#!/bin/sh
# create self-signed server certificate:
read -p "请输入证书的域 例如[www.example.com or 192.168.1.52]: " DOMAIN
mkdir newcerts private conf server
# 根据自己的需求，来更改这些内容
SUBJECT="/C=CN/ST=BJ/L=BJ/O=company/OU=company/CN=$DOMAIN"
CA="/C=CN/ST=BJ/L=BJ/O=company/OU=company/CN=$DOMAIN"

echo "创建 CA 根证书..."
echo "生成私钥 key 文件..."
openssl genrsa -out private/ca.key 2048  
echo "生成证书请求 csr 文件..."
openssl req -new -subj $CA -key private/ca.key -out private/ca.csr 

echo "生成凭证 crt 文件..."
openssl x509 -req -days 365 -in private/ca.csr -signkey private/ca.key -out private/ca.crt  

echo "为我们的 key 设置起始序列号和创建 CA 键库..."

rm -rf serial index.txt
echo FACE > serial
touch index.txt

echo "服务器证书的生成..."
openssl genrsa -out server/server.key 2048 
openssl req -new -subj $SUBJECT -key server/server.key -out server/server.csr  

echo "使用我们私有的 CA key 为刚才的 key 签名，生成证书有效时间在 openssl.conf 中配置..."
openssl ca -in server/server.csr -cert private/ca.crt -keyfile private/ca.key -out server/server.crt -config "./openssl.conf" 

echo "客户端证书的生成 * 创建存放 key 的目录 users..."
mkdir users  
echo " 为用户创建一个 key..."
openssl genrsa -des3 -out ./users/client.key 2048 

echo "为 key 创建一个证书签名请求 csr 文件..."
openssl req -new -subj $SUBJECT -key ./users/client.key -out ./users/client.csr  

echo "使用我们私有的 CA key 为刚才的 key 签名..."
openssl ca -in ./users/client.csr -cert ./private/ca.crt -keyfile ./private/ca.key -out ./users/client.crt -config "./openssl.conf" 

echo "将证书转换为大多数浏览器都能识别的 PKCS12 文件..."
openssl pkcs12 -export -clcerts -in ./users/client.crt -inkey ./users/client.key -out ./users/client.p12  

echo "把以上生成的文件copy到nginx conf文件的ssl目录下面，如果ssl目录不存在请创建"
echo "接下请配置nginx.conf操作:"
echo " server {																						"
echo " 			...                                           "
echo "     ssl on;                                        "
echo "     ssl_certificate ca/server/server.crt;                "
echo "     ssl_certificate_key ca/server/server.key;            "
echo "     ssl_client_certificate ca/private/ca.crt;             "
echo "     ssl_verify_client on;                          "
echo "			...                                           "
echo "     }                                               "
echo "使用如下命令重新加载nginx配置"
echo "nginx -s reload"
echo "客户端使用： users/client.p12 和 private/ca.crt"

ssl_certificate /path/to/openssl/server/server.crt;

ssl_certificate_key /path/to/openssl/server/server.key;

ssl_client_certificate  /path/to/openssl/private/ca.crt;

ssl_verify_client on;    ## 开启客户端的验证

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

private final static String P12_PATH = "client.p12";   //客户端证书路径
private final static String P12_PWD = "12345678"; //客户端证书密码
private final static String CA_PATH = "ca.crt";   // 根证书路径

public static String sslRequestGet(String url) throws Exception {
    SSLContext ctx = getSSLContext(P12_PATH, CA_PATH);
    LayeredConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(ctx);
    HttpGet httpget = new HttpGet(url);
    try (CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLSocketFactory(sslSocketFactory)
            .build();CloseableHttpResponse response = httpClient.execute(httpget) ) {
        HttpEntity entity = response.getEntity();
        String jsonStr = EntityUtils.toString(response.getEntity(), "UTF-8");//返回结果
        EntityUtils.consume(entity);
        return jsonStr;
    } catch (Exception e) {
        e.printStackTrace();
    }
    return "";
}
/** 加载客户端验证证书 **/
private static SSLContext getSSLContext(String keyStorePath, String trustStorePath) throws NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException, IOException, CertificateException, KeyManagementException {
    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
    InputStream is = new FileInputStream(keyStorePath);
    keyStore.load(is, P12_PWD.toCharArray());
    is.close();
    keyManagerFactory.init(keyStore, P12_PWD.toCharArray());
    SSLContext ctx = SSLContext.getInstance("TLS");
    ctx.init(keyManagerFactory.getKeyManagers(), getTrustManagers(trustStorePath) , null);
    return ctx;
}
/** 加载信任证书 **/
private static TrustManager [] getTrustManagers (String ... crtPath) throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException {
    if (crtPath == null || crtPath.length < 1) {
        return null;
    }
    CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
    keyStore.load(null);
    for (int i=0, j=crtPath.length; i<j; i++) {
        String path = crtPath[i];
        InputStream is = new FileInputStream(path);
        keyStore.setCertificateEntry(Integer.toString(i), certificateFactory.generateCertificate(is));
        is.close();
    }
    TrustManagerFactory trustManagerFactory =TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    trustManagerFactory.init(keyStore);
    return trustManagerFactory.getTrustManagers();
}