202 lines
6.1 KiB
Markdown
202 lines
6.1 KiB
Markdown
# 构建文档
|
||
|
||
## 1. 环境准备
|
||
|
||
### 1.1 系统要求
|
||
|
||
- **操作系统**: Ubuntu 24.04 (WSL2)
|
||
- **Java**: OpenJDK 17+
|
||
- **Maven**: 3.6+
|
||
- **GCC**: 13+ (build-essential)
|
||
- **Tongsuo**: 8.4.0
|
||
|
||
### 1.2 依赖安装
|
||
|
||
```bash
|
||
sudo apt update
|
||
sudo apt install -y build-essential libpcre2-dev zlib1g-dev libssl-dev perl
|
||
sudo apt install -y openjdk-17-jdk-headless maven
|
||
```
|
||
|
||
## 2. 编译 Tongsuo
|
||
|
||
```bash
|
||
cd /mnt/d/workbench/gateway2
|
||
tar -xzf 8.4.0.tar.gz
|
||
cd Tongsuo-8.4.0
|
||
./config --prefix=/opt/tongsuo-8.4.0
|
||
make -j$(nproc)
|
||
sudo make install_sw
|
||
```
|
||
|
||
## 3. 编译 Nginx（链接 Tongsuo）
|
||
|
||
```bash
|
||
cd /mnt/d/workbench/gateway2/nginx-1.26.2
|
||
./configure \
|
||
--with-http_ssl_module \
|
||
--with-openssl-opt=no-shared \
|
||
--with-cc-opt="-I/opt/tongsuo-8.4.0/include" \
|
||
--with-ld-opt="-L/opt/tongsuo-8.4.0/lib64 -lssl -lcrypto -ldl -lpthread"
|
||
make -j$(nproc)
|
||
```
|
||
|
||
## 4. 编译 JNI 动态库
|
||
|
||
```bash
|
||
cd /mnt/d/workbench/gateway2/java-client
|
||
javac -h native src/main/java/com/gateway/ssl/jni/GmSSLJNI.java -d target/classes
|
||
|
||
cd native
|
||
gcc -shared -fPIC -o libgmssl_jni.so \
|
||
-I/usr/lib/jvm/java-17-openjdk-amd64/include \
|
||
-I/usr/lib/jvm/java-17-openjdk-amd64/include/linux \
|
||
-I/opt/tongsuo-8.4.0/include \
|
||
-L/opt/tongsuo-8.4.0/lib64 \
|
||
gmssl_jni.c -lssl -lcrypto -ldl \
|
||
-Wl,-rpath,/opt/tongsuo-8.4.0/lib64
|
||
```
|
||
|
||
## 5. 编译 Java 客户端
|
||
|
||
```bash
|
||
cd /mnt/d/workbench/gateway2/java-client
|
||
mvn clean package -Dmaven.test.skip=true
|
||
```
|
||
|
||
## 6. 生成测试证书
|
||
|
||
### 6.1 国密 SM2 证书
|
||
|
||
```bash
|
||
export LD_LIBRARY_PATH=/opt/tongsuo-8.4.0/lib64:$LD_LIBRARY_PATH
|
||
TONGSUO=/opt/tongsuo-8.4.0/bin/openssl
|
||
CERT_DIR=/mnt/d/workbench/gateway2/java-client/certs
|
||
|
||
# CA
|
||
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/ca-sm2-key.pem
|
||
$TONGSUO req -new -SM3 -key $CERT_DIR/ca-sm2-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=SM2 Test CA" \
|
||
-out $CERT_DIR/ca-sm2.csr
|
||
$TONGSUO x509 -req -SM3 -days 3650 \
|
||
-signkey $CERT_DIR/ca-sm2-key.pem \
|
||
-in $CERT_DIR/ca-sm2.csr \
|
||
-out $CERT_DIR/ca-sm2-cert.pem
|
||
|
||
# 服务器签名证书
|
||
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/server-sm2-sign-key.pem
|
||
$TONGSUO req -new -SM3 -key $CERT_DIR/server-sm2-sign-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=localhost" \
|
||
-out $CERT_DIR/server-sm2-sign.csr
|
||
$TONGSUO x509 -req -SM3 -days 3650 \
|
||
-CA $CERT_DIR/ca-sm2-cert.pem -CAkey $CERT_DIR/ca-sm2-key.pem \
|
||
-in $CERT_DIR/server-sm2-sign.csr \
|
||
-out $CERT_DIR/server-sm2-sign-cert.pem
|
||
|
||
# 服务器加密证书
|
||
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/server-sm2-enc-key.pem
|
||
$TONGSUO req -new -SM3 -key $CERT_DIR/server-sm2-enc-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=localhost" \
|
||
-out $CERT_DIR/server-sm2-enc.csr
|
||
$TONGSUO x509 -req -SM3 -days 3650 \
|
||
-CA $CERT_DIR/ca-sm2-cert.pem -CAkey $CERT_DIR/ca-sm2-key.pem \
|
||
-in $CERT_DIR/server-sm2-enc.csr \
|
||
-out $CERT_DIR/server-sm2-enc-cert.pem
|
||
|
||
# 客户端证书
|
||
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/client-sm2-key.pem
|
||
$TONGSUO req -new -SM3 -key $CERT_DIR/client-sm2-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=client" \
|
||
-out $CERT_DIR/client-sm2.csr
|
||
$TONGSUO x509 -req -SM3 -days 3650 \
|
||
-CA $CERT_DIR/ca-sm2-cert.pem -CAkey $CERT_DIR/ca-sm2-key.pem \
|
||
-in $CERT_DIR/client-sm2.csr \
|
||
-out $CERT_DIR/client-sm2-cert.pem
|
||
```
|
||
|
||
### 6.2 ECDSA 证书（Java 兼容）
|
||
|
||
```bash
|
||
$TONGSUO ecparam -genkey -name prime256v1 -out $CERT_DIR/ca-ecdsa-key.pem
|
||
$TONGSUO req -new -key $CERT_DIR/ca-ecdsa-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=ECDSA Test CA" \
|
||
-out $CERT_DIR/ca-ecdsa.csr
|
||
$TONGSUO x509 -req -days 3650 -sha256 \
|
||
-signkey $CERT_DIR/ca-ecdsa-key.pem \
|
||
-in $CERT_DIR/ca-ecdsa.csr \
|
||
-out $CERT_DIR/ca-ecdsa-cert.pem
|
||
|
||
$TONGSUO ecparam -genkey -name prime256v1 -out $CERT_DIR/server-ecdsa-key.pem
|
||
$TONGSUO req -new -key $CERT_DIR/server-ecdsa-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=localhost" \
|
||
-out $CERT_DIR/server-ecdsa.csr
|
||
$TONGSUO x509 -req -days 3650 -sha256 \
|
||
-signkey $CERT_DIR/server-ecdsa-key.pem \
|
||
-in $CERT_DIR/server-ecdsa.csr \
|
||
-out $CERT_DIR/server-ecdsa-cert.pem
|
||
|
||
$TONGSUO ecparam -genkey -name prime256v1 -out $CERT_DIR/client-ecdsa-key.pem
|
||
$TONGSUO req -new -key $CERT_DIR/client-ecdsa-key.pem \
|
||
-subj "/C=CN/O=GatewayTest/CN=client-ecdsa" \
|
||
-out $CERT_DIR/client-ecdsa.csr
|
||
$TONGSUO x509 -req -days 3650 -sha256 \
|
||
-CA $CERT_DIR/ca-ecdsa-cert.pem -CAkey $CERT_DIR/ca-ecdsa-key.pem \
|
||
-in $CERT_DIR/client-ecdsa.csr \
|
||
-out $CERT_DIR/client-ecdsa-cert.pem
|
||
```
|
||
|
||
### 6.3 Java 密钥库
|
||
|
||
```bash
|
||
$TONGSUO pkcs12 -export -inkey $CERT_DIR/client-ecdsa-key.pem \
|
||
-in $CERT_DIR/client-ecdsa-cert.pem \
|
||
-certfile $CERT_DIR/ca-ecdsa-cert.pem \
|
||
-out $CERT_DIR/client-ecdsa.p12 -password pass:changeit
|
||
|
||
$TONGSUO pkcs12 -export -nokeys \
|
||
-in $CERT_DIR/ca-ecdsa-cert.pem \
|
||
-out $CERT_DIR/truststore-ecdsa.p12 -password pass:changeit
|
||
```
|
||
|
||
## 7. 启动测试服务端
|
||
|
||
### 7.1 Tongsuo s_server
|
||
|
||
```bash
|
||
export LD_LIBRARY_PATH=/opt/tongsuo-8.4.0/lib64:$LD_LIBRARY_PATH
|
||
CERT_DIR=/mnt/d/workbench/gateway2/java-client/certs
|
||
TONGSUO=/opt/tongsuo-8.4.0/bin/openssl
|
||
|
||
# 单向认证 (7443)
|
||
$TONGSUO s_server -accept 7443 \
|
||
-cert $CERT_DIR/server-ecdsa-cert.pem \
|
||
-key $CERT_DIR/server-ecdsa-key.pem \
|
||
-WWW -quiet &
|
||
|
||
# 双向认证 (7444)
|
||
$TONGSUO s_server -accept 7444 \
|
||
-cert $CERT_DIR/server-ecdsa-cert.pem \
|
||
-key $CERT_DIR/server-ecdsa-key.pem \
|
||
-CAfile $CERT_DIR/ca-ecdsa-cert.pem \
|
||
-verify 1 \
|
||
-WWW -quiet &
|
||
```
|
||
|
||
## 8. 项目文件结构
|
||
|
||
```
|
||
java-client/
|
||
├── pom.xml # Maven 项目配置
|
||
├── nginx-gmssl.conf # Nginx 国密 SSL 配置模板
|
||
├── native/
|
||
│ ├── gmssl_jni.c # JNI C 实现
|
||
│ ├── com_gateway_ssl_jni_GmSSLJNI.h # JNI 头文件
|
||
│ └── libgmssl_jni.so # 编译产物
|
||
├── certs/ # 测试证书
|
||
└── src/main/java/com/gateway/ssl/
|
||
├── Main.java # 测试入口
|
||
├── config/ # SSL 配置
|
||
├── http/ # HTTPS 客户端
|
||
├── tcp/ # TCP+SSL 客户端
|
||
└── jni/ # JNI 国密客户端
|
||
``` |