Get the private .key from the .pfx certificate
openssl pkcs12 -in my_certificate.pfx -nocerts -out my_certificate-encrypted.key
Get the decrypted .key file from the encrypted private .key file
openssl rsa -in my_certificate-encrypted.key -out my_certificate.key
Get the .crt file from the .pfx file
openssl pkcs12 -in my_certificate.pfx -clcerts -nokeys -out my_certificate.crt
REF:
https://blog.christian-schou.dk/convert-pfx-to-crt-and-key-file-with-openssl/
設定
nginx 假如 host/ http_host 不是自家 domain 導出 444
nginx 444 表示中斷連線, 連 header 都不會發出來
if ( $host !~* ^(mydomain.com)$ ) {
return 444;
}
if ( $http_host !~* ^(mydomain.com)$ ) {
return 444;
}
更新 SSL 後 CURL 失效
1. 將新的 .crt 拷貝至 /etc/pki/ca-trust/source/anchors
2. 執行 update-ca-trust extract
3. 測試 curl 是否可以重新讀取
ref:
https://ep.gnt.md/index.php/curl-60-peers-certificate-issuer-is-not-recognized/
Step 1. update to last repo
# yum -y install epel-release
# yum -y update
# yum install make gcc kernel-headers kernel-devel perl dkms bzip2
# reboot
Step 2. mount CDROM and install
# mkdir /mnt/cdrom
# mount /dev/cdrom /mnt/cdrom
# cd /mnt/cdrom
# ./VBoxLinuxAdditions.run
# reboot
# yum install nfs-utils rpcbind
# systemctl enable nfs-serverIn RHEL7.1 (nfs-utils-1.3.0-8.el7) enabling nfs-lock does not work (No such file or directory). it does not need to be enabled since rpc-statd.service is static.
# systemctl enable rpcbind
# systemctl enable nfs-lock
# systemctl enable nfs-idmapIn RHEL7.1 (nfs-utils-1.3.0-8.el7) this does not work (No such file or directory). it does not need to be enabled since nfs-idmapd.service is static.
# systemctl start rpcbind4. Check the status of NFS service:
# systemctl start nfs-server
# systemctl start nfs-lock
# systemctl start nfs-idmap
# systemctl status nfs
# mkdir /test
dir client1 (options) [client2(options)...]Client options include (defaults are listed first) :
# vi /etc/exports/test *(rw)
# exportfs -r
-a : exports entries in /etc/exports but do not synchronize with /var/lib/nfs/etab
-i : ignore entries in /etc/exports and uses command line arguments.
-u : un-export one or more directories
-o : specify client options on command line
# systemctl restart nfs-server
# yum install nfs-utils
mount -t nfs -o options host:/remote/export /local/directory
# mount -t nfs -o ro,nosuid remote_host:/home /remote_homeThis example does the following:
# vi /etc/fstab
remote_host:/home /remote_home nfs ro,nosuid 0 0
# firewall-cmd --add-service=nfs --zone=internal --permanent
# firewall-cmd --add-service=mountd --zone=internal --permanent
# firewall-cmd --add-service=rpc-bind --zone=internal --permanent
https://www.thegeekdiary.com/centos-rhel-7-configuring-an-nfs-server-and-nfs-client/
[req]
prompt = no
default_md = sha256
default_bits = 2048
distinguished_name = dn
x509_extensions = v3_req
[dn]
C = TW
ST = Taiwan
L = Taipei
O = My Inc.
OU = IT Department
emailAddress = admin@example.com
CN = CA Disaplay Name
[v3_req]
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.localhost
DNS.2 = localhost
DNS.3 = *.your.domain.name
DNS.4 = 192.168.1.100
openssl req -x509 -new -nodes -sha256 -utf8 -days 3650 -newkey rsa:2048 -keyout server.key -out server.crt -config ssl.conf
openssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx
certutil -addstore -f "ROOT" server.crt