blog
Table des matières
- 2026:
- 2025:
4 billet(s) pour juillet 2026
| Procédure simple augmentation de la SWAP | 2026/07/17 15:49 | Jean-Baptiste |
| Exemple git clone avec Ansible | 2026/07/16 14:47 | Jean-Baptiste |
| Windows exe - Comparaison de fichiers binaires | 2026/07/16 10:25 | Jean-Baptiste |
| Pb git | 2026/07/01 17:36 | Jean-Baptiste |
OpenSSL - Créer un certificat autosigné / create a self-signed ssl certificate
make-ssl-cert generate-default-snakeoil --force-overwrite
Les certs générées sont ici :
- /etc/ssl/certs/ssl-cert-snakeoil.pem
- /etc/ssl/private/ssl-cert-snakeoil.key
Ou
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt
ou
FQDN="plop.local" PORT=9443 # create private key for TLS openssl genrsa -out $FQDN.key 2048 # create public certificate for TLS # openssl req -new -key $FQDN.key -x509 -subj '/CN=localhost' -out $FQDN.cert openssl req -new -key $FQDN.key -x509 -days 3653 -out $FQDN.crt -subj "/C=FR/ST=FR/L=PLOP/O=myorg/CN=$FQDN" # create pem format key+cert cat $FQDN.key $FQDN.crt >$FQDN.pem
Source : https://fabianlee.org/2022/10/26/linux-socat-used-as-secure-https-web-server/
openssl - vérifier la cohérence d'un certificat entre KEY CSR CRT
openssl pkey -in privateKey.key -pubout -outform pem | sha256sum openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum
Source https://www.sslshopper.com/certificate-key-matcher.html
OpenSSL - Quels sont les SANs (Subject Alternative Names) de mon certificat SSL/TLS
Fichier certificat
openssl x509 -text -noout -fingerprint -sha256 -in plop.cer | grep DNS
En ligne
openssl s_client -connect plop.acme.org:443 -servername plop.acme.org </dev/null | openssl x509 -text -noout -in - | grep DNS | sed -e 's/ DNS:/\n&/g'
Test
$ curl -v https://test.acme.fr 2>&1 | grep subject * subject: C=FR; O=ACME FRANCE; OU=Private Group PKI; CN=www.test.acme.fr * subjectAltName does not match test.acme.fr * SSL: no alternative certificate subject name matches target host name 'test.acme.fr' curl: (51) SSL: no alternative certificate subject name matches target host name 'test.acme.fr'
Ou encore mieux :
$ echo | openssl s_client -connect redhat.com:443 2>/dev/null | openssl x509 -noout -ext subjectAltName
X509v3 Subject Alternative Name:
DNS:*.redhat.com, DNS:redhat.com
OpenSSL - Est-ce bien le bon certificat SSL/TLS qui est installé sur le serveur Web
openssl x509 -text -noout -fingerprint -sha256 -in plop.cer | grep Fingerprint openssl s_client -connect plop.acme.org:443 -servername plop.acme.org </dev/null | openssl x509 -text -noout -fingerprint -sha256 -in - | grep Fingerprint
Notes OpenBSD
Installation de paquets (Git, vim...)
export PKG_PATH=ftp://ftp.fr.openbsd.org/pub/OpenBSD/5.6/packages/amd64/
Mise à jour
pkg_add -Uu
blog.txt · Dernière modification : de 127.0.0.1