Showing posts with label OpenSSL. Show all posts

2012-07-13

Compile OpenSSL with Visual Studio 2010

Hướng dẫn http://okolovich.info/compile-openssl-by-visual-studio-2010-express/

Download Perl, nasm, source OpenSSL -> chỉnh lại path trong file bat (copy trong link trên)

@rem @echo off

@cls

@rem 1. Download and unzip Netwide Assembler (http://nasm.us/) to some folder

@rem 2. Download and uzip Strawberry Perl (http://strawberryperl.com/)

@rem or ActivePerl (http://www.activestate.com/activeperl/downloads)

@rem 3. Download and uzip (xxx.tar.gz) latest version of OpenSSL (http://www.openssl.org/)

@rem NOTE: For more info, please read INSTALL.W32 file in OpenSSL folder

@rem ***************************************************************

@rem Setup paths

@rem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@set strPathNetwideAssembler=D:\workspace\nasm-2.09.10

@set strPathStrawberryPerl=D:\workspace\strawberry

@set strPathActivePerl=D:\workspace\Perl64\bin

@rem set strPathActivePerl=D:\workspace\Perl64\bin

@set strPathOpenSSLDir=D:

@set strPathOpenSSL=%strPathOpenSSLDir%\download\openssl-1.0.1c

@set strPathTargetOpenSSLDir=D:\workspace\openssl-1.0.1c

@set bEnableStaticEngine=True

@rem True -> the shared library build will compile the engines into libeay32.dll

@rem ***************************************************************

@IF NOT "%strPathNetwideAssembler%" == "" set PATH=%strPathNetwideAssembler%;%PATH%

@IF NOT "%strPathStrawberryPerl%" == "" set PATH=%strPathStrawberryPerl%\c\bin;

%strPathStrawberryPerl%\perl\site\bin;%strPathStrawberryPerl%\perl\bin;%PATH%

@IF NOT "%strPathActivePerl%" == "" set PATH=%strPathActivePerl%;%PATH%

@set strEnableStaticEngine=

@IF "%bEnableStaticEngine%"=="True" set strEnableStaticEngine=enable-static-engine

@rem START

@rem Create OpenSSL installation dir

@rmdir /S /Q %strPathTargetOpenSSLDir%

@mkdir %strPathTargetOpenSSLDir%

@echo OpenSSL will be installed into %strPathTargetOpenSSLDir%

@%strPathOpenSSLDir%

@cd %strPathOpenSSL%

@IF NOT "%strPathNetwideAssembler%" == "" call :ConfigureMakefileWithASM

@IF "%strPathNetwideAssembler%" == "" call :ConfigureMakefileWithoutASM

@if "%VS100COMNTOOLS%" == "" goto ErrorNoVS2010

@call "%VS100COMNTOOLS%vsvars32.bat"

@cls

@echo ***************************************************************

@echo Compile OpenSSL

@echo ***************************************************************

@pause

@nmake -f ms\ntdll.mak

@echo ***************************************************************

@echo Compile OpenSSL DONE

@echo ***************************************************************

@echo .

@echo ***************************************************************

@echo Test OpenSSL

@echo ***************************************************************

@pause

@nmake -f ms\ntdll.mak test

@echo ***************************************************************

@echo Test OpenSSL DONE

@echo ***************************************************************

@echo .

@echo ***************************************************************

@echo install OpenSSL to the specified location (%strPathTargetOpenSSLDir%)

@echo ***************************************************************

@pause

@nmake -f ms\ntdll.mak install

@echo ***************************************************************

@echo install OpenSSL to %strPathTargetOpenSSLDir% DONE

@echo ***************************************************************

@pause

goto EOF

:ConfigureMakefileWithoutASM

@rem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@rem Configure with platform VC-WIN32 but without Assembler and Build Makefiles

@rem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@echo ***************************************************************

@echo Configure with platform VC-WIN32 but without Assembler

@echo ***************************************************************

@perl Configure VC-WIN32 no-asm %strEnableStaticEngine% --prefix=%strPathTargetOpenSSLDir%

@echo ***************************************************************

@echo Configure with platform VC-WIN32 but without Assembler. DONE

@echo ***************************************************************

@echo .

@echo ***************************************************************

@echo Build the Makefiles

@echo ***************************************************************

@call ms\do_ms.bat

@echo ***************************************************************

@echo Build the Makefiles DONE

@echo ***************************************************************

@pause

@cls

goto EOF

:ConfigureMakefileWithASM

@rem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@rem Configure with platform VC-WIN32 and with Assembler, and Build Makefiles

@rem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@echo ***************************************************************

@echo Configure with platform VC-WIN32 and Assembler

@echo ***************************************************************

perl Configure VC-WIN32 %strEnableStaticEngine% --prefix=%strPathTargetOpenSSLDir%

@echo ***************************************************************

@echo Configure with platform VC-WIN32 and Assembler. DONE

@echo ***************************************************************

@echo .

@echo ***************************************************************

@echo Build the Makefiles and optionally the assembly language files:

@echo ***************************************************************

@call ms\do_nasm.bat

@echo ***************************************************************

@echo Build the Makefiles DONE

@echo ***************************************************************

@pause

@cls

goto EOF

rem Errors

rem ***********************************************************

:ErrorNoVS2010

echo Visual Studio 2010 is not installed on your computer. Please install it and run this file again.

goto EOF

:EOF

2011-11-01

Create self-signed certificate for localhost/DEV web server (enabled https/ssl)

Purposes

access_token. Tạo môi trường test tại localhost hay server dev.

Download OpenSSL binary

1. Download OpenSSL binary http://gnuwin32.sourceforge.net/packages/openssl.htm, bản mới nhất hiện tại là openssl-0.9.8h, extract phần bin (folder bin có chức các file exe như openssl.exe) vào folder giả sử D:\ openssl-0.9.8h.

2. Tạo folder tương ứng certs, config, keys, p12, requests. Có thể chỉ dùng 1 folder cũng được

3. Tạo file text database.txt, command tương ứng là

D:\openssl-0.9.8h>copy con database.txt

4. Tạo file text serial.txt, nội dung có 1 dòng là 01

D:\openssl-0.9.8h>copy con serial.txt

5. Download file config openssl.cnf, search trên Google là có liền (http://stuff.mit.edu/afs/athena/contrib/crypto/openssl.cnf hoặc copy từ thư mục Apache config của Wamp Server D:/Wamp/bin/apache/Apache2.2.17/conf) và copy vào folder config. Chỉnh lại các giá trị trong file config cho phù hợp: ví dụ dưới dùng dir = thư mục hiện tại (dấu .)

dir = .
certs = $dir/certs
database = $dir/database.txt
new_certs_dir = $dir/certs
serial = $dir/serial.txt
...

6. Bắt đầu dùng command line thực hiện các bước mô tả bên dưới, phần đường dẫn D:\ openssl-0.9.8h> trong các command bỏ qua.

Create CA key, self-signed CA cert

1. Tạo CA key, command này sẽ yêu cầu một password

openssl genrsa -des3 -out keys\ca-key.pem 1024

2. Tạo CA self-signed, output vào folder certs, valid 10 năm, dùng config file trong folder config đã chuẩn bị, phần Your Name ví dụ là company.com

openssl req -config config\openssl.cnf -new -x509 -days 3650 -key keys\ca-key.pem -out certs\ca-cert.cer

Backup/Remove passphrase from key

1. Backup CA key

copy keys\ca-key.pem keys\ca-key-org.pem

2. Tạo RSA private key

openssl rsa -in keys\ca-key-org.pem -out keys\ca-key.pem

Tới đây đã có CA cert và CA key

Create localhost (web server) private key (optional)

1. Tương tự tạo private key cho web server (ở đây gọi là localhost hay xxxyyy) giả sử password là password localhost.key.

openssl genrsa -des3 -out keys\server-key.pem 1024

2. Backup CA key

copy keys\server-key.pem keys\server-key-org.pem

3. Tạo RSA private key

openssl rsa -in keys\server-key-org.pem -out keys\server-key.pem

Bước này không cần thiết, vì trong bước sau sẽ thực hiện tạo Certificate Signing Request cùng với Private Key.

Create CSR + Private key

Tạo csr kết quả sẽ output trong folder requests, đồng thời tạo private key cho web server, phần Your Name nên để là localhost, tức địa chỉ localhost hay nếu dùng địa chỉ khác thì là www.company.com

openssl req -new -nodes -days 3650 -config config\openssl.cnf -out requests\server-request.csr -keyout keys\server-key.pem

Sign request WITH CA key

Dùng command openssl ca để ký lên yêu cầu vừa mới tạo trong bước trước

openssl ca -policy policy_anything -config config\openssl.cnf -cert certs\ca-cert.cer -in requests\server-request.csr -keyfile keys\ca-key.pem -days 3650 -out certs\server-cert.cer

Create DER/p12

1. Tạo DER format cer bằng command

openssl x509 -in certs\ca-cert.cer -outform DER -out certs\ca-cert.der

2. Tạo p12 bằng command

openssl pkcs12 -export -in certs\ca-cert.cer -inkey keys\ca-key.pem -certfile certs\ca-cert.cer -out p12\ca.p12

Install CA as Trusted Root CA

Double click vào CA cert và install vào Trusted Root Certification Authorities store.

Install Cert with Wampserver

1. Enable SSL trong file config của Apache, uncomment load module SSL và include HTTPS config

D:\Wamp\bin\apache\Apache2.2.17\conf\httpd.conf

LoadModule ssl_module modules/mod_ssl.so

Include conf/extra/httpd-ssl.conf

2. Copy cert và private key của localhost vừa tạo vào folder config của WampServer Apache D:/Wamp/bin/apache/Apache2.2.17/conf

3. Replace đường dẫn sai trong extra/httpd-ssl.conf dạng path-to-Apache-folder đang bị sai thường là c:/Apache2 thành D:/Wamp/bin/apache/Apache2.2.17 (tùy version và path đang dùng)

4. Uncomment và chỉnh các giá trị SSLCertificateFile và SSLCertificateKeyFile

SSLCertificateFile "D:/Wamp/bin/apache/Apache2.2.17/conf/server-cert.cer"
SSLCertificateKeyFile "D:/Wamp/bin/apache/Apache2.2.17/conf/server-key.pem"

5. Chỉnh lại đường đẫn enable SSL, có thể enable cả www của Wamp Server trong httpd-ssl.conf

DocumentRoot "D:/Wamp/www"

ServerName localhost:443

Testing

Nếu không start được wampapache. Có thể bị lỗi sau (xem trong event logs) có thể cần load thêm module mod_socache_shmcb

The Apache service named reported the following error:

>>> SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you need to load the appropriate socache module (mod_socache_shmcb?). .