Web安全：TLS/SSL证书详解

Web安全TLS/SSL证书详解1. TLS概述TLSTransport Layer Security是用于在两个通信应用程序之间提供保密性和数据完整性的协议。2. TLS握手过程1. ClientHello: 客户端支持的TLS版本、加密套件、随机数 2. ServerHello: 服务器选择的加密套件、随机数、证书 3. 证书验证: 客户端验证服务器证书 4. 密钥交换: DH/ECDH或RSA密钥交换 5. Finished: 双方确认握手完成3. Go语言TLS配置3.1 生成自签名证书import crypto/tls import crypto/rand import crypto/x509 import math/big import time func generateSelfSignedCert() ([]byte, []byte, error) { // 生成CA ca : x509.Certificate{ SerialNumber: big.NewInt(time.Now().Unix()), NotBefore: time.Now(), NotAfter: time.Now().AddDate(1, 0, 0), KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, IsCA: true, } caPrivateKey, err : rsa.GenerateKey(rand.Reader, 2048) if err ! nil { return nil, nil, err } caBytes, err : x509.CreateCertificate(rand.Reader, ca, ca, caPrivateKey.PublicKey, caPrivateKey) if err ! nil { return nil, nil, err } // 生成服务器证书 cert : x509.Certificate{ SerialNumber: big.NewInt(time.Now().Unix()), NotBefore: time.Now(), NotAfter: time.Now().AddDate(1, 0, 0), DNSNames: []string{localhost}, KeyUsage: x509.KeyUsageDigitalSignature, } certPrivateKey, err : rsa.GenerateKey(rand.Reader, 2048) if err ! nil { return nil, nil, err } certBytes, err : x509.CreateCertificate(rand.Reader, cert, ca, certPrivateKey.PublicKey, caPrivateKey) if err ! nil { return nil, nil, err } // 编码为PEM格式 certPEM : pem.EncodeToMemory(pem.Block{Type: CERTIFICATE, Bytes: certBytes}) keyPEM : pem.EncodeToMemory(pem.Block{Type: RSA PRIVATE KEY, Bytes: x509.MarshalPKCS1PrivateKey(certPrivateKey)}) return certPEM, keyPEM, nil }3.2 服务器TLS配置import crypto/tls import net/http func createTLSConfig(certFile, keyFile string) (*tls.Config, error) { cert, err : tls.LoadX509KeyPair(certFile, keyFile) if err ! nil { return nil, err } return tls.Config{ Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12, CurvePreferences: []tls.CurveID{ tls.CurveP256, tls.X25519, }, CipherSuites: []uint16{ tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, }, }, nil } func serveHTTPS(addr, certFile, keyFile string) error { cfg, err : createTLSConfig(certFile, keyFile) if err ! nil { return err } server : http.Server{ Addr: addr, TLSConfig: cfg, } return server.ListenAndServeTLS(certFile, keyFile) }3.3 客户端TLS配置import crypto/tls import crypto/x509 func createClientTLSConfig(caFile string) (*tls.Config, error) { caCert, err : os.ReadFile(caFile) if err ! nil { return nil, err } certPool : x509.NewCertPool() certPool.AppendCertsFromPEM(caCert) return tls.Config{ RootCAs: certPool, InsecureSkipVerify: false, // 生产环境必须验证证书 MinVersion: tls.VersionTLS12, }, nil } func createHTTPSClient(caFile string) (*http.Client, error) { cfg, err : createClientTLSConfig(caFile) if err ! nil { return nil, err } return http.Client{ Transport: http.Transport{ TLSClientConfig: cfg, }, }, nil }4. Lets Encrypt证书4.1 使用certbot# 安装certbot sudo apt-get install certbot python3-certbot-nginx # 获取证书 sudo certbot certonly --standalone -d example.com -d www.example.com # 自动续期 sudo certbot renew --dry-run4.2 ACME协议自动化import github.com/go-acme/lego/v4/certificate import github.com/go-acme/lego/v4/lego import github.com/go-acme/lego/v4/providers/http/middleware func obtainCertificate(domain string) (*certificate.Resource, error) { config : lego.NewConfig(Account{ Email: your-emailexample.com, Key: yourPrivateKey, }) client, err : lego.NewClient(config) if err ! nil { return nil, err } cert, err : client.Certificate.Obtain(certificate ObtainRequest{ Domains: []string{domain}, ChallengeProviderHTTP: middleware.NewHTTPProvider(), }) if err ! nil { return nil, err } return cert, nil }5. 证书监控5.1 证书过期检查import crypto/x509 import os import time func checkCertExpiry(certFile string) (time.Duration, error) { certPEM, err : os.ReadFile(certFile) if err ! nil { return 0, err } block, _ : pem.Decode(certPEM) cert, err : x509.ParseCertificate(block.Bytes) if err ! nil { return 0, err } remaining : cert.NotAfter.Sub(time.Now()) return remaining, nil }6. 总结TLS是Web安全的基础通过加密传输保护数据安全。在生产环境中应使用受信任的CA签发证书配置强加密套件并启用证书自动续期。