一、简介

GMSSL提供一个国密版OpenSSL和国密版Nginx，支持单向/双向认证，支持标准SSL/国密SSL自适应。
其中国密版OpenSSL基于OpenSSL1.1.1d实现，且已经修正了CVE-2020-1967。

证书申请

GMSSL - 国密SSL实验室

二、运行环境

Centos7 x86_64

三、下载

yum install wget -y

国密OpenSSL与国密Nginx
gmssl_openssl_1.1_bxx.tar.gz
nginx-1.18.0.tar.gz

四、编译部署（以nginx-1.8.0为例）

1) 下载gmssl_openssl_1.1_bxx.tar.gz到/roo/下
2) 解压 tar xzfm gmssl_openssl_1.1_bxx.tar.gz -C /usr/local
3) 下载nginx-1.18.0.tar.gz到/roo/下
4) 解压 tar xzfm nginx-1.18.0.tar.gz
5) 进入目录 cd /root/nginx-1.18.0
6) 编辑auto/lib/openssl/conf，将全部$OPENSSL/.openssl/修改为$OPENSSL/并保存

./configure \
--without-http_gzip_module \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-http_v2_module \
--with-file-aio \
--with-openssl="/usr/local/gmssl" \
--with-cc-opt="-I/usr/local/gmssl/include" \
--with-ld-opt="-lm"

8) 编译安装
make install
9) /usr/local/nginx即为生成的nginx目录
注：可能需要使用yum install pcre-devel需要安装pcre-devel

配置示例(国密单向)

server
{listen 0.0.0.0:443 ssl;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;ssl_verify_client off;ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;location /{root html;index index.html index.htm;}
}

配置示例(国密双向)

server
{listen 0.0.0.0:443 ssl;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;ssl_client_certificate /usr/local/nginx/conf/demo1.sm2.trust;ssl_verify_client on;ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;location /{root html;index index.html index.htm;}
}

配置示例(国密/RSA单向自适应)

server
{listen 0.0.0.0:443 ssl;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;ssl_verify_client off;ssl_certificate /usr/local/nginx/conf/demo1.rsa.crt.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.rsa.key.pem;ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;location /{root html;index index.html index.htm;}
}

本文来自互联网用户投稿，文章观点仅代表作者本人，不代表本站立场，不承担相关法律责任。如若转载，请注明出处。 如若内容造成侵权/违法违规/事实不符，请点击【内容举报】进行投诉反馈！