OpenSSL programming I: basic concepts

One 、OpenSSL Basic concepts

/index.html (openssl.org)

OpenSSL Chinese Manual | OpenSSL Chinese net

Two 、OpenSSL Command learning

1、openssl command

[email protected]:~$ openssl help
Standard commands
asn1parse         ca                ciphers           cms               
crl               crl2pkcs7         dgst              dhparam           
dsa               dsaparam          ec                ecparam           
enc               engine            errstr            gendsa            
genpkey           genrsa            help              list              
nseq              ocsp              passwd            pkcs12            
pkcs7             pkcs8             pkey              pkeyparam         
pkeyutl           prime             rand              rehash            
req               rsa               rsautl            s_client          
s_server          s_time            sess_id           smime             
speed             spkac             srp               storeutl          
ts                verify            version           x509              

Message Digest commands (see the `dgst' command for more details) blake2b512 blake2s256 gost md4 md5 rmd160 sha1 sha224 sha256 sha3-224 sha3-256 sha3-384 sha3-512 sha384 sha512 sha512-224 sha512-256 shake128 shake256 sm3 Cipher commands (see the `enc' command for more details)
aes-128-cbc       aes-128-ecb       aes-192-cbc       aes-192-ecb       
aes-256-cbc       aes-256-ecb       aria-128-cbc      aria-128-cfb      
aria-128-cfb1     aria-128-cfb8     aria-128-ctr      aria-128-ecb      
aria-128-ofb      aria-192-cbc      aria-192-cfb      aria-192-cfb1     
aria-192-cfb8     aria-192-ctr      aria-192-ecb      aria-192-ofb      
aria-256-cbc      aria-256-cfb      aria-256-cfb1     aria-256-cfb8     
aria-256-ctr      aria-256-ecb      aria-256-ofb      base64            
bf                bf-cbc            bf-cfb            bf-ecb            
bf-ofb            camellia-128-cbc  camellia-128-ecb  camellia-192-cbc  
camellia-192-ecb  camellia-256-cbc  camellia-256-ecb  cast              
cast-cbc          cast5-cbc         cast5-cfb         cast5-ecb         
cast5-ofb         des               des-cbc           des-cfb           
des-ecb           des-ede           des-ede-cbc       des-ede-cfb       
des-ede-ofb       des-ede3          des-ede3-cbc      des-ede3-cfb      
des-ede3-ofb      des-ofb           des3              desx              
rc2               rc2-40-cbc        rc2-64-cbc        rc2-cbc           
rc2-cfb           rc2-ecb           rc2-ofb           rc4               
rc4-40            seed              seed-cbc          seed-cfb          
seed-ecb          seed-ofb          sm4-cbc           sm4-cfb           
sm4-ctr           sm4-ecb           sm4-ofb           

[email protected]:~$

command	explain
asn1parse	One used to diagnose ASN.1 Structural tools , Can also be used from ASN1.1 Extract data from data .
ca	A small CA System . It can issue certificate requests and generate CRL. It maintains a text database of the status of issued certificates .
ciphers	Show supported encryption Suites .
cms
crl	Used in the Office PME or DER Format CRL file .
crl2pkcs7	according to CRL Or certificate to generate pkcs#7 news .
dgst	For data summarization .
dhparam	dhparam by dh Parameter manipulation and generation tools .
dsa	Used for processing DSA secret key 、 Format conversion and printing information .
dsaparam	Used to generate and operate dsa Parameters .
ec	Elliptic curve key processing tool .
ecparam	Elliptic curve key parameter generation and operation .
enc	enc For symmetric encryption and decryption tools , You can do it base64 Encoding conversion .
engine
errstr	Used to query error codes .
gendsa	according to DSA Key parameter generation DSA secret key ,dsa Key parameters are available dsaparam Command to generate .
genpkey
genrsa	Generate RSA secret key .
help
list
nseq	For multiple certificates and netscape Certificate sequences are transformed into each other .
ocsp
passwd	Generate various password ciphertext .
pkcs12	pkcs12 File tools , Can generate and analyze pkcs12 file .
pkcs7	Used for processing DER perhaps PEM Format pkcs#7 file .
pkcs8	pkcs8 Format private key conversion tool .
pkey
pkeyparam
pkeyutl
prime	Check whether a number is prime .
rand	Generate random number .
rehash
req	For generating and processing PKCS#10 Certificate request .
rsa	Used for processing RSA secret key 、 Format conversion and printing information .
rsautl	Use RSA Algorithmic signature , Verify identity , encryption / Decrypt data .
s_client	s_client For one SSL/TLS Client program , And s_server Corresponding , It can not only communicate with s_server communicate , Can also be used with any ssl Communicate with other service programs of the protocol .
s_server	s_server yes openssl One of the SSL Service program . Before using this program , Various certificates need to be generated .
s_time	s_time yes openss Provided SSL/TLS Performance testing tools , Used for testing SSL/TSL service .
sess_id	sess_id by SSL/TLS Agreed session Processing tools .
smime	S/MIME Tools , Used for processing S/MIME mail , It can encrypt 、 Decrypt 、 Signature and verification S/MIME news .
speed	Used to test the performance of the library .
spkac
srp
storeutl
ts
verify	Certificate verification tool .
version	Used to print versions and openssl Other information .
x509	X509 Command is a versatile certificate tool . It can display certificate information 、 Convert certificate format 、 Sign the certificate request and change the trust settings of the certificate .

2、 Command format query

Check the specific usage of the command , Use -help Command view . With ciphers For example ：

[email protected]:~$ openssl ciphers -help
Usage: ciphers [options]
Valid options are:
 -help              Display this summary
 -v                 Verbose listing of the SSL/TLS ciphers
 -V                 Even more verbose
 -s                 Only supported ciphers
 -tls1              TLS1 mode
 -tls1_1            TLS1.1 mode
 -tls1_2            TLS1.2 mode
 -tls1_3            TLS1.3 mode
 -stdname           Show standard cipher names
 -psk               include ciphersuites requiring PSK
 -srp               include ciphersuites requiring SRP
 -convert val       Convert standard name into OpenSSL name
 -ciphersuites val  Configure the TLSv1.3 ciphersuites to use
[email protected]:~$