小编van*_*any的帖子

我想使用OpenSSL生成私有/公共/(证书签名请求)并稍后签署一些数据.但我想使用OpenSSL GOST引擎.

我下载了OpenSSL 1.0.0并修改了openssl.cfg文件:

    openssl_conf = openssl_def

    [openssl_def]
    engines = engine_section

    [engine_section]
    gost = gost_section

    [gost_section]
    engine_id = gost
    dynamic_path = ./gost.dll
    default_algorithms = ALL
    CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet

我可以生成私钥和CSR(单行命令字符串):

    openssl req -newkey gost2001 -pkeyopt paramset:A -passout pass:aofvlgzm \
    -subj "/C=RU/ST=Moscow/L=Moscow/O=foo_bar/OU=foo_bar/CN=developer/ \
           emailAddress=vany.egorov@gmail.com" \
    -new > certificate_signing_request.csr

我得到2个文件:

• certificate_signing_request.csr
• privkey.pem

我知道我可以做(打印私钥和公钥的(未加密的)文本表示):

    openssl genpkey -algorithm gost2001 -pkeyopt paramset:A -text

我使用GOST代替RSA,这就是为什么我不能这样做:

    openssl rsa -in privkey.pem -pubout -out pubkey.pem
    Enter pass phrase for privkey.pem:
    6132:error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting …