广东网站建设英铭科技,网站服务器租用和托管,怎么搭建wap网站,icp备案网站接入信息目录 1. 编译铜锁ssl库2. 编译nghttp2库3. 编译curl4. 验证4.1 查看版本信息4.2 验证国密ssl握手功能4.3 验证http2协议功能 以下以ubuntu 22.04环境为例进行编译
本次编译采用铜锁sslnghttp2curl#xff0c;使得编译出来的curl可以支持国密ssl#xff0c;并且可以支持http2… 目录 1. 编译铜锁ssl库2. 编译nghttp2库3. 编译curl4. 验证4.1 查看版本信息4.2 验证国密ssl握手功能4.3 验证http2协议功能 以下以ubuntu 22.04环境为例进行编译
本次编译采用铜锁sslnghttp2curl使得编译出来的curl可以支持国密ssl并且可以支持http2协议。
废话少说直接上编译过程:
1. 编译铜锁ssl库
git clone https://github.com/Tongsuo-Project/Tongsuocd Tongsuo./config --prefix/opt/tongsuo enable-ntls
make -j
sudo make install2. 编译nghttp2库
git clone https://github.com/tatsuhiro-t/nghttp2.gitcd nghttp2autoreconf -i
automake
autoconf./configure --prefix/opt/nghttp2
make
sudo make install
3. 编译curl
git clone https://github.com/Tongsuo-Project/curl.gitcd curl
git apply tongsuo.patchautoreconf -fiLDFLAGS-Wl,-rpath/opt/tongsuo/lib64:/opt/nghttp2/lib ./configure --enable-warnings --enable-werror --with-openssl/opt/tongsuo --with-nghttp2/opt/nghttp2 --prefix/opt/gmcurl --disable-sharedmake
sudo make install
这里通过rpath指定了生成的curl依赖的libcrypto.so和libssl.so的目录为/opt/tongsuo/lib64libnghttp2.so的目录为/opt/nghttp2/lib并且以静态链接的方式链接到libcurl。
4. 验证
4.1 查看版本信息
通过curl的 --version选项查看相关信息
命令
/opt/gmcurl/curl --version输出curl 8.5.0-DEV (x86_64-pc-linux-gnu) libcurl/8.5.0-DEV OpenSSL/3.0.3 zlib/1.2.11 nghttp2/1.60.0-DEV
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM SSL threadsafe TLS-SRP UnixSockets
从上面看到程序已经支持http2协议了。
在进行相关功能测试之前需要准备一个支持国密和http2协议能力的tengine服务器。
4.2 验证国密ssl握手功能
然后测试和支持国密https的web服务器的国密ssl握手
命令/opt/gmcurl/bin/curl --tlcp https://www.test.com:9443/ -kv输出* Host www.test.com:9441 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
* Trying 127.0.0.1:9441...
* Connected to www.test.com (127.0.0.1) port 9441
* ALPN: curl offers h2,http/1.1
* (101) (OUT), , Unknown (1):
* (101) (IN), , Unknown (2):
* (101) (IN), , Unknown (11):
* (101) (IN), , Unknown (12):
* (101) (IN), , Unknown (14):
* (101) (OUT), , Unknown (16):
* (101) (OUT), , Change cipher spec (1):
* (101) (OUT), , Unknown (20):
* (101) (IN), , Unknown (20):
* SSL connection using NTLSv1.1 / ECC-SM2-SM4-GCM-SM3 / UNDEF / SM2
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
* subject: CCN; STBJ; LHaiDian; OBeijing JNTA Technology LTD.; OUBSRC of TASS; CNserver sign (SM2)
* start date: May 23 02:45:48 2019 GMT
* expire date: Jul 1 02:45:48 2023 GMT
* issuer: CCN; STBJ; LHaiDian; OBeijing JNTA Technology LTD.; OUSORB of TASS; CNTest CA (SM2)
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Certificate level 0: Public key type SM2/SM2 (256/128 Bits/secBits), signed using SM2-with-SM3
* Certificate level 1: Public key type SM2/SM2 (256/128 Bits/secBits), signed using SM2-with-SM3
* using HTTP/1.xGET / HTTP/1.1Host: www.test.com:9441User-Agent: curl/8.5.0-DEVAccept: */*HTTP/1.1 200 OKServer: Tengine/3.1.0Date: Mon, 26 Feb 2024 02:21:21 GMTContent-Type: text/plainContent-Length: 91Connection: keep-aliveContent-Type: text/html;charsetutf-8* Connection #0 to host www.test.com left intact
可以看到已经可以支持国密ssl握手了。
4.3 验证http2协议功能 命令/opt/gmcurl/bin/curl --http https://www.test.com:9443/ -kv输出* Host www.test.com:9441 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
* Trying 127.0.0.1:9441...
* Connected to www.test.com (127.0.0.1) port 9441
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
* subject: Ccn; STcd; LDefault City; ODefault Company Ltd
* start date: Aug 23 07:31:25 2019 GMT
* expire date: Aug 22 07:31:25 2020 GMT
* issuer: Ccn; STcd; LDefault City; ODefault Company Ltd
* SSL certificate verify result: self-signed certificate (18), continuing anyway.
* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA1
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.test.com:9441/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.test.com:9441]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.5.0-DEV]
* [HTTP/2] [1] [accept: */*]GET / HTTP/2Host: www.test.com:9441User-Agent: curl/8.5.0-DEVAccept: */** TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removingHTTP/2 200 server: Tengine/3.1.0date: Mon, 26 Feb 2024 02:44:16 GMTcontent-type: text/plaincontent-length: 90content-type: text/html;charsetutf-8* Connection #0 to host www.test.com left intact
tengine ntls test OK, ssl_protocol is TLSv1.3 (NTLSv1.1 表示国密其他表示国际)下文进一步对铜锁ssl通过curl进行测试验证
支持国密ssl的curl编译和测试验证(下)
