首先,我创建了一个ca-cert密钥对
openssl req -new -x509 -keyout private_key.pem -out public_cert.pem -days 365 -nodes
Generating a RSA private key
..+++++
.................................+++++
writing new private key to 'private_key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:.
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:.
Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
Organizational Unit Name (eg, section) []:.
Common Name (e.g. server FQDN or YOUR name) []:35.222.65.55 <----------------------- this ip should be server ip very important
Email Address []:
现在我使用python代码运行服务器。
# libraries needed:
from http.server import HTTPServer, SimpleHTTPRequestHandler
import ssl , socket
# address set
server_ip = '0.0.0.0'
server_port = 3389
# configuring HTTP -> HTTPS
httpd = HTTPServer((server_ip, server_port), SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket(httpd.socket, certfile='./public_cert.pem',keyfile='./private_key.pem', server_side=True)
httpd.serve_forever()
现在,当使用SSL case时,此服务器可以连接到安全ca-cert情况和ingore-ca-cert服务器连接。
也就是说,curl --cacert public_cert.pem --cert-type PEM https://35.222.65.55:3389
和curl -k https://35.222.65.55:3389
可以工作
如何检测请求是否来自服务器端?
发布于 2021-12-14 22:55:23
如何不允许来自服务器端的不安全连接?
服务器端无法控制在客户端进行的证书验证。如果客户端验证了证书,服务器就不知道了。在交换的数据中,没有任何信息表明客户端是否在执行没有此选项的curl -k
或curl。因此,无法阻止具有已损坏或禁用验证的客户端连接到服务器。
https://stackoverflow.com/questions/70359347
复制相似问题