Debian 上 OpenSSL 命令行高效用法
一 安装与基础配置
sudo apt update && sudo apt install -y openssl libssl-devsudo apt update && sudo apt install --only-upgrade ca-certificates && sudo update-ca-certificates二 证书与密钥快速操作
openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048openssl req -new -key private.key -out server.csropenssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodesopenssl x509 -req -days 365 -in server.csr -signkey private.key -out server.crtopenssl x509 -in server.crt -noout -textopenssl verify -CAfile ca.crt server.crtopenssl pkcs12 -export -in server.crt -inkey private.key -out keystore.p12 -name mycertopenssl dhparam -out dhparams.pem 2048三 文件加解密与摘要校验
openssl enc -aes-256-cbc -salt -in plaintext.txt -out encrypted.binopenssl enc -d -aes-256-cbc -in encrypted.bin -out decrypted.txt-k PASS 或 -pass file:pass.txt 等方式提供，避免交互输入openssl genpkey -algorithm RSA -out rsa_key.pem -pkeyopt rsa_keygen_bits:2048openssl rsa -pubout -in rsa_key.pem -out rsa_pubkey.pemopenssl pkeyutl -encrypt -pubin -inkey rsa_pubkey.pem -in plaintext.txt -out encrypted.binopenssl pkeyutl -decrypt -inkey rsa_key.pem -in encrypted.bin -out decrypted.txtopenssl dgst -sha256 inputfile四 测试与排查 SSL/TLS 连接
openssl s_client -connect www.example.com:443openssl s_client -connect www.example.com:443 -tls1_3openssl s_client -connect www.example.com:443 -cipher AES256-GCM-SHA384openssl s_client -connect www.example.com:443 -verify_return_erroropenssl s_client -connect www.example.com:443 -CAfile my_ca_cert.pemopenssl s_client -connect www.example.com:443 -cert client_cert.pem -key client_key.pemopenssl s_client -connect www.example.com:443 > handshake.log 2>&1五 实用与安全建议
s_client -verify_return_error 严格校验update-ca-certificates