enabled" : true , "idpURL" : "http://ca.lab.d9lab.eu.org/1.0/crl" } ,
创建模板 /etc/step-ca/templates/x509/leaf.tpl
leaf.tpl 1 2 3 4 5 6 7 8 9 10 11 { "subject" : { { toJson .Subject } } , "sans" : { { toJson .SANs } } , { { - if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey } } "keyUsage" : [ "keyEncipherment" , "digitalSignature" ] , { { - else } } "keyUsage" : [ "digitalSignature" ] , { { - end } } "extKeyUsage" : [ "serverAuth" , "clientAuth" ] , "crlDistributionPoints" : [ "http://ca.lab.d9lab.eu.org/1.0/crl" ] }
编辑 step-ca/config/ca.json
ca.json 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 ...... "claims" : { "maxTLSCertDuration" : "336h" , "minTLSCertDuration" : "24h" , "defaultTLSCertDuration" : "168h" } , "options" : { "x509" : { "templateFile" : "/etc/step-ca/templates/x509/leaf.tpl" } , "ssh" : { } } ...... "claims" : { "enableSSHCA" : true , "disableRenewal" : false , "allowRenewalAfterExpiry" : false , "disableSmallstepExtensions" : false } , "options" : { "x509" : { "templateFile" : "/etc/step-ca/templates/x509/leaf.tpl" } , "ssh" : { } }
其他ACME客户端可以参考：Popular ACME Clients acme.sh ，主打一个小而美。
假设我要给我内网的旁路由（OpenWRT）签一个证书
由于我们的自建CA不在系统的信任根证书列表里，所以如果直接运行acme.sh，curl会报错，我们需要把root_ca.crt复制一份到设备上。
1 2 3 4 5 6 7 8 $ curl https://get.acme.sh | sh -s [email protected] $ ~/.acme.sh/acme.sh --issue -d router2.d9lab.eu.org \ --server https://ca.lab.thinkalone.win:4443/acme/acme/directory \ --ca-bundle /root/certs/root_ca.crt \ --webroot /www --days 6 --reloadcmd "service uhttpd reload"
然后编辑/etc/config/uhttpd
1 2 3 4 5 6 7 8 9 ... list listen_https '0.0.0.0:443' list listen_https '[::]:443' ... option cert '/root/.acme.sh/router2.d9lab.eu.org_ecc/router2.d9lab.eu.org.cer' option key '/root/.acme.sh/router2.d9lab.eu.org_ecc/router2.d9lab.eu.org.key' ...
参考：SSH Certificates with step-ca step-ca で ssh証明書を扱う
重启 step-ca ，查看日志找到 SSH Host CA Key 和 SSH User CA Key
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 $ sudo service step-ca stop $ sudo service step-ca start $ sudo service step-ca status ● step-ca.service - step-ca Loaded: loaded (/etc/systemd/system/step-ca.service; enabled; preset: enabled) Active: active (running) since Main PID: 156738 (sh) Tasks: 11 (limit : 4529) Memory: 14.4M CPU: 305ms CGroup: /system.slice/step-ca.service ├─156738 /bin/sh -c "/usr/local/bin/step-ca /etc/step-ca/config/ca.json" └─156739 /usr/local/bin/step-ca /etc/step-ca/config/ca.json ...... SSH Host CA Key: ecdsa-sha2-nistp256 AAA= SSH User CA Key: ecdsa-sha2-nistp256 AAB= ......
将 SSH User CA Key 写入到 /etc/ssh/ssh_user_ca_key.pub
1 2 3 $ sudo echo "ecdsa-sha2-nistp256 AAB=" > /etc/ssh/ssh_user_ca_key.pub $ sudo chown root:root /etc/ssh/ssh_user_ca_key.pub $ sudo chmod 644 /etc/ssh/ssh_user_ca_key.pub
签名主机公钥
1 2 3 $ sudo cp /etc/ssh/ssh_host_ecdsa_key.pub ssh_host_ecdsa_key.pub $ sudo step ssh certificate $HOSTNAME ssh_host_ecdsa_key.pub --host --sign $ sudo cp ssh_host_ecdsa_key-cert.pub /etc/ssh/ssh_host_ecdsa_key-cert.pub
创建 /etc/ssh/sshd_config.d/ca.conf
ca.conf 1 2 TrustedUserCAKeys /etc/ssh/ssh_user_ca_key.pub HostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub
测试 sshd 配置并重启 sshd
1 2 $ sudo sshd -t $ sudo service ssh restart
将 SSH Host CA Key 写入到 ~/.ssh/authorized_keys
authorized_keys 1 ecdsa-sha2-nistp256 AAA=
生成用于连接的证书
1 2 3 4 5 6 $ step ssh certificate [email protected] id_ecdsa ...... Please enter the password to encrypt the private key: Private Key: id_ecdsa Public Key: id_ecdsa.pub Certificate: id_ecdsa-cert.pub
将 SSH Host CA Key 写入到 ~/.ssh/known_hosts
authorized_keys 1 echo "@cert-authority 192.168.1.100 ecdsa-sha2-nistp256 AAA=" >> ~/.ssh/authorized_keys
然后就可以直接 ssh [email protected] 连接了
（完）
