Linux Cache

未启用双向验证时的openssl sclient请求

[root@ip-172-31-47-53 ~]# openssl s_client -connect api.iot.com:443
CONNECTED(00000003)
depth=2 C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = YSWM ROOT CA
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
   i:/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
 1 s:/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
   i:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
 2 s:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
   i:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFojCCA4qgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMxOTA2NDgzOVoXDTIxMDMxOTA2NDgzOVowZjELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV0wxCzAJBgNVBAsMAklUMRQwEgYDVQQDDAthcGkuaW90LmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPKYx0hAmQ0SNZPXY2W7wDZM
2CoQEhMSuAvh5s1+P5QBx+llHCwk2ZNoRXiidRlA1E5Rr1YsAclEjbWcv9YKWiYn
RstZ1/k0/l9xo3dhRgwptb3nXeHht2PXY++uMEOTWWe+C/Q6aYbkia87ZtNI7n82
n9/pFY3dXQatbjulxheYnoWjCz5fl7O0/uw15U7C1P/CB3XMUGLqqm3KKIJfpLmT
gP7L+Q1dZVAcwrIfZdle6wG6dnpjRI7ak0GfbxOTokWAmr6YtWQoHYIoBpw8bKGS
xwc0fhpvwroNAY9pSsNs96wlteVMDp7oibltq31oH10/TWB7j0qflqr9WuFjA7MC
AwEAAaOCAUowggFGMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCG
SAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUw
HQYDVR0OBBYEFPLQcQCz1Qhb+obRMVXL5CiTcIT7MIGsBgNVHSMEgaQwgaGAFLu/
V7kbBJBkvwKAFrDNbnmg6uPfoYGEpIGBMH8xCzAJBgNVBAYTAkNOMRIwEAYDVQQI
DAlHdWFuZ2RvbmcxETAPBgNVBAcMCFNoZW56aGVuMQ0wCwYDVQQKDARZU1dNMSMw
IQYDVQQLDBpZU1dNIENlcnRpZmljYXRlIEF1dGhvcml0eTEVMBMGA1UEAwwMWVNX
TSBST09UIENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH
AwEwDQYJKoZIhvcNAQELBQADggIBAAsmdvtSux+U9FV8Z/+RIHxR/zvuPlc8sVnT
0ivj069MTUwNN7Q91V+YSWzAB//17H9Lsy5f6Fxl9zNP9r9X3F3J9ha1qVZLgJFa
CH3Otn/WPraS6Q1KiBwKPIMCgE0IA2Nz5ZrcIQwlTwQ2gIo41ZEMeVk0QvrXQXra
vEeFTB4NHID5naJivP/ObO1y+4NKiT4hjjjn/xQxW5y0ddAkHYPPibbMlGA3htFe
V/mIcVP7IeBYyJ31GPbJ9zu3hBpLFuqLh1YUdvJj9JL3wKTsPok5tL5RIM3wN9Ir
BOZRkkJ8uN/hsFoMY4cFz1NS7iy/4SnslQibT8oGqa/lBxt+3ABYjI5nQUvyHkf0
+Y1mXyTLy2EbaM4streJPV48FY3vsmwk7bA5BkbjvS3aj7Mt7AW28LtD+szlK1Ix
v4D06+Rl9kfZxFd6MWhLiMIYG4KfyIeficzM2X18PNZNdyxvbM/lWiLapc34aR6g
ISz6/vFD58euDAHYiQnRjsk1cL4ViF3yZVXvZWRm7Lyhwj/5CZ7EGuNXGhw/svMu
RLfr8SeoKohcJGE7nAEu+Q1q6VoNG0HKWk9Y2fEX+pS8z6ET875nL6ce12d9eEYR
CkhIeoqCXtd9qHof3L5Qf5yndGGkn4rt0lG6tZikyXxmzOV2pjr/STezH/2mqLS2
oEAMh2YN
-----END CERTIFICATE-----
subject=/C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
issuer=/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5136 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 62D71A0E3BD96BF7FB3890E13F0BE760153A9687C8D1CF6ADED63410C54EB79A
    Session-ID-ctx: 
    Master-Key: BDB9A9FD44557DA803D7B092E956CFB7A476362A98DFE195AE9567828399FFA8AA9D389A401539CE3CA4E19131F64455
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 37 ed 69 e7 17 db f4 0f-2b d1 76 a5 fd 7a 4c a9   7.i.....+.v..zL.
    0010 - 81 b2 88 94 e1 61 e1 81-3a 7b e8 14 4f e7 51 65   .....a..:{..O.Qe
    0020 - 73 20 e8 16 f8 b8 52 6e-b7 f9 3a 9d 94 92 e7 c9   s ....Rn..:.....
    0030 - 98 6c db 55 bd eb b9 83-18 41 a0 67 16 45 b7 c0   .l.U.....A.g.E..
    0040 - 76 de 48 97 36 a8 53 c5-d3 e6 98 b0 2d 73 96 1b   v.H.6.S.....-s..
    0050 - e3 a8 9e c9 ec 35 e3 06-f0 9b f4 b4 c3 e8 15 79   .....5.........y
    0060 - 5d 6e 97 c4 ae 43 b0 19-43 b3 bb e2 0f 98 10 8a   ]n...C..C.......
    0070 - 86 99 50 44 21 5c d9 ca-3e de 0c d2 05 89 1d bf   ..PD!\..>.......
    0080 - 92 f7 5e e9 25 26 f9 87-9b af 3d 73 9e f9 44 b2   ..^.%&....=s..D.
    0090 - 51 1b 65 ab 3c 4e e9 4b-79 04 d4 f1 49 33 0e b6   Q.e.<N.Ky...I3..
    00a0 - 6c f3 fe 74 b3 9b d4 76-cc 9f ce 69 ff f3 a4 1d   l..t...v...i....

    Start Time: 1584606277
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
closed
[root@ip-172-31-47-53 ~]#

自签CA使用openssl s_client调试时return code: 19的处理

客户端指定CA证书文件参数

-CAfile ./ca/certs/ca.cert.pem

启用双向验证（服务端启用客户端证书验证）时的openssl s_client请求

[root@ip-172-31-47-53 ~]# openssl s_client -connect api.iot.com:443
CONNECTED(00000003)
depth=2 C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = YSWM ROOT CA
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
   i:/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
 1 s:/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
   i:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
 2 s:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
   i:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFojCCA4qgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMxOTA2NDgzOVoXDTIxMDMxOTA2NDgzOVowZjELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV0wxCzAJBgNVBAsMAklUMRQwEgYDVQQDDAthcGkuaW90LmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPKYx0hAmQ0SNZPXY2W7wDZM
2CoQEhMSuAvh5s1+P5QBx+llHCwk2ZNoRXiidRlA1E5Rr1YsAclEjbWcv9YKWiYn
RstZ1/k0/l9xo3dhRgwptb3nXeHht2PXY++uMEOTWWe+C/Q6aYbkia87ZtNI7n82
n9/pFY3dXQatbjulxheYnoWjCz5fl7O0/uw15U7C1P/CB3XMUGLqqm3KKIJfpLmT
gP7L+Q1dZVAcwrIfZdle6wG6dnpjRI7ak0GfbxOTokWAmr6YtWQoHYIoBpw8bKGS
xwc0fhpvwroNAY9pSsNs96wlteVMDp7oibltq31oH10/TWB7j0qflqr9WuFjA7MC
AwEAAaOCAUowggFGMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCG
SAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUw
HQYDVR0OBBYEFPLQcQCz1Qhb+obRMVXL5CiTcIT7MIGsBgNVHSMEgaQwgaGAFLu/
V7kbBJBkvwKAFrDNbnmg6uPfoYGEpIGBMH8xCzAJBgNVBAYTAkNOMRIwEAYDVQQI
DAlHdWFuZ2RvbmcxETAPBgNVBAcMCFNoZW56aGVuMQ0wCwYDVQQKDARZU1dNMSMw
IQYDVQQLDBpZU1dNIENlcnRpZmljYXRlIEF1dGhvcml0eTEVMBMGA1UEAwwMWVNX
TSBST09UIENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH
AwEwDQYJKoZIhvcNAQELBQADggIBAAsmdvtSux+U9FV8Z/+RIHxR/zvuPlc8sVnT
0ivj069MTUwNN7Q91V+YSWzAB//17H9Lsy5f6Fxl9zNP9r9X3F3J9ha1qVZLgJFa
CH3Otn/WPraS6Q1KiBwKPIMCgE0IA2Nz5ZrcIQwlTwQ2gIo41ZEMeVk0QvrXQXra
vEeFTB4NHID5naJivP/ObO1y+4NKiT4hjjjn/xQxW5y0ddAkHYPPibbMlGA3htFe
V/mIcVP7IeBYyJ31GPbJ9zu3hBpLFuqLh1YUdvJj9JL3wKTsPok5tL5RIM3wN9Ir
BOZRkkJ8uN/hsFoMY4cFz1NS7iy/4SnslQibT8oGqa/lBxt+3ABYjI5nQUvyHkf0
+Y1mXyTLy2EbaM4streJPV48FY3vsmwk7bA5BkbjvS3aj7Mt7AW28LtD+szlK1Ix
v4D06+Rl9kfZxFd6MWhLiMIYG4KfyIeficzM2X18PNZNdyxvbM/lWiLapc34aR6g
ISz6/vFD58euDAHYiQnRjsk1cL4ViF3yZVXvZWRm7Lyhwj/5CZ7EGuNXGhw/svMu
RLfr8SeoKohcJGE7nAEu+Q1q6VoNG0HKWk9Y2fEX+pS8z6ET875nL6ce12d9eEYR
CkhIeoqCXtd9qHof3L5Qf5yndGGkn4rt0lG6tZikyXxmzOV2pjr/STezH/2mqLS2
oEAMh2YN
-----END CERTIFICATE-----
subject=/C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
issuer=/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
---
Acceptable client certificate CA names
/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5429 bytes and written 427 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 1065A02DB9470543CD1A23636D4315216639311463D12A1F9EADF69D543F1D04
    Session-ID-ctx: 
    Master-Key: 91579E43C1053D74A1319F3A620259CFF1B40667ADA246A303B89CD017FA813A236DCEC267289EC82A0725A1ABC3D279
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 21 7b 18 62 74 1d b5 ef-15 31 c5 19 a3 5a 51 6b   !{.bt....1...ZQk
    0010 - b3 ea 43 71 71 58 4e 8e-44 70 59 a5 4d ac fe 2f   ..CqqXN.DpY.M../
    0020 - 81 3e 74 41 69 53 b8 40-83 4f 4c 8a 59 29 d4 77   .>tAiS.@.OL.Y).w
    0030 - 51 09 c5 eb 52 b5 7b 28-9d 80 a0 44 c2 89 0d 73   Q...R.{(...D...s
    0040 - 08 61 df 07 f7 2a 9b 0a-8c ae fd b4 23 52 8d 48   .a...*......#R.H
    0050 - c0 c9 b5 87 29 50 47 8b-56 01 30 87 c8 e4 9a d2   ....)PG.V.0.....
    0060 - 2d 5d 50 c4 49 15 56 bf-ac e3 92 c6 61 97 32 29   -]P.I.V.....a.2)
    0070 - 58 2d 5d 5e 54 11 05 21-63 8f b0 84 ff 82 52 c4   X-]^T..!c.....R.
    0080 - bb fd f8 3b 31 d7 01 e6-5f 2a 6a a8 f4 06 16 08   ...;1..._*j.....
    0090 - ac 0d a7 34 46 f7 88 08-92 25 08 12 2d ee ba f2   ...4F....%..-...
    00a0 - 85 ba 09 be 78 25 83 56-b7 b7 47 04 cd a3 0c 67   ....x%.V..G....g

    Start Time: 1584607327
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
closed
[root@ip-172-31-47-53 ~]#

启用双向验证（服务端启用客户端证书验证）时的完整openssl s_client请求

[root@ip-172-31-47-53 ~]# openssl s_client -connect api.iot.com:443 -tls1_2 -key ./device.key.pem -cert ./ca/intermediate/certs/device.cert.pem -CAfile ./ca/certs/ca.cert.pem -state
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=2 C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = YSWM ROOT CA
verify return:1
depth=1 C = CN, ST = Guangdong, O = YSWM, OU = YSWM Certificate Authority, CN = YSWM Intermediate CA
verify return:1
depth=0 C = CN, ST = Guangdong, L = Shenzhen, O = YSWL, OU = IT, CN = api.iot.com
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server certificate request A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client certificate A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write certificate verify A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read server session ticket A
SSL_connect:SSLv3 read finished A
---
Certificate chain
 0 s:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
   i:/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
 1 s:/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
   i:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
 2 s:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
   i:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFojCCA4qgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMxOTA2NDgzOVoXDTIxMDMxOTA2NDgzOVowZjELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV0wxCzAJBgNVBAsMAklUMRQwEgYDVQQDDAthcGkuaW90LmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPKYx0hAmQ0SNZPXY2W7wDZM
2CoQEhMSuAvh5s1+P5QBx+llHCwk2ZNoRXiidRlA1E5Rr1YsAclEjbWcv9YKWiYn
RstZ1/k0/l9xo3dhRgwptb3nXeHht2PXY++uMEOTWWe+C/Q6aYbkia87ZtNI7n82
n9/pFY3dXQatbjulxheYnoWjCz5fl7O0/uw15U7C1P/CB3XMUGLqqm3KKIJfpLmT
gP7L+Q1dZVAcwrIfZdle6wG6dnpjRI7ak0GfbxOTokWAmr6YtWQoHYIoBpw8bKGS
xwc0fhpvwroNAY9pSsNs96wlteVMDp7oibltq31oH10/TWB7j0qflqr9WuFjA7MC
AwEAAaOCAUowggFGMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCG
SAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUw
HQYDVR0OBBYEFPLQcQCz1Qhb+obRMVXL5CiTcIT7MIGsBgNVHSMEgaQwgaGAFLu/
V7kbBJBkvwKAFrDNbnmg6uPfoYGEpIGBMH8xCzAJBgNVBAYTAkNOMRIwEAYDVQQI
DAlHdWFuZ2RvbmcxETAPBgNVBAcMCFNoZW56aGVuMQ0wCwYDVQQKDARZU1dNMSMw
IQYDVQQLDBpZU1dNIENlcnRpZmljYXRlIEF1dGhvcml0eTEVMBMGA1UEAwwMWVNX
TSBST09UIENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH
AwEwDQYJKoZIhvcNAQELBQADggIBAAsmdvtSux+U9FV8Z/+RIHxR/zvuPlc8sVnT
0ivj069MTUwNN7Q91V+YSWzAB//17H9Lsy5f6Fxl9zNP9r9X3F3J9ha1qVZLgJFa
CH3Otn/WPraS6Q1KiBwKPIMCgE0IA2Nz5ZrcIQwlTwQ2gIo41ZEMeVk0QvrXQXra
vEeFTB4NHID5naJivP/ObO1y+4NKiT4hjjjn/xQxW5y0ddAkHYPPibbMlGA3htFe
V/mIcVP7IeBYyJ31GPbJ9zu3hBpLFuqLh1YUdvJj9JL3wKTsPok5tL5RIM3wN9Ir
BOZRkkJ8uN/hsFoMY4cFz1NS7iy/4SnslQibT8oGqa/lBxt+3ABYjI5nQUvyHkf0
+Y1mXyTLy2EbaM4streJPV48FY3vsmwk7bA5BkbjvS3aj7Mt7AW28LtD+szlK1Ix
v4D06+Rl9kfZxFd6MWhLiMIYG4KfyIeficzM2X18PNZNdyxvbM/lWiLapc34aR6g
ISz6/vFD58euDAHYiQnRjsk1cL4ViF3yZVXvZWRm7Lyhwj/5CZ7EGuNXGhw/svMu
RLfr8SeoKohcJGE7nAEu+Q1q6VoNG0HKWk9Y2fEX+pS8z6ET875nL6ce12d9eEYR
CkhIeoqCXtd9qHof3L5Qf5yndGGkn4rt0lG6tZikyXxmzOV2pjr/STezH/2mqLS2
oEAMh2YN
-----END CERTIFICATE-----
subject=/C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
issuer=/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
---
Acceptable client certificate CA names
/C=CN/ST=Guangdong/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM Intermediate CA
/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 6757 bytes and written 2015 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: AAB0EF0F80FC694473791CD82FBAC09E1D2898F0A0809649313C99D5C7200483
    Session-ID-ctx: 
    Master-Key: 753B0AC90C5EF61C2065EC4CDDDBCF547787633E5E02B45AD73FAEE42FD8019D0BD3233543A70543C5EF276C9CAFDBEB
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 21 7b 18 62 74 1d b5 ef-15 31 c5 19 a3 5a 51 6b   !{.bt....1...ZQk
    0010 - db ca cd da a0 46 ac 3a-4b fe 0a cc bd d9 e5 c0   .....F.:K.......
    0020 - 4b 63 e9 3f ba 9f 01 72-45 3f 31 32 07 98 8b ad   Kc.?...rE?12....
    0030 - c8 b6 d6 65 9c 3b 04 99-13 e8 20 5e 45 0d bd 00   ...e.;.... ^E...
    0040 - 00 a1 d2 c6 34 50 4c 07-12 da aa e7 7e 90 b0 0c   ....4PL.....~...
    0050 - ba 60 e5 70 98 23 1c 57-08 34 00 64 fe ce 37 b5   .`.p.#.W.4.d..7.
    0060 - 7c 6f 66 2d 6a b8 9a 53-ef dd ab bd e3 1e 0d bc   |of-j..S........
    0070 - 69 eb df 29 a5 dd 92 9e-78 c4 77 2f c4 29 62 85   i..)....x.w/.)b.
    0080 - e5 67 6f 5a 83 1a 7b 84-23 37 ab 56 93 2d d9 75   .goZ..{.#7.V.-.u
    0090 - 44 a1 79 82 06 d3 b3 74-65 a7 ed 91 79 8b 0b 94   D.y....te...y...
    00a0 - 05 90 ed 42 c0 88 e0 ae-de c9 a7 3f 0b 45 e8 0f   ...B.......?.E..
    00b0 - af 86 3a 1e 9f 7e c2 66-a9 94 16 1c 1e a1 3d da   ..:..~.f......=.
    00c0 - 4b c7 71 72 87 9d 56 69-de 2e 52 4c d7 0c 45 ec   K.qr..Vi..RL..E.
    00d0 - 1a 5e bb 2d c8 77 65 6f-c6 0b 7a af 1d d0 dd e8   .^.-.weo..z.....
    00e0 - 3e ae cb a2 b7 1b ed 81-c1 13 9e 8f 7c 99 4a 90   >...........|.J.
    00f0 - 4e 42 b1 63 8a 80 08 ee-ad 3c 31 2f bd 53 4b 5f   NB.c.....<1/.SK_
    0100 - 7c 51 02 eb 70 37 aa 1c-73 49 fb 9c e6 6c 84 d0   |Q..p7..sI...l..
    0110 - a5 88 43 08 43 fc 9b 43-5f ef 53 bf ae 74 ac 15   ..C.C..C_.S..t..
    0120 - 4d 1b 6a c9 7c 37 e9 f7-d1 3c 54 72 9f 4e de 45   M.j.|7...<Tr.N.E
    0130 - b9 2a 5c 31 40 12 40 ec-17 c1 19 23 08 d1 9f 70   .*\1@.@....#...p
    0140 - 39 06 51 ff 9c d0 34 62-a7 75 29 46 9e e5 0b a5   9.Q...4b.u)F....
    0150 - 6b b4 2b d6 c0 21 25 a3-ad cf 83 43 13 d1 79 6f   k.+..!%....C..yo
    0160 - 1e 51 54 a6 70 9a 13 24-4f 5c 77 16 66 d0 c8 e5   .QT.p..$O\w.f...
    0170 - 56 0e 1e 4d dd 17 76 11-4d ff 94 ee 70 18 ab 2f   V..M..v.M...p../
    0180 - 11 20 2b 72 7e 9e 0f 54-55 f3 c7 0d 15 54 d3 e5   . +r~..TU....T..
    0190 - f9 a3 f1 67 03 c9 b5 26-b4 6a 2b 08 5c d5 bf db   ...g...&.j+.\...
    01a0 - 00 81 d0 d2 01 28 c4 05-a7 88 48 bf 32 2b d4 64   .....(....H.2+.d
    01b0 - fe 2d 7f ea d5 e3 2f 8c-23 b2 c0 92 e7 02 d2 b4   .-..../.#.......
    01c0 - a9 b1 6f 05 ce ff c3 78-87 38 f0 ac d6 42 fd 70   ..o....x.8...B.p
    01d0 - 50 3e 51 d2 48 cf ab 91-72 06 90 b9 a1 f9 19 81   P>Q.H...r.......
    01e0 - 15 c4 dd 5b 02 f9 61 94-1c 6a 1a 17 fc c6 a6 8f   ...[..a..j......
    01f0 - 24 95 2d 48 90 7c e6 4e-90 6d 3d 57 e6 2c 92 f8   $.-H.|.N.m=W.,..
    0200 - 3f 7b 02 d5 16 47 a5 b2-94 74 5e 3b 9d bc 0b d1   ?{...G...t^;....
    0210 - 78 63 c2 d4 6c ae f6 d3-aa 8d 49 1c 5c f1 b7 76   xc..l.....I.\..v
    0220 - 8f f5 6e 62 93 82 9b 6c-9c 30 de 58 f8 b1 04 85   ..nb...l.0.X....
    0230 - 0c c4 79 cc 9a 95 d3 8d-42 6a 3d ba f2 b5 2e e0   ..y.....Bj=.....
    0240 - ab 06 1d 6c 64 2c d2 da-59 81 bc 41 20 48 ce b0   ...ld,..Y..A H..
    0250 - 23 f8 09 4c 80 93 ce 8d-26 06 05 83 08 55 f5 d9   #..L....&....U..
    0260 - 96 ee 8f 9f 88 7f 07 b4-b2 5b c4 f3 24 2c b6 ec   .........[..$,..
    0270 - 2b dc 85 a2 ef 1e 20 5b-90 ed b8 6b fc a0 e4 72   +..... [...k...r
    0280 - f7 76 45 d1 26 e5 2c 39-67 ed be 5a 7f f3 64 37   .vE.&.,9g..Z..d7
    0290 - 98 9d 01 68 e0 27 b4 b8-32 1d cb 3a 52 46 9e 8f   ...h.'..2..:RF..
    02a0 - c8 a8 b2 5e c9 b1 a3 b1-76 b3 a5 e0 6f 41 bc 80   ...^....v...oA..
    02b0 - 60 d4 3b e7 3c 3b ff 9a-1a 08 4a 8c fa 48 86 5c   `.;.<;....J..H.\
    02c0 - 24 fd 9a 3c 3c c9 4b a2-a9 5d 5e 8d 07 1c f8 7f   $..<<.K..]^.....
    02d0 - 14 86 15 45 f9 d5 16 3a-a8 d9 a3 8d 18 06 b7 14   ...E...:........
    02e0 - 0a 0e 8b 42 18 6e e0 09-0f f3 2e 6b e8 1d 2b 37   ...B.n.....k..+7
    02f0 - c5 fc 55 f5 61 58 0b 5c-db 72 bb fb b2 75 4a cf   ..U.aX.\.r...uJ.
    0300 - 12 04 05 83 ea d7 e4 69-bf c3 0b 6a b7 1d 4c 57   .......i...j..LW
    0310 - 98 38 bd 72 9d a6 3c c9-14 98 f5 0b c2 3f ec 3e   .8.r..<......?.>
    0320 - 59 f8 44 e0 b6 0e 43 f0-2a d9 a2 99 24 9f 37 13   Y.D...C.*...$.7.
    0330 - db ec 5f 45 33 01 4e 47-24 b3 20 52 f4 25 a0 20   .._E3.NG$. R.%. 
    0340 - 59 f5 6c ac a6 36 91 96-aa 8e 50 fc 41 f5 d0 2d   Y.l..6....P.A..-
    0350 - f1 2d 3a db 21 d7 6b 49-d9 a1 24 89 18 90 c7 06   .-:.!.kI..$.....
    0360 - fe 1c 66 aa 72 10 57 b1-9f fb a8 d0 7b 54 71 eb   ..f.r.W.....{Tq.
    0370 - ae 12 f6 1d 0c 4b a4 bc-08 93 d1 7a 4e 46 d4 86   .....K.....zNF..
    0380 - 65 97 1f de 62 f2 87 68-4c 43 93 81 f5 01 21 4c   e...b..hLC....!L
    0390 - ea 8b a3 ea 21 75 3c 59-5b 46 b9 32 28 0b 53 1d   ....!u<Y[F.2(.S.
    03a0 - 83 60 bc 53 4c f0 35 d9-f2 5a 4a 6c bc 75 d7 e2   .`.SL.5..ZJl.u..
    03b0 - 4a 52 85 e7 54 9d c3 52-69 cc b0 a1 88 3b 78 e0   JR..T..Ri....;x.
    03c0 - cb 4d a3 db bc f0 28 85-f0 41 cc 73 e8 de 59 3a   .M....(..A.s..Y:
    03d0 - dc cb 8a eb 32 ef 99 26-bb 3b dc eb 1d f4 fc d6   ....2..&.;......
    03e0 - 2e 7e b2 e8 a5 41 2b 4a-9b 85 09 96 b0 6c 21 f7   .~...A+J.....l!.
    03f0 - 7e 29 8e 6a bd 0c 3a 5f-44 3f 7a dc 2a 65 26 71   ~).j..:_D?z.*e&q
    0400 - 6d ac cf 68 82 1d 63 f6-66 3d 1d a7 8a db 1c 4d   m..h..c.f=.....M
    0410 - 6a 5e de fe 3f ab 62 97-7f ed a8 27 fa 61 fb 48   j^..?.b....'.a.H
    0420 - d4 20 38 ae 44 26 63 df-45 e8 65 11 48 07 38 39   . 8.D&c.E.e.H.89
    0430 - 54 dc ea b6 9a 92 94 0f-88 80 e5 be d1 d1 f5 88   T...............
    0440 - f8 7c 40 e2 1c 6f 2a 47-e8 0a c8 19 e7 01 ad 38   .|@..o*G.......8
    0450 - ab a1 c0 1d a0 56 29 23-40 d4 0a 75 7e ad cd 5b   .....V)#@..u~..[
    0460 - 80 b7 85 6f e2 7d c4 85-5b 5a 8b 05 c6 80 e7 b1   ...o.}..[Z......
    0470 - ce 57 14 e5 f8 5d 99 be-66 d9 41 6d eb 40 8f 22   .W...]..f.Am.@."
    0480 - ac 79 c2 61 31 41 71 c0-87 c6 78 b4 73 24 06 69   .y.a1Aq...x.s$.i
    0490 - 6c 15 36 7d f2 80 5d b4-59 44 be 64 bf 61 f8 fc   l.6}..].YD.d.a..
    04a0 - 5f d6 8e 9e fe 6c 95 b9-d0 36 b8 0d 5f 67 eb 9b   _....l...6.._g..
    04b0 - 2f ea b1 36 fd 2e 68 ae-0e 99 b8 c6 bb 1d c4 7d   /..6..h........}
    04c0 - 57 60 19 03 8b 15 ca 24-ec 40 d4 21 f1 de 1b 1a   W`.....$.@.!....
    04d0 - 19 a1 35 eb fb f7 82 8d-14 71 f6 a8 1d 0c d8 4c   ..5......q.....L
    04e0 - 46 d8 1c 97 c9 32 64 5b-21 a7 4d e2 59 2b 4b 3d   F....2d[!.M.Y+K=
    04f0 - ef 3e 09 91 b7 66 ad c2-a4 f5 a6 d8 25 bb 81 a4   .>...f......%...
    0500 - b0 00 ea 80 d3 5c 74 ac-57 d8 3a c7 44 22 eb eb   .....\t.W.:.D"..
    0510 - ad c9 9b 73 8e db 59 4b-4a ea 33 85 20 7b 6d 61   ...s..YKJ.3. {ma
    0520 - 4c a5 61 a6 9e 5d 18 10-75 f5 cc 73 f7 72 66 f8   L.a..]..u..s.rf.
    0530 - 2b 87 65 b6 e3 25 b8 30-84 90 64 6f 90 18 6a 17   +.e..%.0..do..j.
    0540 - 55 bf 70 3a 78 16 27 ac-35 89 9d ec 0a 3e 79 19   U.p:x.'.5....>y.
    0550 - aa 2d 6e fe 64 f0 bc 5f-0d b4 19 e9 bb 8d 57 ca   .-n.d.._......W.
    0560 - 49 f6 e2 18 04 84 7d 3e-79 fd bf 36 62 0f 89 85   I.....}>y..6b...
    0570 - 8a 38 67 37 9c 52 a5 49-7b e1 fa b4 8f 62 57 d3   .8g7.R.I{....bW.
    0580 - ec 92 58 e3 51 ad 5b fa-0f 02 37 bd 05 b6 ce 0e   ..X.Q.[...7.....
    0590 - e9 30 69 47 c3 c9 02 cd-f9 cc 71 46 db 0c 5a a5   .0iG......qF..Z.
    05a0 - ed 2a b8 f7 fb 0a c0 b2-a8 7a 9d 35 75 1e f1 fe   .*.......z.5u...
    05b0 - df 47 0d 47 0b e2 94 88-69 26 e2 dc ef 5c 18 71   .G.G....i&...\.q
    05c0 - 01 28 83 26 4d ae 73 c7-db 4d 36 06 d1 0d d1 90   .(.&M.s..M6.....
    05d0 - 22 99 5e c4 ee 84 f9 a4-4a de b4 fe e0 d0 8d 8a   ".^.....J.......

    Start Time: 1584608510
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
SSL3 alert read:warning:close notify
closed
SSL3 alert write:warning:close notify
[root@ip-172-31-47-53 ~]#

命令参数

openssl s_client -connect api.iot.com:443 -tls1_2 \
-key ./device.key.pem \
-cert ./ca/intermediate/certs/device.cert.pem \
-CAfile ./ca/certs/ca.cert.pem -state

openssl s_client -connect api.iot.com:443 -tls1_2 \
-key ./device.key.pem \
-cert ./ca/intermediate/certs/device.cert.pem \
-CAfile ./ca/certs/ca.cert.pem -state -debug

修改中级CA配置文件

[root@ip-172-31-2-174 ca]# vi intermediate/openssl.cnf

适用于客户端验证服务端证书吊销状态

[ server_cert ]
authorityInfoAccess = OCSP;URI:http://ocsp.iot.com

适用于服务端验证客户端证书吊销状态

[ usr_cert ]
authorityInfoAccess = OCSP;URI:http://ocsp.iot.com

生成OCSP私钥

openssl genrsa -aes256 \
-out intermediate/private/ocsp.iot.com.key.pem 4096

[root@ip-172-31-2-174 ca]# openssl genrsa -aes256 \
> -out intermediate/private/ocsp.iot.com.key.pem 4096
Generating RSA private key, 4096 bit long modulus
...............++
............++
e is 65537 (0x10001)
Enter pass phrase for intermediate/private/ocsp.iot.com.key.pem:
Verifying - Enter pass phrase for intermediate/private/ocsp.iot.com.key.pem:
[root@ip-172-31-2-174 ca]#

生成OCSP CSR文件

openssl req -config intermediate/openssl.cnf -new -sha256 \
-key intermediate/private/ocsp.iot.com.key.pem \
-out intermediate/csr/ocsp.iot.com.csr.pem

[root@ip-172-31-2-174 ca]# openssl req -config intermediate/openssl.cnf -new -sha256 \
> -key intermediate/private/ocsp.iot.com.key.pem \
> -out intermediate/csr/ocsp.iot.com.csr.pem
Enter pass phrase for intermediate/private/ocsp.iot.com.key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name [England]:Guangdong
Locality Name []:Shenzhen
Organization Name [Alice Ltd]:YSWM
Organizational Unit Name []:YSWM Certificate Authority
Common Name []:ocsp.iot.com
Email Address []:
[root@ip-172-31-2-174 ca]#

生成OCSP证书

openssl ca -config intermediate/openssl.cnf \
-extensions ocsp -days 375 -notext -md sha256 \
-in intermediate/csr/ocsp.iot.com.csr.pem \
-out intermediate/certs/ocsp.iot.com.cert.pem

[root@ip-172-31-2-174 ca]# openssl ca -config intermediate/openssl.cnf \
> -extensions ocsp -days 375 -notext -md sha256 \
> -in intermediate/csr/ocsp.iot.com.csr.pem \
> -out intermediate/certs/ocsp.iot.com.cert.pem
Using configuration from intermediate/openssl.cnf
Enter pass phrase for /root/ca/intermediate/private/intermediate.key.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4098 (0x1002)
        Validity
            Not Before: Mar 21 06:17:03 2020 GMT
            Not After : Mar 31 06:17:03 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Guangdong
            localityName              = Shenzhen
            organizationName          = YSWM
            organizationalUnitName    = YSWM Certificate Authority
            commonName                = ocsp.iot.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B0:F5:53:93:E6:76:AD:F9:2A:87:38:9B:0F:D9:00:AD:77:2E:F1:5B
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                OCSP Signing
Certificate is to be certified until Mar 31 06:17:03 2021 GMT (375 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ip-172-31-2-174 ca]#

验证OCSP证书状态

openssl x509 -in intermediate/certs/ocsp.iot.com.cert.pem \
-text -noout

[root@ip-172-31-2-174 ca]# openssl x509 -in intermediate/certs/ocsp.iot.com.cert.pem \
> -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4098 (0x1002)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM Intermediate CA
        Validity
            Not Before: Mar 21 06:17:03 2020 GMT
            Not After : Mar 31 06:17:03 2021 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=ocsp.iot.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:c7:69:7f:2a:6b:ba:96:d9:52:43:88:91:fb:fa:
                    ce:3b:a0:b6:80:e5:1e:29:d4:4e:34:b5:45:c9:ae:
                    88:6a:12:90:cc:de:d3:1c:91:59:7a:84:d3:5c:53:
                    38:2b:e2:d9:47:a2:21:ff:ae:8c:51:03:76:dc:08:
                    44:84:77:e0:ea:34:ca:65:de:25:cd:19:34:70:95:
                    d7:cf:78:01:26:c1:79:f8:89:e2:c0:c3:b5:64:e1:
                    55:6c:ea:63:03:ac:c9:81:c6:33:f0:ad:64:32:6c:
                    5e:94:dc:71:76:9c:dd:7e:d0:a2:df:75:ec:47:6b:
                    22:de:0d:72:1d:a7:79:fa:5e:04:66:68:e9:8b:a2:
                    e4:bc:d6:b6:b9:6d:0d:7c:6b:7b:36:44:38:36:51:
                    a2:72:50:c2:51:66:21:f8:e0:2c:b9:68:2d:c7:75:
                    da:d3:95:ce:c0:33:3e:7c:ba:81:3b:c3:fa:74:29:
                    30:f4:c7:ce:dd:00:cc:27:6c:58:ea:8f:f2:24:f8:
                    09:f5:02:ff:4b:2e:9a:53:47:5b:27:77:29:c3:37:
                    26:4f:2d:1c:c9:c7:be:53:30:01:02:a6:41:b8:77:
                    03:14:a5:69:ef:9d:fe:ce:19:3b:09:25:a6:8e:eb:
                    52:18:9b:a7:88:ab:63:30:31:64:bb:52:13:04:8c:
                    34:cb:13:71:c0:94:6c:dd:fb:3d:8d:a1:d9:65:28:
                    bc:c8:e8:d3:6a:02:ca:50:8b:a9:97:4d:8e:be:c2:
                    04:3d:1f:76:76:96:b6:d2:43:a9:0a:75:4e:f2:e4:
                    39:67:aa:08:7f:75:12:6a:5a:45:36:e4:f9:7b:4e:
                    9e:bd:b8:42:45:95:16:07:42:4c:b9:23:42:04:c3:
                    71:1c:28:40:27:a7:e1:2d:77:fa:b6:56:29:67:e2:
                    e5:10:fc:38:c9:8c:e2:44:19:ae:b5:90:b0:63:1d:
                    76:82:21:93:95:01:2a:ba:7d:76:3e:f1:dc:1d:b8:
                    5c:ec:d2:04:7e:e6:11:a1:76:3f:f3:f1:7d:57:82:
                    77:d5:a8:eb:b0:fb:bb:65:c7:a7:74:ad:36:f5:a8:
                    b5:dc:4a:ba:91:f5:d7:1b:1f:31:4c:d4:e2:b7:35:
                    2b:b8:a5:a8:0a:76:d5:2e:71:dd:66:d4:23:34:87:
                    c5:61:e1:bd:83:df:99:85:42:a0:45:c2:12:90:09:
                    23:f0:f3:4b:f0:19:e4:3a:e5:2b:77:d0:79:5b:02:
                    62:50:03:38:2e:31:d5:c3:56:2b:bc:4a:7f:27:a7:
                    3b:05:80:0f:6f:34:b3:19:60:10:c1:a7:d6:8b:16:
                    ee:41:14:0e:c0:94:4c:9d:79:a0:15:1b:4d:39:fc:
                    f6:14:d9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B0:F5:53:93:E6:76:AD:F9:2A:87:38:9B:0F:D9:00:AD:77:2E:F1:5B
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
         08:59:ae:bf:ef:a5:7c:8c:29:5e:0e:d4:ef:ce:84:6f:97:a1:
         0e:a1:5b:1f:00:30:86:93:b3:5d:3c:1c:88:63:09:17:c7:f1:
         a2:d1:40:d4:5d:11:59:36:37:e2:5b:f4:93:69:b9:08:6b:2d:
         dc:b8:55:d4:44:a1:d7:76:7d:e9:21:fa:f2:0d:c5:11:6a:2e:
         33:06:ba:3f:af:72:5b:73:01:d4:1a:1e:df:e8:a6:ac:fb:bc:
         e7:42:c5:c1:5e:96:63:ee:be:23:34:9b:89:12:1b:75:d7:04:
         fb:e0:a0:96:fc:29:54:cd:c2:d3:34:d4:1f:eb:bf:43:68:d3:
         ab:e6:3b:03:73:46:3d:e7:fe:23:63:ec:d7:d7:69:da:d5:67:
         55:b4:ca:20:74:2b:f0:f8:f2:ba:74:48:2f:53:be:7b:a9:e6:
         ce:c8:0a:c9:34:5d:3f:ae:d0:d5:30:87:88:ad:12:56:ee:5a:
         36:f2:96:d0:a4:55:c3:db:c0:1f:3c:3a:b7:e3:a2:d4:ad:91:
         5b:da:f2:51:87:05:46:68:95:97:67:37:02:a0:3c:0c:b2:d4:
         c0:bd:12:c9:c8:04:41:4f:33:32:96:2b:6e:6c:5f:e0:ea:f9:
         ac:ea:b5:58:6e:41:67:19:1f:02:73:20:62:85:6f:35:b5:f2:
         97:1c:33:08:25:d6:f9:eb:2b:aa:aa:cb:91:1c:13:98:cb:9b:
         d6:22:8c:fb:c6:20:ce:18:ce:0d:b8:d5:0b:92:d8:6d:dd:d3:
         a1:95:ad:1b:3e:be:4f:1e:5e:dd:bf:f2:f1:86:60:34:ae:e3:
         19:74:93:b1:42:9b:0e:3f:b8:05:a0:6a:4a:2a:25:63:48:70:
         b0:86:7f:14:90:f9:1c:9a:8a:47:70:29:1d:27:bd:dd:8f:99:
         f7:37:3e:a4:d5:08:83:4d:13:67:29:12:ae:99:25:43:39:9f:
         4c:5f:63:d6:e7:41:f4:d5:d0:68:45:c4:53:c1:25:99:27:00:
         af:4d:86:8e:f1:04:82:9c:b7:dc:6e:df:d5:f9:0c:2a:f4:c2:
         a8:fb:c4:c9:49:fb:c6:dd:0a:1a:be:d4:ef:05:95:1e:0f:d6:
         7b:0a:4e:8d:85:95:46:d7:aa:0c:5f:c4:9c:95:25:47:66:e2:
         d6:5f:43:b5:23:ad:92:bf:f8:8d:6e:3b:d6:37:8f:11:af:0e:
         b3:dd:29:51:34:b5:ae:45:5d:5c:e1:2d:d4:1c:93:fe:f9:da:
         cb:23:82:ad:23:88:3a:82:e6:ed:ab:91:56:58:05:f9:88:a2:
         0c:42:7d:dc:e0:d9:03:e3:51:fa:36:1b:a7:ad:5e:f1:f0:ff:
         53:06:de:c4:3b:6e:76:fd
[root@ip-172-31-2-174 ca]#

查看证书签发列表

[root@ip-172-31-2-174 ca]# cat intermediate/index.txt
V       210321055837Z           1000    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
V       200917060403Z           1001    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=MENGNIU/OU=IT/CN=IOTHS0000238
V       210331061703Z           1002    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=ocsp.iot.com
[root@ip-172-31-2-174 ca]# 

使用OCSP检查客户端证书吊销状态

运行服务端

openssl ocsp -port 127.0.0.1:2560 -text -sha256 \
-index intermediate/index.txt \
-CA intermediate/certs/ca-chain.cert.pem \
-rkey intermediate/private/ocsp.iot.com.key.pem \
-rsigner intermediate/certs/ocsp.iot.com.cert.pem \
-nrequest 1

[root@ip-172-31-2-174 ca]# openssl ocsp -port 127.0.0.1:2560 -text -sha256 \
> -index intermediate/index.txt \
> -CA intermediate/certs/ca-chain.cert.pem \
> -rkey intermediate/private/ocsp.iot.com.key.pem \
> -rsigner intermediate/certs/ocsp.iot.com.cert.pem \
> -nrequest 1
Enter pass phrase for intermediate/private/ocsp.iot.com.key.pem:
Waiting for OCSP client connections...

运行客户端

openssl ocsp -CAfile intermediate/certs/ca-chain.cert.pem \
-url http://127.0.0.1:2560 -resp_text \
-issuer intermediate/certs/intermediate.cert.pem \
-cert intermediate/certs/device.cert.pem

服务端输出

OCSP Request Data:
    Version: 1 (0x0)
    Requestor List:
        Certificate ID:
          Hash Algorithm: sha1
          Issuer Name Hash: BF07CCE36736D257F8D75DE02D5E65E1CB8068F3
          Issuer Key Hash: 8081958BB9215707AE5EE20A2CEE882DB6DBEFEF
          Serial Number: 1001
    Request Extensions:
        OCSP Nonce: 
            0410C85B38CAADFCCAB98072C7F6BF3D6EE1
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = ocsp.iot.com
    Produced At: Mar 21 06:42:58 2020 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: BF07CCE36736D257F8D75DE02D5E65E1CB8068F3
      Issuer Key Hash: 8081958BB9215707AE5EE20A2CEE882DB6DBEFEF
      Serial Number: 1001
    Cert Status: good
    This Update: Mar 21 06:42:58 2020 GMT

    Response Extensions:
        OCSP Nonce: 
            0410C85B38CAADFCCAB98072C7F6BF3D6EE1
    Signature Algorithm: sha256WithRSAEncryption
         51:40:18:da:ef:c5:e3:e6:af:b9:26:6a:19:a8:63:24:f7:4a:
         41:0a:de:88:b4:16:73:7c:3e:7e:af:cb:f6:75:41:eb:19:da:
         55:2a:96:b1:77:d1:98:aa:f8:4a:02:88:4c:5a:1f:03:a6:d4:
         97:1b:4d:cb:4d:98:bc:19:02:6a:b5:be:5e:d0:c2:33:3e:c7:
         5d:b7:63:86:b3:71:8f:63:58:6b:7d:9d:7c:29:0d:52:a4:03:
         b2:ba:7a:da:90:19:93:68:04:ad:8d:66:1b:f0:f6:af:ce:98:
         09:26:88:b6:98:43:0f:e6:6d:32:4d:2d:9a:01:9d:fb:8c:00:
         b2:89:95:c7:2b:c2:aa:e2:ea:b1:75:81:7f:3c:12:fd:8a:a4:
         ae:92:22:9a:70:fe:97:f4:04:4d:8a:dd:ea:9b:11:28:96:cb:
         ff:12:9d:64:76:a8:27:5d:1b:bf:05:66:25:58:8e:8a:2e:cf:
         27:a6:ab:28:c6:ff:13:7c:7a:65:ef:ec:31:b2:da:9b:95:1f:
         c5:b7:72:4e:f6:00:04:ec:74:65:1c:6b:37:ce:46:b1:c5:27:
         91:9f:96:81:40:dd:33:42:05:cf:a1:f7:77:06:12:a3:f3:5e:
         52:58:35:34:25:a8:1e:1e:44:e6:0e:26:13:32:ac:a6:f8:75:
         7f:f9:91:64:1e:73:51:8b:42:3d:d6:25:68:c2:23:c4:63:dd:
         ff:73:50:01:15:af:15:af:0e:91:ed:a4:16:58:c0:f2:31:d3:
         5f:49:83:d4:11:60:9e:15:fd:94:48:1a:21:41:39:d7:57:6b:
         34:3a:97:3f:24:e3:90:62:ab:ec:77:72:7c:ef:35:cd:80:a0:
         8a:b9:6a:66:00:a5:3c:45:da:59:fd:c7:37:53:72:40:9e:33:
         9d:1e:c1:4d:f2:a8:23:ea:57:76:b5:df:67:91:d5:64:fe:d7:
         81:9e:53:36:e1:64:40:39:87:4c:f7:b7:1f:02:a1:71:4e:ea:
         45:42:ab:22:c7:9f:4e:9a:08:3b:95:11:32:eb:16:dd:95:ac:
         11:99:66:ce:4a:a3:0f:9f:f1:16:9b:ff:0e:de:a7:27:4e:70:
         cb:cd:fa:e6:be:79:ff:a3:13:5d:76:2c:1b:3e:d7:bd:19:0f:
         f3:da:12:76:57:3b:98:30:24:eb:95:0e:db:aa:e9:62:d6:89:
         e7:af:80:3e:00:fc:84:fa:3c:6f:3a:8e:9d:60:59:60:5c:76:
         38:1e:73:1f:71:3a:be:2e:a6:f2:ca:1c:ba:2c:36:5f:33:24:
         f0:c9:cb:3f:1f:49:16:fb:63:65:7e:90:47:05:e3:0d:f7:fa:
         c8:59:a5:05:a0:31:00:65
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4098 (0x1002)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM Intermediate CA
        Validity
            Not Before: Mar 21 06:17:03 2020 GMT
            Not After : Mar 31 06:17:03 2021 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=ocsp.iot.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:c7:69:7f:2a:6b:ba:96:d9:52:43:88:91:fb:fa:
                    ce:3b:a0:b6:80:e5:1e:29:d4:4e:34:b5:45:c9:ae:
                    88:6a:12:90:cc:de:d3:1c:91:59:7a:84:d3:5c:53:
                    38:2b:e2:d9:47:a2:21:ff:ae:8c:51:03:76:dc:08:
                    44:84:77:e0:ea:34:ca:65:de:25:cd:19:34:70:95:
                    d7:cf:78:01:26:c1:79:f8:89:e2:c0:c3:b5:64:e1:
                    55:6c:ea:63:03:ac:c9:81:c6:33:f0:ad:64:32:6c:
                    5e:94:dc:71:76:9c:dd:7e:d0:a2:df:75:ec:47:6b:
                    22:de:0d:72:1d:a7:79:fa:5e:04:66:68:e9:8b:a2:
                    e4:bc:d6:b6:b9:6d:0d:7c:6b:7b:36:44:38:36:51:
                    a2:72:50:c2:51:66:21:f8:e0:2c:b9:68:2d:c7:75:
                    da:d3:95:ce:c0:33:3e:7c:ba:81:3b:c3:fa:74:29:
                    30:f4:c7:ce:dd:00:cc:27:6c:58:ea:8f:f2:24:f8:
                    09:f5:02:ff:4b:2e:9a:53:47:5b:27:77:29:c3:37:
                    26:4f:2d:1c:c9:c7:be:53:30:01:02:a6:41:b8:77:
                    03:14:a5:69:ef:9d:fe:ce:19:3b:09:25:a6:8e:eb:
                    52:18:9b:a7:88:ab:63:30:31:64:bb:52:13:04:8c:
                    34:cb:13:71:c0:94:6c:dd:fb:3d:8d:a1:d9:65:28:
                    bc:c8:e8:d3:6a:02:ca:50:8b:a9:97:4d:8e:be:c2:
                    04:3d:1f:76:76:96:b6:d2:43:a9:0a:75:4e:f2:e4:
                    39:67:aa:08:7f:75:12:6a:5a:45:36:e4:f9:7b:4e:
                    9e:bd:b8:42:45:95:16:07:42:4c:b9:23:42:04:c3:
                    71:1c:28:40:27:a7:e1:2d:77:fa:b6:56:29:67:e2:
                    e5:10:fc:38:c9:8c:e2:44:19:ae:b5:90:b0:63:1d:
                    76:82:21:93:95:01:2a:ba:7d:76:3e:f1:dc:1d:b8:
                    5c:ec:d2:04:7e:e6:11:a1:76:3f:f3:f1:7d:57:82:
                    77:d5:a8:eb:b0:fb:bb:65:c7:a7:74:ad:36:f5:a8:
                    b5:dc:4a:ba:91:f5:d7:1b:1f:31:4c:d4:e2:b7:35:
                    2b:b8:a5:a8:0a:76:d5:2e:71:dd:66:d4:23:34:87:
                    c5:61:e1:bd:83:df:99:85:42:a0:45:c2:12:90:09:
                    23:f0:f3:4b:f0:19:e4:3a:e5:2b:77:d0:79:5b:02:
                    62:50:03:38:2e:31:d5:c3:56:2b:bc:4a:7f:27:a7:
                    3b:05:80:0f:6f:34:b3:19:60:10:c1:a7:d6:8b:16:
                    ee:41:14:0e:c0:94:4c:9d:79:a0:15:1b:4d:39:fc:
                    f6:14:d9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B0:F5:53:93:E6:76:AD:F9:2A:87:38:9B:0F:D9:00:AD:77:2E:F1:5B
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
         08:59:ae:bf:ef:a5:7c:8c:29:5e:0e:d4:ef:ce:84:6f:97:a1:
         0e:a1:5b:1f:00:30:86:93:b3:5d:3c:1c:88:63:09:17:c7:f1:
         a2:d1:40:d4:5d:11:59:36:37:e2:5b:f4:93:69:b9:08:6b:2d:
         dc:b8:55:d4:44:a1:d7:76:7d:e9:21:fa:f2:0d:c5:11:6a:2e:
         33:06:ba:3f:af:72:5b:73:01:d4:1a:1e:df:e8:a6:ac:fb:bc:
         e7:42:c5:c1:5e:96:63:ee:be:23:34:9b:89:12:1b:75:d7:04:
         fb:e0:a0:96:fc:29:54:cd:c2:d3:34:d4:1f:eb:bf:43:68:d3:
         ab:e6:3b:03:73:46:3d:e7:fe:23:63:ec:d7:d7:69:da:d5:67:
         55:b4:ca:20:74:2b:f0:f8:f2:ba:74:48:2f:53:be:7b:a9:e6:
         ce:c8:0a:c9:34:5d:3f:ae:d0:d5:30:87:88:ad:12:56:ee:5a:
         36:f2:96:d0:a4:55:c3:db:c0:1f:3c:3a:b7:e3:a2:d4:ad:91:
         5b:da:f2:51:87:05:46:68:95:97:67:37:02:a0:3c:0c:b2:d4:
         c0:bd:12:c9:c8:04:41:4f:33:32:96:2b:6e:6c:5f:e0:ea:f9:
         ac:ea:b5:58:6e:41:67:19:1f:02:73:20:62:85:6f:35:b5:f2:
         97:1c:33:08:25:d6:f9:eb:2b:aa:aa:cb:91:1c:13:98:cb:9b:
         d6:22:8c:fb:c6:20:ce:18:ce:0d:b8:d5:0b:92:d8:6d:dd:d3:
         a1:95:ad:1b:3e:be:4f:1e:5e:dd:bf:f2:f1:86:60:34:ae:e3:
         19:74:93:b1:42:9b:0e:3f:b8:05:a0:6a:4a:2a:25:63:48:70:
         b0:86:7f:14:90:f9:1c:9a:8a:47:70:29:1d:27:bd:dd:8f:99:
         f7:37:3e:a4:d5:08:83:4d:13:67:29:12:ae:99:25:43:39:9f:
         4c:5f:63:d6:e7:41:f4:d5:d0:68:45:c4:53:c1:25:99:27:00:
         af:4d:86:8e:f1:04:82:9c:b7:dc:6e:df:d5:f9:0c:2a:f4:c2:
         a8:fb:c4:c9:49:fb:c6:dd:0a:1a:be:d4:ef:05:95:1e:0f:d6:
         7b:0a:4e:8d:85:95:46:d7:aa:0c:5f:c4:9c:95:25:47:66:e2:
         d6:5f:43:b5:23:ad:92:bf:f8:8d:6e:3b:d6:37:8f:11:af:0e:
         b3:dd:29:51:34:b5:ae:45:5d:5c:e1:2d:d4:1c:93:fe:f9:da:
         cb:23:82:ad:23:88:3a:82:e6:ed:ab:91:56:58:05:f9:88:a2:
         0c:42:7d:dc:e0:d9:03:e3:51:fa:36:1b:a7:ad:5e:f1:f0:ff:
         53:06:de:c4:3b:6e:76:fd
-----BEGIN CERTIFICATE-----
MIIF5DCCA8ygAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMyMTA2MTcwM1oXDTIxMDMzMTA2MTcwM1owfzELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV00xIzAhBgNVBAsMGllTV00gQ2VydGlmaWNhdGUgQXV0aG9yaXR5
MRUwEwYDVQQDDAxvY3NwLmlvdC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDHaX8qa7qW2VJDiJH7+s47oLaA5R4p1E40tUXJrohqEpDM3tMckVl6
hNNcUzgr4tlHoiH/roxRA3bcCESEd+DqNMpl3iXNGTRwldfPeAEmwXn4ieLAw7Vk
4VVs6mMDrMmBxjPwrWQybF6U3HF2nN1+0KLfdexHayLeDXIdp3n6XgRmaOmLouS8
1ra5bQ18a3s2RDg2UaJyUMJRZiH44Cy5aC3HddrTlc7AMz58uoE7w/p0KTD0x87d
AMwnbFjqj/Ik+An1Av9LLppTR1sndynDNyZPLRzJx75TMAECpkG4dwMUpWnvnf7O
GTsJJaaO61IYm6eIq2MwMWS7UhMEjDTLE3HAlGzd+z2NodllKLzI6NNqAspQi6mX
TY6+wgQ9H3Z2lrbSQ6kKdU7y5Dlnqgh/dRJqWkU25Pl7Tp69uEJFlRYHQky5I0IE
w3EcKEAnp+Etd/q2Viln4uUQ/DjJjOJEGa61kLBjHXaCIZOVASq6fXY+8dwduFzs
0gR+5hGhdj/z8X1XgnfVqOuw+7tlx6d0rTb1qLXcSrqR9dcbHzFM1OK3NSu4pagK
dtUucd1m1CM0h8Vh4b2D35mFQqBFwhKQCSPw80vwGeQ65St30HlbAmJQAzguMdXD
Viu8Sn8npzsFgA9vNLMZYBDBp9aLFu5BFA7AlEydeaAVG005/PYU2QIDAQABo3Uw
czAJBgNVHRMEAjAAMB0GA1UdDgQWBBSw9VOT5nat+SqHOJsP2QCtdy7xWzAfBgNV
HSMEGDAWgBSAgZWLuSFXB65e4gos7ogtttvv7zAOBgNVHQ8BAf8EBAMCB4AwFgYD
VR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAAhZrr/vpXyM
KV4O1O/OhG+XoQ6hWx8AMIaTs108HIhjCRfH8aLRQNRdEVk2N+Jb9JNpuQhrLdy4
VdREodd2fekh+vINxRFqLjMGuj+vcltzAdQaHt/opqz7vOdCxcFelmPuviM0m4kS
G3XXBPvgoJb8KVTNwtM01B/rv0No06vmOwNzRj3n/iNj7NfXadrVZ1W0yiB0K/D4
8rp0SC9Tvnup5s7ICsk0XT+u0NUwh4itElbuWjbyltCkVcPbwB88OrfjotStkVva
8lGHBUZolZdnNwKgPAyy1MC9EsnIBEFPMzKWK25sX+Dq+azqtVhuQWcZHwJzIGKF
bzW18pccMwgl1vnrK6qqy5EcE5jLm9YijPvGIM4Yzg241QuS2G3d06GVrRs+vk8e
Xt2/8vGGYDSu4xl0k7FCmw4/uAWgakoqJWNIcLCGfxSQ+RyaikdwKR0nvd2Pmfc3
PqTVCINNE2cpEq6ZJUM5n0xfY9bnQfTV0GhFxFPBJZknAK9Nho7xBIKct9xu39X5
DCr0wqj7xMlJ+8bdChq+1O8FlR4P1nsKTo2FlUbXqgxfxJyVJUdm4tZfQ7UjrZK/
+I1uO9Y3jxGvDrPdKVE0ta5FXVzhLdQck/752ssjgq0jiDqC5u2rkVZYBfmIogxC
fdzg2QPjUfo2G6etXvHw/1MG3sQ7bnb9
-----END CERTIFICATE-----

客户端输出

OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = ocsp.iot.com
    Produced At: Mar 21 06:42:58 2020 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: BF07CCE36736D257F8D75DE02D5E65E1CB8068F3
      Issuer Key Hash: 8081958BB9215707AE5EE20A2CEE882DB6DBEFEF
      Serial Number: 1001
    Cert Status: good
    This Update: Mar 21 06:42:58 2020 GMT

    Response Extensions:
        OCSP Nonce: 
            0410C85B38CAADFCCAB98072C7F6BF3D6EE1
    Signature Algorithm: sha256WithRSAEncryption
         51:40:18:da:ef:c5:e3:e6:af:b9:26:6a:19:a8:63:24:f7:4a:
         41:0a:de:88:b4:16:73:7c:3e:7e:af:cb:f6:75:41:eb:19:da:
         55:2a:96:b1:77:d1:98:aa:f8:4a:02:88:4c:5a:1f:03:a6:d4:
         97:1b:4d:cb:4d:98:bc:19:02:6a:b5:be:5e:d0:c2:33:3e:c7:
         5d:b7:63:86:b3:71:8f:63:58:6b:7d:9d:7c:29:0d:52:a4:03:
         b2:ba:7a:da:90:19:93:68:04:ad:8d:66:1b:f0:f6:af:ce:98:
         09:26:88:b6:98:43:0f:e6:6d:32:4d:2d:9a:01:9d:fb:8c:00:
         b2:89:95:c7:2b:c2:aa:e2:ea:b1:75:81:7f:3c:12:fd:8a:a4:
         ae:92:22:9a:70:fe:97:f4:04:4d:8a:dd:ea:9b:11:28:96:cb:
         ff:12:9d:64:76:a8:27:5d:1b:bf:05:66:25:58:8e:8a:2e:cf:
         27:a6:ab:28:c6:ff:13:7c:7a:65:ef:ec:31:b2:da:9b:95:1f:
         c5:b7:72:4e:f6:00:04:ec:74:65:1c:6b:37:ce:46:b1:c5:27:
         91:9f:96:81:40:dd:33:42:05:cf:a1:f7:77:06:12:a3:f3:5e:
         52:58:35:34:25:a8:1e:1e:44:e6:0e:26:13:32:ac:a6:f8:75:
         7f:f9:91:64:1e:73:51:8b:42:3d:d6:25:68:c2:23:c4:63:dd:
         ff:73:50:01:15:af:15:af:0e:91:ed:a4:16:58:c0:f2:31:d3:
         5f:49:83:d4:11:60:9e:15:fd:94:48:1a:21:41:39:d7:57:6b:
         34:3a:97:3f:24:e3:90:62:ab:ec:77:72:7c:ef:35:cd:80:a0:
         8a:b9:6a:66:00:a5:3c:45:da:59:fd:c7:37:53:72:40:9e:33:
         9d:1e:c1:4d:f2:a8:23:ea:57:76:b5:df:67:91:d5:64:fe:d7:
         81:9e:53:36:e1:64:40:39:87:4c:f7:b7:1f:02:a1:71:4e:ea:
         45:42:ab:22:c7:9f:4e:9a:08:3b:95:11:32:eb:16:dd:95:ac:
         11:99:66:ce:4a:a3:0f:9f:f1:16:9b:ff:0e:de:a7:27:4e:70:
         cb:cd:fa:e6:be:79:ff:a3:13:5d:76:2c:1b:3e:d7:bd:19:0f:
         f3:da:12:76:57:3b:98:30:24:eb:95:0e:db:aa:e9:62:d6:89:
         e7:af:80:3e:00:fc:84:fa:3c:6f:3a:8e:9d:60:59:60:5c:76:
         38:1e:73:1f:71:3a:be:2e:a6:f2:ca:1c:ba:2c:36:5f:33:24:
         f0:c9:cb:3f:1f:49:16:fb:63:65:7e:90:47:05:e3:0d:f7:fa:
         c8:59:a5:05:a0:31:00:65
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4098 (0x1002)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM Intermediate CA
        Validity
            Not Before: Mar 21 06:17:03 2020 GMT
            Not After : Mar 31 06:17:03 2021 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=ocsp.iot.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:c7:69:7f:2a:6b:ba:96:d9:52:43:88:91:fb:fa:
                    ce:3b:a0:b6:80:e5:1e:29:d4:4e:34:b5:45:c9:ae:
                    88:6a:12:90:cc:de:d3:1c:91:59:7a:84:d3:5c:53:
                    38:2b:e2:d9:47:a2:21:ff:ae:8c:51:03:76:dc:08:
                    44:84:77:e0:ea:34:ca:65:de:25:cd:19:34:70:95:
                    d7:cf:78:01:26:c1:79:f8:89:e2:c0:c3:b5:64:e1:
                    55:6c:ea:63:03:ac:c9:81:c6:33:f0:ad:64:32:6c:
                    5e:94:dc:71:76:9c:dd:7e:d0:a2:df:75:ec:47:6b:
                    22:de:0d:72:1d:a7:79:fa:5e:04:66:68:e9:8b:a2:
                    e4:bc:d6:b6:b9:6d:0d:7c:6b:7b:36:44:38:36:51:
                    a2:72:50:c2:51:66:21:f8:e0:2c:b9:68:2d:c7:75:
                    da:d3:95:ce:c0:33:3e:7c:ba:81:3b:c3:fa:74:29:
                    30:f4:c7:ce:dd:00:cc:27:6c:58:ea:8f:f2:24:f8:
                    09:f5:02:ff:4b:2e:9a:53:47:5b:27:77:29:c3:37:
                    26:4f:2d:1c:c9:c7:be:53:30:01:02:a6:41:b8:77:
                    03:14:a5:69:ef:9d:fe:ce:19:3b:09:25:a6:8e:eb:
                    52:18:9b:a7:88:ab:63:30:31:64:bb:52:13:04:8c:
                    34:cb:13:71:c0:94:6c:dd:fb:3d:8d:a1:d9:65:28:
                    bc:c8:e8:d3:6a:02:ca:50:8b:a9:97:4d:8e:be:c2:
                    04:3d:1f:76:76:96:b6:d2:43:a9:0a:75:4e:f2:e4:
                    39:67:aa:08:7f:75:12:6a:5a:45:36:e4:f9:7b:4e:
                    9e:bd:b8:42:45:95:16:07:42:4c:b9:23:42:04:c3:
                    71:1c:28:40:27:a7:e1:2d:77:fa:b6:56:29:67:e2:
                    e5:10:fc:38:c9:8c:e2:44:19:ae:b5:90:b0:63:1d:
                    76:82:21:93:95:01:2a:ba:7d:76:3e:f1:dc:1d:b8:
                    5c:ec:d2:04:7e:e6:11:a1:76:3f:f3:f1:7d:57:82:
                    77:d5:a8:eb:b0:fb:bb:65:c7:a7:74:ad:36:f5:a8:
                    b5:dc:4a:ba:91:f5:d7:1b:1f:31:4c:d4:e2:b7:35:
                    2b:b8:a5:a8:0a:76:d5:2e:71:dd:66:d4:23:34:87:
                    c5:61:e1:bd:83:df:99:85:42:a0:45:c2:12:90:09:
                    23:f0:f3:4b:f0:19:e4:3a:e5:2b:77:d0:79:5b:02:
                    62:50:03:38:2e:31:d5:c3:56:2b:bc:4a:7f:27:a7:
                    3b:05:80:0f:6f:34:b3:19:60:10:c1:a7:d6:8b:16:
                    ee:41:14:0e:c0:94:4c:9d:79:a0:15:1b:4d:39:fc:
                    f6:14:d9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B0:F5:53:93:E6:76:AD:F9:2A:87:38:9B:0F:D9:00:AD:77:2E:F1:5B
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
         08:59:ae:bf:ef:a5:7c:8c:29:5e:0e:d4:ef:ce:84:6f:97:a1:
         0e:a1:5b:1f:00:30:86:93:b3:5d:3c:1c:88:63:09:17:c7:f1:
         a2:d1:40:d4:5d:11:59:36:37:e2:5b:f4:93:69:b9:08:6b:2d:
         dc:b8:55:d4:44:a1:d7:76:7d:e9:21:fa:f2:0d:c5:11:6a:2e:
         33:06:ba:3f:af:72:5b:73:01:d4:1a:1e:df:e8:a6:ac:fb:bc:
         e7:42:c5:c1:5e:96:63:ee:be:23:34:9b:89:12:1b:75:d7:04:
         fb:e0:a0:96:fc:29:54:cd:c2:d3:34:d4:1f:eb:bf:43:68:d3:
         ab:e6:3b:03:73:46:3d:e7:fe:23:63:ec:d7:d7:69:da:d5:67:
         55:b4:ca:20:74:2b:f0:f8:f2:ba:74:48:2f:53:be:7b:a9:e6:
         ce:c8:0a:c9:34:5d:3f:ae:d0:d5:30:87:88:ad:12:56:ee:5a:
         36:f2:96:d0:a4:55:c3:db:c0:1f:3c:3a:b7:e3:a2:d4:ad:91:
         5b:da:f2:51:87:05:46:68:95:97:67:37:02:a0:3c:0c:b2:d4:
         c0:bd:12:c9:c8:04:41:4f:33:32:96:2b:6e:6c:5f:e0:ea:f9:
         ac:ea:b5:58:6e:41:67:19:1f:02:73:20:62:85:6f:35:b5:f2:
         97:1c:33:08:25:d6:f9:eb:2b:aa:aa:cb:91:1c:13:98:cb:9b:
         d6:22:8c:fb:c6:20:ce:18:ce:0d:b8:d5:0b:92:d8:6d:dd:d3:
         a1:95:ad:1b:3e:be:4f:1e:5e:dd:bf:f2:f1:86:60:34:ae:e3:
         19:74:93:b1:42:9b:0e:3f:b8:05:a0:6a:4a:2a:25:63:48:70:
         b0:86:7f:14:90:f9:1c:9a:8a:47:70:29:1d:27:bd:dd:8f:99:
         f7:37:3e:a4:d5:08:83:4d:13:67:29:12:ae:99:25:43:39:9f:
         4c:5f:63:d6:e7:41:f4:d5:d0:68:45:c4:53:c1:25:99:27:00:
         af:4d:86:8e:f1:04:82:9c:b7:dc:6e:df:d5:f9:0c:2a:f4:c2:
         a8:fb:c4:c9:49:fb:c6:dd:0a:1a:be:d4:ef:05:95:1e:0f:d6:
         7b:0a:4e:8d:85:95:46:d7:aa:0c:5f:c4:9c:95:25:47:66:e2:
         d6:5f:43:b5:23:ad:92:bf:f8:8d:6e:3b:d6:37:8f:11:af:0e:
         b3:dd:29:51:34:b5:ae:45:5d:5c:e1:2d:d4:1c:93:fe:f9:da:
         cb:23:82:ad:23:88:3a:82:e6:ed:ab:91:56:58:05:f9:88:a2:
         0c:42:7d:dc:e0:d9:03:e3:51:fa:36:1b:a7:ad:5e:f1:f0:ff:
         53:06:de:c4:3b:6e:76:fd
-----BEGIN CERTIFICATE-----
MIIF5DCCA8ygAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMyMTA2MTcwM1oXDTIxMDMzMTA2MTcwM1owfzELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV00xIzAhBgNVBAsMGllTV00gQ2VydGlmaWNhdGUgQXV0aG9yaXR5
MRUwEwYDVQQDDAxvY3NwLmlvdC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDHaX8qa7qW2VJDiJH7+s47oLaA5R4p1E40tUXJrohqEpDM3tMckVl6
hNNcUzgr4tlHoiH/roxRA3bcCESEd+DqNMpl3iXNGTRwldfPeAEmwXn4ieLAw7Vk
4VVs6mMDrMmBxjPwrWQybF6U3HF2nN1+0KLfdexHayLeDXIdp3n6XgRmaOmLouS8
1ra5bQ18a3s2RDg2UaJyUMJRZiH44Cy5aC3HddrTlc7AMz58uoE7w/p0KTD0x87d
AMwnbFjqj/Ik+An1Av9LLppTR1sndynDNyZPLRzJx75TMAECpkG4dwMUpWnvnf7O
GTsJJaaO61IYm6eIq2MwMWS7UhMEjDTLE3HAlGzd+z2NodllKLzI6NNqAspQi6mX
TY6+wgQ9H3Z2lrbSQ6kKdU7y5Dlnqgh/dRJqWkU25Pl7Tp69uEJFlRYHQky5I0IE
w3EcKEAnp+Etd/q2Viln4uUQ/DjJjOJEGa61kLBjHXaCIZOVASq6fXY+8dwduFzs
0gR+5hGhdj/z8X1XgnfVqOuw+7tlx6d0rTb1qLXcSrqR9dcbHzFM1OK3NSu4pagK
dtUucd1m1CM0h8Vh4b2D35mFQqBFwhKQCSPw80vwGeQ65St30HlbAmJQAzguMdXD
Viu8Sn8npzsFgA9vNLMZYBDBp9aLFu5BFA7AlEydeaAVG005/PYU2QIDAQABo3Uw
czAJBgNVHRMEAjAAMB0GA1UdDgQWBBSw9VOT5nat+SqHOJsP2QCtdy7xWzAfBgNV
HSMEGDAWgBSAgZWLuSFXB65e4gos7ogtttvv7zAOBgNVHQ8BAf8EBAMCB4AwFgYD
VR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAAhZrr/vpXyM
KV4O1O/OhG+XoQ6hWx8AMIaTs108HIhjCRfH8aLRQNRdEVk2N+Jb9JNpuQhrLdy4
VdREodd2fekh+vINxRFqLjMGuj+vcltzAdQaHt/opqz7vOdCxcFelmPuviM0m4kS
G3XXBPvgoJb8KVTNwtM01B/rv0No06vmOwNzRj3n/iNj7NfXadrVZ1W0yiB0K/D4
8rp0SC9Tvnup5s7ICsk0XT+u0NUwh4itElbuWjbyltCkVcPbwB88OrfjotStkVva
8lGHBUZolZdnNwKgPAyy1MC9EsnIBEFPMzKWK25sX+Dq+azqtVhuQWcZHwJzIGKF
bzW18pccMwgl1vnrK6qqy5EcE5jLm9YijPvGIM4Yzg241QuS2G3d06GVrRs+vk8e
Xt2/8vGGYDSu4xl0k7FCmw4/uAWgakoqJWNIcLCGfxSQ+RyaikdwKR0nvd2Pmfc3
PqTVCINNE2cpEq6ZJUM5n0xfY9bnQfTV0GhFxFPBJZknAK9Nho7xBIKct9xu39X5
DCr0wqj7xMlJ+8bdChq+1O8FlR4P1nsKTo2FlUbXqgxfxJyVJUdm4tZfQ7UjrZK/
+I1uO9Y3jxGvDrPdKVE0ta5FXVzhLdQck/752ssjgq0jiDqC5u2rkVZYBfmIogxC
fdzg2QPjUfo2G6etXvHw/1MG3sQ7bnb9
-----END CERTIFICATE-----
Response verify OK
intermediate/certs/device.cert.pem: good
        This Update: Mar 21 06:42:58 2020 GMT

吊销客户端证书

openssl ca -config intermediate/openssl.cnf \
-revoke intermediate/certs/device.cert.pem

[root@ip-172-31-2-174 ca]# openssl ca -config intermediate/openssl.cnf \
> -revoke intermediate/certs/device.cert.pem
Using configuration from intermediate/openssl.cnf
Enter pass phrase for /root/ca/intermediate/private/intermediate.key.pem:
Revoking Certificate 1001.
Data Base Updated
[root@ip-172-31-2-174 ca]#

查看证书签发列表

[root@ip-172-31-2-174 ca]# cat intermediate/index.txt
V       210321055837Z           1000    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
R       200917060403Z   200321064519Z   1001    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=MENGNIU/OU=IT/CN=IOTHS0000238
V       210331061703Z           1002    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=ocsp.iot.com
[root@ip-172-31-2-174 ca]#

再次使用OCSP检查测试客户端证书吊销状态

服务端输出

OCSP Request Data:
    Version: 1 (0x0)
    Requestor List:
        Certificate ID:
          Hash Algorithm: sha1
          Issuer Name Hash: BF07CCE36736D257F8D75DE02D5E65E1CB8068F3
          Issuer Key Hash: 8081958BB9215707AE5EE20A2CEE882DB6DBEFEF
          Serial Number: 1001
    Request Extensions:
        OCSP Nonce: 
            0410DC75A083910B1B7697B71CCAA816DC85
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = ocsp.iot.com
    Produced At: Mar 21 06:46:58 2020 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: BF07CCE36736D257F8D75DE02D5E65E1CB8068F3
      Issuer Key Hash: 8081958BB9215707AE5EE20A2CEE882DB6DBEFEF
      Serial Number: 1001
    Cert Status: revoked
    Revocation Time: Mar 21 06:45:19 2020 GMT
    This Update: Mar 21 06:46:58 2020 GMT

    Response Extensions:
        OCSP Nonce: 
            0410DC75A083910B1B7697B71CCAA816DC85
    Signature Algorithm: sha256WithRSAEncryption
         9a:87:82:dc:24:3e:4a:a3:1a:16:16:42:70:c7:6d:98:6a:6c:
         3c:d2:a1:a1:13:49:59:26:65:a9:b7:fe:fa:aa:88:70:7a:cb:
         7a:b5:cf:fb:ad:fb:3d:59:30:34:ae:34:e5:95:38:fa:29:1a:
         ce:aa:5f:94:1a:fe:70:15:ec:ae:7e:4a:01:f5:38:ea:9c:57:
         60:af:d3:b7:d4:e1:29:19:78:08:a1:62:b4:8f:0f:89:2f:9d:
         8a:b4:0e:74:44:ba:81:29:1e:9d:03:25:ba:9d:55:78:32:73:
         46:3b:41:6a:9b:94:35:eb:c2:2d:cd:2c:2d:89:86:86:7d:cd:
         7a:c6:3e:8e:c3:e1:c6:5e:40:69:fe:0f:a6:9b:3a:18:c7:39:
         c9:34:5e:31:cf:9b:b2:cf:fa:04:17:f1:a1:33:0f:7c:87:ae:
         ad:19:da:bf:25:1b:da:b2:ee:e9:f5:df:49:7c:24:02:10:2d:
         c5:51:a8:b7:ac:7d:78:58:76:bd:33:d2:f7:b4:7b:87:27:74:
         0b:d9:78:e1:70:6e:30:b7:4e:d8:1f:45:87:35:89:d7:2a:65:
         41:18:16:82:03:6a:3a:e1:ba:bb:8c:d8:a6:7a:f9:39:f4:ba:
         30:56:90:dd:ac:16:f2:1e:53:b7:40:24:95:95:44:71:a3:56:
         c9:f7:fa:f0:54:bc:99:87:7f:35:37:6f:a4:46:dc:e5:b1:e2:
         a4:d3:e8:2a:10:a2:97:72:c8:f3:1c:6c:58:e5:65:60:a4:2f:
         9a:8d:43:6e:a7:3e:dc:d1:cc:c8:e2:8f:7d:b9:df:17:cf:f8:
         aa:3d:b3:ab:ef:2e:89:e0:b8:28:96:9e:86:2c:d7:25:fb:98:
         b1:a2:5a:b8:94:84:e9:82:72:1c:7a:c6:4d:cc:14:c7:7e:e6:
         57:8b:7a:ad:53:ef:1e:ce:50:0f:f7:60:c7:67:9b:9b:ef:22:
         de:c0:6e:1f:58:13:7d:f0:05:16:f2:0c:c9:58:8c:74:cc:93:
         56:6d:07:e1:be:2f:3e:c5:4a:1c:ed:4e:d5:da:bb:b8:73:09:
         7d:c8:69:9b:e7:0b:4e:37:a9:95:8d:47:a9:8b:3a:eb:ff:de:
         dc:5b:30:ce:51:60:f5:12:b0:dd:22:61:af:40:5d:bb:89:89:
         cc:73:c0:02:a1:da:8b:6b:02:ee:43:6c:33:cc:14:f0:15:a1:
         60:04:71:f7:70:34:ea:c3:d3:6b:0f:fc:90:b3:b0:2b:3d:01:
         ce:26:63:3e:c0:a7:bd:c5:74:9f:b6:47:6b:ac:28:8d:87:b4:
         6d:4c:09:09:4c:66:d2:71:00:f1:be:25:58:30:cc:a5:8e:22:
         5a:00:4b:19:3e:68:15:ea
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4098 (0x1002)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM Intermediate CA
        Validity
            Not Before: Mar 21 06:17:03 2020 GMT
            Not After : Mar 31 06:17:03 2021 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=ocsp.iot.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:c7:69:7f:2a:6b:ba:96:d9:52:43:88:91:fb:fa:
                    ce:3b:a0:b6:80:e5:1e:29:d4:4e:34:b5:45:c9:ae:
                    88:6a:12:90:cc:de:d3:1c:91:59:7a:84:d3:5c:53:
                    38:2b:e2:d9:47:a2:21:ff:ae:8c:51:03:76:dc:08:
                    44:84:77:e0:ea:34:ca:65:de:25:cd:19:34:70:95:
                    d7:cf:78:01:26:c1:79:f8:89:e2:c0:c3:b5:64:e1:
                    55:6c:ea:63:03:ac:c9:81:c6:33:f0:ad:64:32:6c:
                    5e:94:dc:71:76:9c:dd:7e:d0:a2:df:75:ec:47:6b:
                    22:de:0d:72:1d:a7:79:fa:5e:04:66:68:e9:8b:a2:
                    e4:bc:d6:b6:b9:6d:0d:7c:6b:7b:36:44:38:36:51:
                    a2:72:50:c2:51:66:21:f8:e0:2c:b9:68:2d:c7:75:
                    da:d3:95:ce:c0:33:3e:7c:ba:81:3b:c3:fa:74:29:
                    30:f4:c7:ce:dd:00:cc:27:6c:58:ea:8f:f2:24:f8:
                    09:f5:02:ff:4b:2e:9a:53:47:5b:27:77:29:c3:37:
                    26:4f:2d:1c:c9:c7:be:53:30:01:02:a6:41:b8:77:
                    03:14:a5:69:ef:9d:fe:ce:19:3b:09:25:a6:8e:eb:
                    52:18:9b:a7:88:ab:63:30:31:64:bb:52:13:04:8c:
                    34:cb:13:71:c0:94:6c:dd:fb:3d:8d:a1:d9:65:28:
                    bc:c8:e8:d3:6a:02:ca:50:8b:a9:97:4d:8e:be:c2:
                    04:3d:1f:76:76:96:b6:d2:43:a9:0a:75:4e:f2:e4:
                    39:67:aa:08:7f:75:12:6a:5a:45:36:e4:f9:7b:4e:
                    9e:bd:b8:42:45:95:16:07:42:4c:b9:23:42:04:c3:
                    71:1c:28:40:27:a7:e1:2d:77:fa:b6:56:29:67:e2:
                    e5:10:fc:38:c9:8c:e2:44:19:ae:b5:90:b0:63:1d:
                    76:82:21:93:95:01:2a:ba:7d:76:3e:f1:dc:1d:b8:
                    5c:ec:d2:04:7e:e6:11:a1:76:3f:f3:f1:7d:57:82:
                    77:d5:a8:eb:b0:fb:bb:65:c7:a7:74:ad:36:f5:a8:
                    b5:dc:4a:ba:91:f5:d7:1b:1f:31:4c:d4:e2:b7:35:
                    2b:b8:a5:a8:0a:76:d5:2e:71:dd:66:d4:23:34:87:
                    c5:61:e1:bd:83:df:99:85:42:a0:45:c2:12:90:09:
                    23:f0:f3:4b:f0:19:e4:3a:e5:2b:77:d0:79:5b:02:
                    62:50:03:38:2e:31:d5:c3:56:2b:bc:4a:7f:27:a7:
                    3b:05:80:0f:6f:34:b3:19:60:10:c1:a7:d6:8b:16:
                    ee:41:14:0e:c0:94:4c:9d:79:a0:15:1b:4d:39:fc:
                    f6:14:d9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B0:F5:53:93:E6:76:AD:F9:2A:87:38:9B:0F:D9:00:AD:77:2E:F1:5B
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
         08:59:ae:bf:ef:a5:7c:8c:29:5e:0e:d4:ef:ce:84:6f:97:a1:
         0e:a1:5b:1f:00:30:86:93:b3:5d:3c:1c:88:63:09:17:c7:f1:
         a2:d1:40:d4:5d:11:59:36:37:e2:5b:f4:93:69:b9:08:6b:2d:
         dc:b8:55:d4:44:a1:d7:76:7d:e9:21:fa:f2:0d:c5:11:6a:2e:
         33:06:ba:3f:af:72:5b:73:01:d4:1a:1e:df:e8:a6:ac:fb:bc:
         e7:42:c5:c1:5e:96:63:ee:be:23:34:9b:89:12:1b:75:d7:04:
         fb:e0:a0:96:fc:29:54:cd:c2:d3:34:d4:1f:eb:bf:43:68:d3:
         ab:e6:3b:03:73:46:3d:e7:fe:23:63:ec:d7:d7:69:da:d5:67:
         55:b4:ca:20:74:2b:f0:f8:f2:ba:74:48:2f:53:be:7b:a9:e6:
         ce:c8:0a:c9:34:5d:3f:ae:d0:d5:30:87:88:ad:12:56:ee:5a:
         36:f2:96:d0:a4:55:c3:db:c0:1f:3c:3a:b7:e3:a2:d4:ad:91:
         5b:da:f2:51:87:05:46:68:95:97:67:37:02:a0:3c:0c:b2:d4:
         c0:bd:12:c9:c8:04:41:4f:33:32:96:2b:6e:6c:5f:e0:ea:f9:
         ac:ea:b5:58:6e:41:67:19:1f:02:73:20:62:85:6f:35:b5:f2:
         97:1c:33:08:25:d6:f9:eb:2b:aa:aa:cb:91:1c:13:98:cb:9b:
         d6:22:8c:fb:c6:20:ce:18:ce:0d:b8:d5:0b:92:d8:6d:dd:d3:
         a1:95:ad:1b:3e:be:4f:1e:5e:dd:bf:f2:f1:86:60:34:ae:e3:
         19:74:93:b1:42:9b:0e:3f:b8:05:a0:6a:4a:2a:25:63:48:70:
         b0:86:7f:14:90:f9:1c:9a:8a:47:70:29:1d:27:bd:dd:8f:99:
         f7:37:3e:a4:d5:08:83:4d:13:67:29:12:ae:99:25:43:39:9f:
         4c:5f:63:d6:e7:41:f4:d5:d0:68:45:c4:53:c1:25:99:27:00:
         af:4d:86:8e:f1:04:82:9c:b7:dc:6e:df:d5:f9:0c:2a:f4:c2:
         a8:fb:c4:c9:49:fb:c6:dd:0a:1a:be:d4:ef:05:95:1e:0f:d6:
         7b:0a:4e:8d:85:95:46:d7:aa:0c:5f:c4:9c:95:25:47:66:e2:
         d6:5f:43:b5:23:ad:92:bf:f8:8d:6e:3b:d6:37:8f:11:af:0e:
         b3:dd:29:51:34:b5:ae:45:5d:5c:e1:2d:d4:1c:93:fe:f9:da:
         cb:23:82:ad:23:88:3a:82:e6:ed:ab:91:56:58:05:f9:88:a2:
         0c:42:7d:dc:e0:d9:03:e3:51:fa:36:1b:a7:ad:5e:f1:f0:ff:
         53:06:de:c4:3b:6e:76:fd
-----BEGIN CERTIFICATE-----
MIIF5DCCA8ygAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMyMTA2MTcwM1oXDTIxMDMzMTA2MTcwM1owfzELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV00xIzAhBgNVBAsMGllTV00gQ2VydGlmaWNhdGUgQXV0aG9yaXR5
MRUwEwYDVQQDDAxvY3NwLmlvdC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDHaX8qa7qW2VJDiJH7+s47oLaA5R4p1E40tUXJrohqEpDM3tMckVl6
hNNcUzgr4tlHoiH/roxRA3bcCESEd+DqNMpl3iXNGTRwldfPeAEmwXn4ieLAw7Vk
4VVs6mMDrMmBxjPwrWQybF6U3HF2nN1+0KLfdexHayLeDXIdp3n6XgRmaOmLouS8
1ra5bQ18a3s2RDg2UaJyUMJRZiH44Cy5aC3HddrTlc7AMz58uoE7w/p0KTD0x87d
AMwnbFjqj/Ik+An1Av9LLppTR1sndynDNyZPLRzJx75TMAECpkG4dwMUpWnvnf7O
GTsJJaaO61IYm6eIq2MwMWS7UhMEjDTLE3HAlGzd+z2NodllKLzI6NNqAspQi6mX
TY6+wgQ9H3Z2lrbSQ6kKdU7y5Dlnqgh/dRJqWkU25Pl7Tp69uEJFlRYHQky5I0IE
w3EcKEAnp+Etd/q2Viln4uUQ/DjJjOJEGa61kLBjHXaCIZOVASq6fXY+8dwduFzs
0gR+5hGhdj/z8X1XgnfVqOuw+7tlx6d0rTb1qLXcSrqR9dcbHzFM1OK3NSu4pagK
dtUucd1m1CM0h8Vh4b2D35mFQqBFwhKQCSPw80vwGeQ65St30HlbAmJQAzguMdXD
Viu8Sn8npzsFgA9vNLMZYBDBp9aLFu5BFA7AlEydeaAVG005/PYU2QIDAQABo3Uw
czAJBgNVHRMEAjAAMB0GA1UdDgQWBBSw9VOT5nat+SqHOJsP2QCtdy7xWzAfBgNV
HSMEGDAWgBSAgZWLuSFXB65e4gos7ogtttvv7zAOBgNVHQ8BAf8EBAMCB4AwFgYD
VR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAAhZrr/vpXyM
KV4O1O/OhG+XoQ6hWx8AMIaTs108HIhjCRfH8aLRQNRdEVk2N+Jb9JNpuQhrLdy4
VdREodd2fekh+vINxRFqLjMGuj+vcltzAdQaHt/opqz7vOdCxcFelmPuviM0m4kS
G3XXBPvgoJb8KVTNwtM01B/rv0No06vmOwNzRj3n/iNj7NfXadrVZ1W0yiB0K/D4
8rp0SC9Tvnup5s7ICsk0XT+u0NUwh4itElbuWjbyltCkVcPbwB88OrfjotStkVva
8lGHBUZolZdnNwKgPAyy1MC9EsnIBEFPMzKWK25sX+Dq+azqtVhuQWcZHwJzIGKF
bzW18pccMwgl1vnrK6qqy5EcE5jLm9YijPvGIM4Yzg241QuS2G3d06GVrRs+vk8e
Xt2/8vGGYDSu4xl0k7FCmw4/uAWgakoqJWNIcLCGfxSQ+RyaikdwKR0nvd2Pmfc3
PqTVCINNE2cpEq6ZJUM5n0xfY9bnQfTV0GhFxFPBJZknAK9Nho7xBIKct9xu39X5
DCr0wqj7xMlJ+8bdChq+1O8FlR4P1nsKTo2FlUbXqgxfxJyVJUdm4tZfQ7UjrZK/
+I1uO9Y3jxGvDrPdKVE0ta5FXVzhLdQck/752ssjgq0jiDqC5u2rkVZYBfmIogxC
fdzg2QPjUfo2G6etXvHw/1MG3sQ7bnb9
-----END CERTIFICATE-----

客户端输出

OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, ST = Guangdong, L = Shenzhen, O = YSWM, OU = YSWM Certificate Authority, CN = ocsp.iot.com
    Produced At: Mar 21 06:46:58 2020 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: BF07CCE36736D257F8D75DE02D5E65E1CB8068F3
      Issuer Key Hash: 8081958BB9215707AE5EE20A2CEE882DB6DBEFEF
      Serial Number: 1001
    Cert Status: revoked
    Revocation Time: Mar 21 06:45:19 2020 GMT
    This Update: Mar 21 06:46:58 2020 GMT

    Response Extensions:
        OCSP Nonce: 
            0410DC75A083910B1B7697B71CCAA816DC85
    Signature Algorithm: sha256WithRSAEncryption
         9a:87:82:dc:24:3e:4a:a3:1a:16:16:42:70:c7:6d:98:6a:6c:
         3c:d2:a1:a1:13:49:59:26:65:a9:b7:fe:fa:aa:88:70:7a:cb:
         7a:b5:cf:fb:ad:fb:3d:59:30:34:ae:34:e5:95:38:fa:29:1a:
         ce:aa:5f:94:1a:fe:70:15:ec:ae:7e:4a:01:f5:38:ea:9c:57:
         60:af:d3:b7:d4:e1:29:19:78:08:a1:62:b4:8f:0f:89:2f:9d:
         8a:b4:0e:74:44:ba:81:29:1e:9d:03:25:ba:9d:55:78:32:73:
         46:3b:41:6a:9b:94:35:eb:c2:2d:cd:2c:2d:89:86:86:7d:cd:
         7a:c6:3e:8e:c3:e1:c6:5e:40:69:fe:0f:a6:9b:3a:18:c7:39:
         c9:34:5e:31:cf:9b:b2:cf:fa:04:17:f1:a1:33:0f:7c:87:ae:
         ad:19:da:bf:25:1b:da:b2:ee:e9:f5:df:49:7c:24:02:10:2d:
         c5:51:a8:b7:ac:7d:78:58:76:bd:33:d2:f7:b4:7b:87:27:74:
         0b:d9:78:e1:70:6e:30:b7:4e:d8:1f:45:87:35:89:d7:2a:65:
         41:18:16:82:03:6a:3a:e1:ba:bb:8c:d8:a6:7a:f9:39:f4:ba:
         30:56:90:dd:ac:16:f2:1e:53:b7:40:24:95:95:44:71:a3:56:
         c9:f7:fa:f0:54:bc:99:87:7f:35:37:6f:a4:46:dc:e5:b1:e2:
         a4:d3:e8:2a:10:a2:97:72:c8:f3:1c:6c:58:e5:65:60:a4:2f:
         9a:8d:43:6e:a7:3e:dc:d1:cc:c8:e2:8f:7d:b9:df:17:cf:f8:
         aa:3d:b3:ab:ef:2e:89:e0:b8:28:96:9e:86:2c:d7:25:fb:98:
         b1:a2:5a:b8:94:84:e9:82:72:1c:7a:c6:4d:cc:14:c7:7e:e6:
         57:8b:7a:ad:53:ef:1e:ce:50:0f:f7:60:c7:67:9b:9b:ef:22:
         de:c0:6e:1f:58:13:7d:f0:05:16:f2:0c:c9:58:8c:74:cc:93:
         56:6d:07:e1:be:2f:3e:c5:4a:1c:ed:4e:d5:da:bb:b8:73:09:
         7d:c8:69:9b:e7:0b:4e:37:a9:95:8d:47:a9:8b:3a:eb:ff:de:
         dc:5b:30:ce:51:60:f5:12:b0:dd:22:61:af:40:5d:bb:89:89:
         cc:73:c0:02:a1:da:8b:6b:02:ee:43:6c:33:cc:14:f0:15:a1:
         60:04:71:f7:70:34:ea:c3:d3:6b:0f:fc:90:b3:b0:2b:3d:01:
         ce:26:63:3e:c0:a7:bd:c5:74:9f:b6:47:6b:ac:28:8d:87:b4:
         6d:4c:09:09:4c:66:d2:71:00:f1:be:25:58:30:cc:a5:8e:22:
         5a:00:4b:19:3e:68:15:ea
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4098 (0x1002)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM Intermediate CA
        Validity
            Not Before: Mar 21 06:17:03 2020 GMT
            Not After : Mar 31 06:17:03 2021 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=ocsp.iot.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:c7:69:7f:2a:6b:ba:96:d9:52:43:88:91:fb:fa:
                    ce:3b:a0:b6:80:e5:1e:29:d4:4e:34:b5:45:c9:ae:
                    88:6a:12:90:cc:de:d3:1c:91:59:7a:84:d3:5c:53:
                    38:2b:e2:d9:47:a2:21:ff:ae:8c:51:03:76:dc:08:
                    44:84:77:e0:ea:34:ca:65:de:25:cd:19:34:70:95:
                    d7:cf:78:01:26:c1:79:f8:89:e2:c0:c3:b5:64:e1:
                    55:6c:ea:63:03:ac:c9:81:c6:33:f0:ad:64:32:6c:
                    5e:94:dc:71:76:9c:dd:7e:d0:a2:df:75:ec:47:6b:
                    22:de:0d:72:1d:a7:79:fa:5e:04:66:68:e9:8b:a2:
                    e4:bc:d6:b6:b9:6d:0d:7c:6b:7b:36:44:38:36:51:
                    a2:72:50:c2:51:66:21:f8:e0:2c:b9:68:2d:c7:75:
                    da:d3:95:ce:c0:33:3e:7c:ba:81:3b:c3:fa:74:29:
                    30:f4:c7:ce:dd:00:cc:27:6c:58:ea:8f:f2:24:f8:
                    09:f5:02:ff:4b:2e:9a:53:47:5b:27:77:29:c3:37:
                    26:4f:2d:1c:c9:c7:be:53:30:01:02:a6:41:b8:77:
                    03:14:a5:69:ef:9d:fe:ce:19:3b:09:25:a6:8e:eb:
                    52:18:9b:a7:88:ab:63:30:31:64:bb:52:13:04:8c:
                    34:cb:13:71:c0:94:6c:dd:fb:3d:8d:a1:d9:65:28:
                    bc:c8:e8:d3:6a:02:ca:50:8b:a9:97:4d:8e:be:c2:
                    04:3d:1f:76:76:96:b6:d2:43:a9:0a:75:4e:f2:e4:
                    39:67:aa:08:7f:75:12:6a:5a:45:36:e4:f9:7b:4e:
                    9e:bd:b8:42:45:95:16:07:42:4c:b9:23:42:04:c3:
                    71:1c:28:40:27:a7:e1:2d:77:fa:b6:56:29:67:e2:
                    e5:10:fc:38:c9:8c:e2:44:19:ae:b5:90:b0:63:1d:
                    76:82:21:93:95:01:2a:ba:7d:76:3e:f1:dc:1d:b8:
                    5c:ec:d2:04:7e:e6:11:a1:76:3f:f3:f1:7d:57:82:
                    77:d5:a8:eb:b0:fb:bb:65:c7:a7:74:ad:36:f5:a8:
                    b5:dc:4a:ba:91:f5:d7:1b:1f:31:4c:d4:e2:b7:35:
                    2b:b8:a5:a8:0a:76:d5:2e:71:dd:66:d4:23:34:87:
                    c5:61:e1:bd:83:df:99:85:42:a0:45:c2:12:90:09:
                    23:f0:f3:4b:f0:19:e4:3a:e5:2b:77:d0:79:5b:02:
                    62:50:03:38:2e:31:d5:c3:56:2b:bc:4a:7f:27:a7:
                    3b:05:80:0f:6f:34:b3:19:60:10:c1:a7:d6:8b:16:
                    ee:41:14:0e:c0:94:4c:9d:79:a0:15:1b:4d:39:fc:
                    f6:14:d9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                B0:F5:53:93:E6:76:AD:F9:2A:87:38:9B:0F:D9:00:AD:77:2E:F1:5B
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
         08:59:ae:bf:ef:a5:7c:8c:29:5e:0e:d4:ef:ce:84:6f:97:a1:
         0e:a1:5b:1f:00:30:86:93:b3:5d:3c:1c:88:63:09:17:c7:f1:
         a2:d1:40:d4:5d:11:59:36:37:e2:5b:f4:93:69:b9:08:6b:2d:
         dc:b8:55:d4:44:a1:d7:76:7d:e9:21:fa:f2:0d:c5:11:6a:2e:
         33:06:ba:3f:af:72:5b:73:01:d4:1a:1e:df:e8:a6:ac:fb:bc:
         e7:42:c5:c1:5e:96:63:ee:be:23:34:9b:89:12:1b:75:d7:04:
         fb:e0:a0:96:fc:29:54:cd:c2:d3:34:d4:1f:eb:bf:43:68:d3:
         ab:e6:3b:03:73:46:3d:e7:fe:23:63:ec:d7:d7:69:da:d5:67:
         55:b4:ca:20:74:2b:f0:f8:f2:ba:74:48:2f:53:be:7b:a9:e6:
         ce:c8:0a:c9:34:5d:3f:ae:d0:d5:30:87:88:ad:12:56:ee:5a:
         36:f2:96:d0:a4:55:c3:db:c0:1f:3c:3a:b7:e3:a2:d4:ad:91:
         5b:da:f2:51:87:05:46:68:95:97:67:37:02:a0:3c:0c:b2:d4:
         c0:bd:12:c9:c8:04:41:4f:33:32:96:2b:6e:6c:5f:e0:ea:f9:
         ac:ea:b5:58:6e:41:67:19:1f:02:73:20:62:85:6f:35:b5:f2:
         97:1c:33:08:25:d6:f9:eb:2b:aa:aa:cb:91:1c:13:98:cb:9b:
         d6:22:8c:fb:c6:20:ce:18:ce:0d:b8:d5:0b:92:d8:6d:dd:d3:
         a1:95:ad:1b:3e:be:4f:1e:5e:dd:bf:f2:f1:86:60:34:ae:e3:
         19:74:93:b1:42:9b:0e:3f:b8:05:a0:6a:4a:2a:25:63:48:70:
         b0:86:7f:14:90:f9:1c:9a:8a:47:70:29:1d:27:bd:dd:8f:99:
         f7:37:3e:a4:d5:08:83:4d:13:67:29:12:ae:99:25:43:39:9f:
         4c:5f:63:d6:e7:41:f4:d5:d0:68:45:c4:53:c1:25:99:27:00:
         af:4d:86:8e:f1:04:82:9c:b7:dc:6e:df:d5:f9:0c:2a:f4:c2:
         a8:fb:c4:c9:49:fb:c6:dd:0a:1a:be:d4:ef:05:95:1e:0f:d6:
         7b:0a:4e:8d:85:95:46:d7:aa:0c:5f:c4:9c:95:25:47:66:e2:
         d6:5f:43:b5:23:ad:92:bf:f8:8d:6e:3b:d6:37:8f:11:af:0e:
         b3:dd:29:51:34:b5:ae:45:5d:5c:e1:2d:d4:1c:93:fe:f9:da:
         cb:23:82:ad:23:88:3a:82:e6:ed:ab:91:56:58:05:f9:88:a2:
         0c:42:7d:dc:e0:d9:03:e3:51:fa:36:1b:a7:ad:5e:f1:f0:ff:
         53:06:de:c4:3b:6e:76:fd
-----BEGIN CERTIFICATE-----
MIIF5DCCA8ygAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwdDELMAkGA1UEBhMCQ04x
EjAQBgNVBAgMCUd1YW5nZG9uZzENMAsGA1UECgwEWVNXTTEjMCEGA1UECwwaWVNX
TSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHTAbBgNVBAMMFFlTV00gSW50ZXJtZWRp
YXRlIENBMB4XDTIwMDMyMTA2MTcwM1oXDTIxMDMzMTA2MTcwM1owfzELMAkGA1UE
BhMCQ04xEjAQBgNVBAgMCUd1YW5nZG9uZzERMA8GA1UEBwwIU2hlbnpoZW4xDTAL
BgNVBAoMBFlTV00xIzAhBgNVBAsMGllTV00gQ2VydGlmaWNhdGUgQXV0aG9yaXR5
MRUwEwYDVQQDDAxvY3NwLmlvdC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDHaX8qa7qW2VJDiJH7+s47oLaA5R4p1E40tUXJrohqEpDM3tMckVl6
hNNcUzgr4tlHoiH/roxRA3bcCESEd+DqNMpl3iXNGTRwldfPeAEmwXn4ieLAw7Vk
4VVs6mMDrMmBxjPwrWQybF6U3HF2nN1+0KLfdexHayLeDXIdp3n6XgRmaOmLouS8
1ra5bQ18a3s2RDg2UaJyUMJRZiH44Cy5aC3HddrTlc7AMz58uoE7w/p0KTD0x87d
AMwnbFjqj/Ik+An1Av9LLppTR1sndynDNyZPLRzJx75TMAECpkG4dwMUpWnvnf7O
GTsJJaaO61IYm6eIq2MwMWS7UhMEjDTLE3HAlGzd+z2NodllKLzI6NNqAspQi6mX
TY6+wgQ9H3Z2lrbSQ6kKdU7y5Dlnqgh/dRJqWkU25Pl7Tp69uEJFlRYHQky5I0IE
w3EcKEAnp+Etd/q2Viln4uUQ/DjJjOJEGa61kLBjHXaCIZOVASq6fXY+8dwduFzs
0gR+5hGhdj/z8X1XgnfVqOuw+7tlx6d0rTb1qLXcSrqR9dcbHzFM1OK3NSu4pagK
dtUucd1m1CM0h8Vh4b2D35mFQqBFwhKQCSPw80vwGeQ65St30HlbAmJQAzguMdXD
Viu8Sn8npzsFgA9vNLMZYBDBp9aLFu5BFA7AlEydeaAVG005/PYU2QIDAQABo3Uw
czAJBgNVHRMEAjAAMB0GA1UdDgQWBBSw9VOT5nat+SqHOJsP2QCtdy7xWzAfBgNV
HSMEGDAWgBSAgZWLuSFXB65e4gos7ogtttvv7zAOBgNVHQ8BAf8EBAMCB4AwFgYD
VR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAAhZrr/vpXyM
KV4O1O/OhG+XoQ6hWx8AMIaTs108HIhjCRfH8aLRQNRdEVk2N+Jb9JNpuQhrLdy4
VdREodd2fekh+vINxRFqLjMGuj+vcltzAdQaHt/opqz7vOdCxcFelmPuviM0m4kS
G3XXBPvgoJb8KVTNwtM01B/rv0No06vmOwNzRj3n/iNj7NfXadrVZ1W0yiB0K/D4
8rp0SC9Tvnup5s7ICsk0XT+u0NUwh4itElbuWjbyltCkVcPbwB88OrfjotStkVva
8lGHBUZolZdnNwKgPAyy1MC9EsnIBEFPMzKWK25sX+Dq+azqtVhuQWcZHwJzIGKF
bzW18pccMwgl1vnrK6qqy5EcE5jLm9YijPvGIM4Yzg241QuS2G3d06GVrRs+vk8e
Xt2/8vGGYDSu4xl0k7FCmw4/uAWgakoqJWNIcLCGfxSQ+RyaikdwKR0nvd2Pmfc3
PqTVCINNE2cpEq6ZJUM5n0xfY9bnQfTV0GhFxFPBJZknAK9Nho7xBIKct9xu39X5
DCr0wqj7xMlJ+8bdChq+1O8FlR4P1nsKTo2FlUbXqgxfxJyVJUdm4tZfQ7UjrZK/
+I1uO9Y3jxGvDrPdKVE0ta5FXVzhLdQck/752ssjgq0jiDqC5u2rkVZYBfmIogxC
fdzg2QPjUfo2G6etXvHw/1MG3sQ7bnb9
-----END CERTIFICATE-----
Response verify OK
intermediate/certs/device.cert.pem: revoked
        This Update: Mar 21 06:46:58 2020 GMT
        Revocation Time: Mar 21 06:45:19 2020 GMT

生成服务端私钥

openssl genrsa -aes256 \
-out intermediate/private/api.iot.com.key.pem 2048

[root@ip-172-31-2-174 ca]# openssl genrsa -aes256 \
> -out intermediate/private/api.iot.com.key.pem 2048
Generating RSA private key, 2048 bit long modulus
...........................................+++
.............+++
e is 65537 (0x10001)
Enter pass phrase for intermediate/private/api.iot.com.key.pem:
Verifying - Enter pass phrase for intermediate/private/api.iot.com.key.pem:
[root@ip-172-31-2-174 ca]# chmod 400 intermediate/private/api.iot.com.key.pem 
[root@ip-172-31-2-174 ca]#

生成服务端CSR文件

openssl req -config intermediate/openssl.cnf \
-key intermediate/private/api.iot.com.key.pem \
-new -sha256 -out intermediate/csr/api.iot.com.csr.pem

[root@ip-172-31-2-174 ca]# openssl req -config intermediate/openssl.cnf \
> -key intermediate/private/api.iot.com.key.pem \
> -new -sha256 -out intermediate/csr/api.iot.com.csr.pem
Enter pass phrase for intermediate/private/api.iot.com.key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name [England]:Guangdong
Locality Name []:Shenzhen
Organization Name [Alice Ltd]:YSWL
Organizational Unit Name []:IT
Common Name []:api.iot.com
Email Address []:
[root@ip-172-31-2-174 ca]#

生成服务端证书

openssl ca -config intermediate/openssl.cnf \
-extensions server_cert -days 365 -notext -md sha256 \
-in intermediate/csr/api.iot.com.csr.pem \
-out intermediate/certs/api.iot.com.cert.pem

[root@ip-172-31-2-174 ca]# openssl ca -config intermediate/openssl.cnf \
> -extensions server_cert -days 365 -notext -md sha256 \
> -in intermediate/csr/api.iot.com.csr.pem \
> -out intermediate/certs/api.iot.com.cert.pem
Using configuration from intermediate/openssl.cnf
Enter pass phrase for /root/ca/intermediate/private/intermediate.key.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4096 (0x1000)
        Validity
            Not Before: Mar 21 05:58:37 2020 GMT
            Not After : Mar 21 05:58:37 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Guangdong
            localityName              = Shenzhen
            organizationName          = YSWL
            organizationalUnitName    = IT
            commonName                = api.iot.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Cert Type: 
                SSL Server
            Netscape Comment: 
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier: 
                9E:90:07:07:EF:B6:7B:A7:67:34:1E:76:DB:83:C4:E8:5B:22:ED:F5
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF
                DirName:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
                serial:10:00

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
Certificate is to be certified until Mar 21 05:58:37 2021 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ip-172-31-2-174 ca]# chmod 444 intermediate/certs/api.iot.com.cert.pem 
[root@ip-172-31-2-174 ca]#

验证服务端证书信息（1年）

[root@ip-172-31-2-174 ca]# openssl x509 -in intermediate/certs/api.iot.com.cert.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4096 (0x1000)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM Intermediate CA
        Validity
            Not Before: Mar 21 05:58:37 2020 GMT
            Not After : Mar 21 05:58:37 2021 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWL, OU=IT, CN=api.iot.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b1:ae:bd:fd:ea:de:ab:16:9b:39:a3:53:f0:de:
                    d7:12:cd:b7:7e:55:06:f8:36:74:57:d7:e3:44:b6:
                    03:be:6c:d8:2a:1c:41:20:76:1c:8f:f1:ba:a5:1e:
                    00:a6:4b:2f:43:af:08:20:97:40:7f:a4:74:e6:ac:
                    a9:57:20:c3:e8:f2:5e:8d:be:e6:f2:a4:d5:eb:b9:
                    9a:a1:2e:3a:01:3f:a1:a1:e9:aa:d3:0a:8f:91:46:
                    9d:dd:32:ad:4d:63:1d:e6:fc:08:75:93:0c:b2:d9:
                    fe:86:38:88:48:9f:07:60:ac:c3:ed:f8:27:bb:c8:
                    4a:76:55:64:44:47:eb:6d:d1:ab:aa:47:f3:ad:93:
                    80:42:4b:a2:d6:8b:86:60:4d:6b:5a:08:2e:e9:01:
                    28:5d:05:82:c2:c6:67:d2:79:ea:b6:ab:0b:8f:6b:
                    ed:f1:43:10:7e:26:4b:b5:8a:bc:d0:94:01:6e:18:
                    fd:a3:ce:9a:04:78:12:39:91:aa:7a:c0:d9:d0:0d:
                    74:5e:db:40:a6:d4:24:83:84:71:53:16:12:92:25:
                    49:af:0b:48:2a:b2:fa:a7:bd:dc:f4:83:28:ac:a2:
                    fa:6e:ee:df:64:7e:57:0f:bc:ea:dc:ca:40:e2:f0:
                    17:79:30:38:ff:c7:aa:37:b1:ae:83:9f:26:89:79:
                    74:7d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Cert Type: 
                SSL Server
            Netscape Comment: 
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier: 
                9E:90:07:07:EF:B6:7B:A7:67:34:1E:76:DB:83:C4:E8:5B:22:ED:F5
            X509v3 Authority Key Identifier: 
                keyid:80:81:95:8B:B9:21:57:07:AE:5E:E2:0A:2C:EE:88:2D:B6:DB:EF:EF
                DirName:/C=CN/ST=Guangdong/L=Shenzhen/O=YSWM/OU=YSWM Certificate Authority/CN=YSWM ROOT CA
                serial:10:00

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
         23:63:ee:d6:bb:3e:59:c0:d7:4f:82:03:32:11:20:70:48:1c:
         d4:42:41:29:0c:38:f6:c9:de:c1:c6:a8:e1:f8:a9:25:40:10:
         06:ee:f3:a6:be:47:8a:24:14:07:e5:71:3a:89:3c:21:09:b8:
         80:18:d8:d5:05:db:c2:9c:8a:65:1d:e5:17:32:42:52:40:20:
         12:7a:7a:75:3e:f8:87:39:01:77:d5:11:30:94:92:75:04:55:
         f9:1f:40:6d:97:8f:3e:b8:41:46:bc:53:04:7f:1c:53:05:c5:
         d8:a6:88:c7:5b:dd:65:c7:b6:dd:f5:90:6d:71:70:9b:39:fd:
         2a:5b:fa:c2:6d:bd:bf:15:97:5e:33:3d:13:24:2c:cf:91:f1:
         3a:32:2f:8d:f7:05:84:1a:81:80:c7:fc:77:24:d8:38:1a:23:
         a3:a8:77:32:16:30:0b:04:b8:ae:30:c9:95:98:57:90:a3:02:
         b5:0b:7d:76:ac:9f:a5:ac:c3:42:74:10:e0:eb:2b:8d:8a:92:
         31:fc:7e:d1:96:d8:25:84:01:b5:06:55:c8:a4:8d:8f:26:af:
         55:bb:3f:b0:12:b8:3d:07:76:87:77:58:fc:2c:45:86:4f:11:
         15:a1:ef:03:24:1d:78:bf:84:fd:02:b5:eb:33:62:28:e9:70:
         b2:c7:21:2c:b5:4f:d9:e6:17:b1:7b:84:04:78:fd:46:bd:a0:
         38:88:45:ad:6a:0b:58:38:1d:2e:4f:ad:ab:69:ae:cb:54:6e:
         6e:34:fc:e4:76:95:09:56:ff:c1:a3:67:4a:6f:2a:5d:61:92:
         a6:57:97:8f:2a:ee:80:9f:a8:1e:d2:db:49:b3:af:46:18:7b:
         a7:08:18:8e:bc:10:75:02:b1:15:7c:fe:42:a0:ce:c0:f5:5a:
         3a:fb:89:bc:80:f8:15:32:1f:83:bf:f2:91:4f:1c:6a:58:f3:
         0c:4a:af:ac:91:7a:80:08:35:1d:8e:ce:2a:c8:5c:92:14:22:
         28:dc:b2:cf:bd:60:1d:ca:17:ee:90:27:28:99:d3:c4:58:5c:
         a0:1b:09:e8:6e:c7:e0:6a:9a:f3:84:ce:ea:02:9f:5a:d1:22:
         6f:cc:e1:4f:e6:f2:0b:a4:ab:b6:84:ae:f3:91:c6:0f:4b:58:
         94:b5:80:c0:11:74:08:c9:68:44:c6:a9:21:de:98:34:54:8d:
         f2:e2:1f:dc:17:f8:09:22:c9:06:a4:70:66:9f:3b:60:fa:e8:
         c8:67:8a:eb:6c:77:3a:c4:b8:db:95:36:2b:7f:b4:ae:94:34:
         fe:24:fa:a3:e6:9e:61:ee:05:b9:d8:a5:df:93:bf:77:4c:81:
         56:26:25:bc:1f:e7:fd:a3
[root@ip-172-31-2-174 ca]#

查看证书签发列表

[root@ip-172-31-2-174 ca]# cat intermediate/index.txt
V       210321055837Z           1000    unknown /C=CN/ST=Guangdong/L=Shenzhen/O=YSWL/OU=IT/CN=api.iot.com
[root@ip-172-31-2-174 ca]#

使用CA证书链验证服务端证书有效性
注意：必须构建证书链文件（根证书在最后部分），任何单级（根/中级）CA都无法完成对服务端证书的验证。

构建证书链文件

cat intermediate/certs/intermediate.cert.pem \
certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem
chmod 444 intermediate/certs/ca-chain.cert.pem

[root@ip-172-31-2-174 ca]# cat intermediate/certs/intermediate.cert.pem \
> certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem 
[root@ip-172-31-2-174 ca]# chmod 444 intermediate/certs/ca-chain.cert.pem

验证

openssl verify -CAfile intermediate/certs/ca-chain.cert.pem \
intermediate/certs/api.iot.com.cert.pem

[root@ip-172-31-2-174 ca]# openssl verify -CAfile intermediate/certs/ca-chain.cert.pem \
> intermediate/certs/api.iot.com.cert.pem
intermediate/certs/api.iot.com.cert.pem: OK
[root@ip-172-31-2-174 ca]#

创建根CA证书签发目录结构

[root@ip-172-31-2-174 ~]# mkdir -p ca/{certs,crl,newcerts,private}
[root@ip-172-31-2-174 ~]# chmod 700 ca/private
[root@ip-172-31-2-174 ~]# touch ca/index.txt
[root@ip-172-31-2-174 ~]# echo 1000 > ca/serial

准备根CA配置文件

[root@ip-172-31-2-174 ~]# cd ca/
[root@ip-172-31-2-174 ca]# vi openssl.cnf

生成根CA证书私钥

[root@ip-172-31-2-174 ca]# openssl genrsa -aes256 -out private/ca.key.pem 4096
Generating RSA private key, 4096 bit long modulus
..............................................................++
..............................................................................++
e is 65537 (0x10001)
Enter pass phrase for private/ca.key.pem:
Verifying - Enter pass phrase for private/ca.key.pem:
[root@ip-172-31-2-174 ca]# chmod 400 private/ca.key.pem 
[root@ip-172-31-2-174 ca]#

生成根CA证书

openssl req -config openssl.cnf \
-key private/ca.key.pem \
-new -x509 -days 7300 -sha256 -extensions v3_ca \
-out certs/ca.cert.pem

[root@ip-172-31-2-174 ca]# openssl req -config openssl.cnf \
> -key private/ca.key.pem \
> -new -x509 -days 7300 -sha256 -extensions v3_ca \
> -out certs/ca.cert.pem
Enter pass phrase for private/ca.key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name [England]:Guangdong
Locality Name []:Shenzhen
Organization Name [Alice Ltd]:YSWM
Organizational Unit Name []:YSWM Certificate Authority
Common Name []:YSWM ROOT CA
Email Address []:
[root@ip-172-31-2-174 ca]# chmod 444 certs/ca.cert.pem 
[root@ip-172-31-2-174 ca]#

验证根CA证书信息（20年）

[root@ip-172-31-2-174 ca]# openssl x509 -in certs/ca.cert.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b4:3b:48:9b:76:69:bf:60
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM ROOT CA
        Validity
            Not Before: Mar 21 05:47:53 2020 GMT
            Not After : Mar 16 05:47:53 2040 GMT
        Subject: C=CN, ST=Guangdong, L=Shenzhen, O=YSWM, OU=YSWM Certificate Authority, CN=YSWM ROOT CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:a1:41:53:36:5b:8c:73:e7:da:90:c2:85:2b:48:
                    47:c1:8b:fb:b9:c0:a9:c1:d5:a8:a7:37:de:41:b3:
                    6b:cb:41:72:ad:e9:99:76:85:37:79:76:6c:54:8b:
                    d3:24:2f:18:6e:37:d2:b4:fb:f8:07:d9:45:7b:71:
                    5c:a2:1a:c1:ea:99:e0:28:53:ab:14:e2:73:5d:54:
                    01:16:fc:1e:27:3d:98:e9:3c:d6:b4:69:df:45:9e:
                    18:ac:8b:4c:ca:10:ff:3b:7d:c5:63:c0:8d:be:e3:
                    31:d7:64:4d:3c:94:32:d1:43:bd:37:87:66:11:b8:
                    24:a5:ab:61:ca:bc:8c:1e:05:78:da:9d:5b:3b:66:
                    ea:b3:a7:6d:b0:f5:1a:8a:72:4e:aa:f3:66:f8:f5:
                    4d:c0:58:b7:11:8f:64:21:ce:8d:5e:d9:e5:79:a9:
                    6a:d3:8f:50:34:f1:e6:2b:73:ce:df:57:9c:2d:fe:
                    a1:17:df:74:d9:0c:f4:4a:a5:a3:9c:6a:64:fd:93:
                    f9:92:18:9b:98:ba:0e:78:06:dc:88:37:0f:17:73:
                    ea:3c:b7:20:fb:10:63:b9:b8:08:55:82:15:84:38:
                    41:9d:e4:e3:31:a9:e5:f5:47:e2:5b:71:15:ac:b6:
                    ec:47:4f:5e:ef:f5:78:44:0c:b1:1d:6a:81:d0:0e:
                    66:b8:bc:a5:10:f0:e0:cc:56:f6:52:86:83:9c:ce:
                    0c:1a:92:42:a3:10:02:92:af:65:0e:1e:1e:d1:bf:
                    3e:9c:c6:59:d1:ae:87:1c:7c:5d:03:0c:b1:1d:0d:
                    73:2f:d1:a7:b3:1c:6e:bf:50:fc:a1:cd:61:e0:e5:
                    20:81:b6:05:2e:89:7a:98:8e:d8:05:a3:14:80:b6:
                    63:cc:c5:0e:26:64:45:93:b0:9c:ac:cd:71:4d:71:
                    19:9a:b7:60:f3:ce:be:e5:0b:78:43:48:d5:70:ad:
                    7a:2c:33:d5:48:85:2e:b8:4a:b3:31:52:70:74:14:
                    ca:26:ce:a1:01:9c:ab:f8:cc:8f:87:f1:8c:20:48:
                    c6:38:aa:e5:57:71:e8:c4:28:41:32:3e:10:4e:16:
                    2d:85:57:d2:a2:46:4c:d4:b7:31:c2:43:41:14:98:
                    b5:5b:f2:19:87:62:fd:72:1b:b4:1c:9f:fc:b7:c3:
                    db:90:f1:15:c4:d0:19:0d:9f:eb:16:b0:d0:47:b8:
                    94:11:29:28:33:f8:ed:7c:0a:09:73:91:bf:5b:ca:
                    48:a8:4f:03:72:82:c2:ab:1b:18:0d:1f:40:e5:6a:
                    a9:64:ef:25:13:2a:9e:6e:c6:46:b5:9b:01:7c:b2:
                    80:40:1a:84:01:71:55:7c:fe:bb:19:bf:4c:53:1a:
                    f2:92:93
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                9A:A7:2A:30:06:3C:68:D4:92:6F:59:91:59:6B:E6:EC:E0:34:36:1F
            X509v3 Authority Key Identifier: 
                keyid:9A:A7:2A:30:06:3C:68:D4:92:6F:59:91:59:6B:E6:EC:E0:34:36:1F

            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
         01:6d:de:25:86:9e:73:82:21:bd:fe:e2:13:39:2d:da:06:aa:
         34:82:9c:62:06:93:a9:bc:f1:23:85:a5:3e:bc:b9:b8:d0:1f:
         78:09:db:8e:82:ab:0e:44:1e:58:44:6b:da:b3:f6:94:a7:62:
         35:85:07:6a:45:90:91:a3:e7:a4:50:25:b3:bc:dd:58:55:f5:
         bd:13:82:1f:2c:3f:13:f9:3d:de:95:9e:7b:34:ad:9d:29:67:
         71:12:cb:bf:87:47:e2:a0:cf:ff:b4:9d:7f:12:40:ed:d1:3a:
         65:ca:ae:d2:3e:f7:94:85:9c:7f:16:b0:78:72:5d:ff:2e:3b:
         13:47:9c:b2:bc:72:2b:90:9c:2b:0e:79:4d:e4:8c:d3:e5:d7:
         98:1b:09:0a:88:f8:63:74:a1:af:56:04:71:4b:b0:1a:d0:75:
         7e:53:5f:5a:5f:fd:73:53:72:12:69:79:5e:d6:88:ad:40:50:
         c4:6d:1a:c7:e8:ac:dc:7c:6a:f5:f0:b7:5f:5a:95:da:a1:6e:
         b3:98:ea:49:40:49:19:39:6d:f2:7d:bb:0b:4a:d4:31:6a:e0:
         2c:20:02:bc:00:f6:74:e6:b0:b0:d3:05:df:dd:6a:1f:db:50:
         ff:43:bf:dd:3b:10:a6:1a:b9:bf:39:5a:c4:09:b0:10:b7:8e:
         76:fc:64:cf:76:2f:a9:08:24:b2:92:3c:37:04:ba:2b:63:98:
         1c:6e:f8:9d:3d:fa:b1:56:49:7c:46:35:7e:2d:ff:43:fe:6c:
         cb:e3:91:66:2a:3e:31:f3:45:b9:c2:96:34:ac:f4:16:e4:6a:
         cd:f0:86:f9:bd:19:19:1e:19:eb:1e:f8:74:71:8a:fb:3b:37:
         4b:45:59:b9:90:30:bc:67:85:de:e0:d9:36:b5:5d:e5:06:d8:
         e1:0a:d3:86:b3:02:d2:a8:c5:43:ca:b9:70:d6:32:a8:c0:4d:
         39:5a:be:bf:7d:3b:66:60:d1:c8:1f:66:a8:57:de:9f:7f:e1:
         2a:4f:89:1c:78:5d:25:9f:69:dc:b5:2e:59:97:99:65:a1:a1:
         ef:78:78:f1:26:5f:fc:ae:1e:72:00:70:ed:25:d2:91:55:8a:
         1c:34:e6:d3:bf:02:1f:9c:4d:dd:a2:b9:12:fa:5a:f3:22:a4:
         05:24:35:e1:56:76:ab:fe:33:65:46:86:56:f6:d6:ca:f7:4c:
         96:15:0b:16:16:b1:f6:49:64:f9:fe:38:42:dd:2c:b3:db:97:
         41:62:ce:b7:62:66:a9:7a:e3:8d:54:8c:89:23:7a:ac:a5:89:
         df:85:b4:dc:b1:dd:82:67:12:49:05:9e:fb:c0:c8:c9:16:66:
         d1:af:ad:a5:9e:75:14:9b
[root@ip-172-31-2-174 ca]#