国密 HTTPS 的"最后一公里"：从证书管理到加密服务的架构转型

# 下载 Tongsuo 源码
wget https://github.com/Tongsuo-Project/Tongsuo/releases/download/8.4.0/Tongsuo-8.4.0.tar.gz
tar xzf Tongsuo-8.4.0.tar.gz
cd Tongsuo-8.4.0

# 编译安装到 /opt/tongsuo
./config --prefix=/opt/tongsuo --openssldir=/opt/tongsuo/ssl shared
make -j$(nproc)
sudo make install

# 验证安装
/opt/tongsuo/bin/openssl version
# 验证国密算法支持
/opt/tongsuo/bin/openssl enc -ciphers | grep sm4
# 应输出 SM4-CBC、SM4-GCM 等

# 下载 Nginx 源码
wget http://nginx.org/download/nginx-1.26.1.tar.gz
tar xzf nginx-1.26.1.tar.gz
cd nginx-1.26.1

# 关键：指定 --with-openssl 路径为 Tongsuo
./configure \
    --prefix=/etc/nginx \
    --with-http_ssl_module \
    --with-http_v2_module \
    --with-http_realip_module \
    --with-http_stub_status_module \
    --with-openssl=/opt/tongsuo \
    --with-cc-opt="-I/opt/tongsuo/include" \
    --with-ld-opt="-L/opt/tongsuo/lib64 -Wl,-rpath,/opt/tongsuo/lib64"

make -j$(nproc)
sudo make install

#!/usr/bin/env python3
"""
generate_sm2_dual_cert.py
生成 SM2 双证书（签名证书 + 加密证书）
需要：pip install gmssl >= 3.2.0
"""
import os
import datetime
from gmssl import sm2, sm3, func
from gmssl.sm2 import CryptSM2
from cryptography import x509
from cryptography.x509.oid import NameOID, ExtensionOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec, padding
from cryptography.hazmat.backends import default_backend
from cryptography.x509.oid import KeyUsageOID
import subprocess


def generate_sm2_key_pair():
    """使用 gmssl 生成 SM2 密钥对"""
    # gmssl 3.2.x API：生成密钥对
    sm2_crypt = CryptSM2(None)
    private_key_bytes = sm2_crypt.generate_private_key()
    public_key_bytes = sm2_crypt.generate_public_key(private_key_bytes)
    return private_key_bytes, public_key_bytes


def create_sm2_self_signed_cert(private_key_bytes, public_key_bytes, 
                                 common_name, days_valid=365):
    """
    创建 SM2 自签名证书
    实际生产环境应从 CA 签发，此处演示证书结构
    """
    # 使用 cryptography 生成 SM2 密钥对（兼容格式）
    # 注意：cryptography 44.x 不支持 ec.SM2() 密钥生成
    # 这里用 subprocess 调用 Tongsuo 命令行生成
    cmd = [
        '/opt/tongsuo/bin/openssl', 'ecparam', '-name', 'sm2',
        '-genkey', '-noout', '-out', f'{common_name}_key.pem'
    ]
    subprocess.run(cmd, check=True)
    
    cmd = [
        '/opt/tongsuo/bin/openssl', 'req', '-new', '-x509',
        '-key', f'{common_name}_key.pem',
        '-out', f'{common_name}_cert.pem',
        '-days', str(days_valid),
        '-subj', f'/CN={common_name}',
        '-sm3'
    ]
    subprocess.run(cmd, check=True)
    
    print(f"已生成: {common_name}_cert.pem, {common_name}_key.pem")


def main():
    """生成签名证书和加密证书"""
    print("=" * 60)
    print("国密双证书生成工具")
    print("=" * 60)
    
    # 生成签名证书
    print("\n[1/2] 生成签名证书...")
    create_sm2_self_signed_cert(None, None, "sm2-sign", days_valid=365)
    
    # 生成加密证书
    print("\n[2/2] 生成加密证书...")
    create_sm2_self_signed_cert(None, None, "sm2-enc", days_valid=365)
    
    print("\n" + "=" * 60)
    print("双证书生成完成！")
    print("  - 签名证书: sm2-sign_cert.pem + sm2-sign_key.pem")
    print("  - 加密证书: sm2-enc_cert.pem + sm2-enc_key.pem")
    print("=" * 60)


if __name__ == '__main__':
    main()

# /etc/nginx/conf.d/gm-gateway.conf

# 国密加密服务网关配置
# 支持 TLS 1.3 + 国密密码套件 + 双证书

server {
    listen 443 ssl;
    server_name example.com;

    # === 国密双证书配置 ===
    # 签名证书（用于身份认证）
    ssl_certificate         /etc/nginx/certs/sm2-sign_cert.pem;
    ssl_certificate_key     /etc/nginx/certs/sm2-sign_key.pem;
    
    # 加密证书（用于密钥交换）
    # Tongsuo 支持在一张配置中同时加载两张证书
    ssl_enc_certificate     /etc/nginx/certs/sm2-enc_cert.pem;
    ssl_enc_certificate_key /etc/nginx/certs/sm2-enc_key.pem;

    # === 密码套件配置 ===
    # 国密优先，回退国际套件
    ssl_conf_command Ciphersuites ECC-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-GCM-SM3;
    ssl_conf_command Options ServerPreference;

    # === TLS 协议版本 ===
    ssl_protocols TLSv1.2 TLSv1.3;

    # === 证书链 ===
    # 如果有 CA 中间证书，合并到证书文件中
    # ssl_trusted_certificate /etc/nginx/certs/ca-chain.pem;

    # === 会话缓存 ===
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # === 安全头部 ===
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Content-Type-Options nosniff always;

    # === 代理到后端 ===
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 关键：告知后端原始请求是 HTTPS
        proxy_set_header X-Forwarded-Ssl on;
    }
}

# HTTP 自动跳转 HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

#!/usr/bin/env python3
"""
cert_autorenew.py
国密证书自动续期 + Nginx reload
配合 cron 每天运行：0 2 * * * python3 /opt/cert-gateway/cert_autorenew.py
"""
import subprocess
import os
import datetime
import logging
from pathlib import Path

logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(message)s',
    handlers=[
        logging.FileHandler('/var/log/cert-autorenew.log'),
        logging.StreamHandler()
    ]
)
logger = logging.getLogger(__name__)

# 配置
CERT_DIR = Path('/etc/nginx/certs')
DOMAINS = ['example.com', 'www.example.com']
ACME_CLIENT = '/usr/local/bin/acme.sh'
DAYS_BEFORE_EXPIRE = 30  # 证书到期前 30 天续期


def check_cert_expiry(cert_path: str) -> int:
    """检查证书剩余天数"""
    try:
        cmd = [
            '/opt/tongsuo/bin/openssl', 'x509', '-in', cert_path,
            '-noout', '-enddate'
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        # 输出格式：notAfter=Jun 15 00:00:00 2026 GMT
        end_date_str = result.stdout.strip().split('=')[1]
        end_date = datetime.datetime.strptime(end_date_str, '%b %d %H:%M:%S %Y GMT')
        remaining = (end_date - datetime.datetime.utcnow()).days
        return remaining
    except Exception as e:
        logger.error(f"检查证书有效期失败: {e}")
        return -1


def renew_cert(domain: str):
    """使用 acme.sh 续期证书"""
    logger.info(f"开始续期证书: {domain}")
    try:
        cmd = [
            ACME_CLIENT, '--renew',
            '-d', domain,
            '--server', 'letsencrypt',
            '--keylength', 'sm2',
            '--output-cert', str(CERT_DIR / f'{domain}-cert.pem'),
            '--output-key', str(CERT_DIR / f'{domain}-key.pem'),
            '--reloadcmd', 'nginx -s reload'
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        logger.info(f"续期成功: {domain}\n{result.stdout}")
        return True
    except subprocess.CalledProcessError as e:
        logger.error(f"续期失败: {domain}\n{e.stderr}")
        return False


def nginx_reload():
    """优雅重载 Nginx（不断开现有连接）"""
    try:
        # 先测试配置
        subprocess.run(['nginx', '-t'], capture_output=True, check=True)
        # 再 reload
        subprocess.run(['nginx', '-s', 'reload'], capture_output=True, check=True)
        logger.info("Nginx 已重新加载配置")
    except subprocess.CalledProcessError as e:
        logger.error(f"Nginx reload 失败: {e.stderr}")


def main():
    logger.info("=" * 50)
    logger.info("证书自动续期检查开始")
    
    for domain in DOMAINS:
        cert_path = str(CERT_DIR / f'{domain}-cert.pem')
        if not os.path.exists(cert_path):
            logger.warning(f"证书文件不存在: {cert_path}")
            continue
        
        remaining = check_cert_expiry(cert_path)
        logger.info(f"{domain}: 剩余 {remaining} 天")
        
        if remaining < DAYS_BEFORE_EXPIRE:
            logger.info(f"{domain}: 证书即将到期，开始续期")
            if renew_cert(domain):
                nginx_reload()
        else:
            logger.info(f"{domain}: 证书有效期充足，无需续期")
    
    logger.info("证书自动续期检查完成")
    logger.info("=" * 50)


if __name__ == '__main__':
    main()

# 验证两张证书使用不同的公钥
from cryptography import x509
from cryptography.hazmat.primitives import serialization

def verify_dual_certs(sign_cert_path: str, enc_cert_path: str):
    """验证双证书使用不同的密钥对"""
    with open(sign_cert_path, 'rb') as f:
        sign_cert = x509.load_pem_x509_certificate(f.read())
    with open(enc_cert_path, 'rb') as f:
        enc_cert = x509.load_pem_x509_certificate(f.read())
    
    sign_pub = sign_cert.public_key().public_bytes(
        serialization.Encoding.X962,
        serialization.PublicFormat.CompressedPoint
    )
    enc_pub = enc_cert.public_key().public_bytes(
        serialization.Encoding.X962,
        serialization.PublicFormat.CompressedPoint
    )
    
    if sign_pub == enc_pub:
        raise ValueError("错误：签名证书和加密证书使用了相同的密钥对！")
    
    print("✓ 双证书密钥对验证通过（不同密钥对）")

# 网关路由配置示例（伪代码）
# /etc/nginx/conf.d/routes.conf

ROUTES = {
    # 新系统：直接 HTTPS
    "app1.example.com": {"scheme": "https", "backend": "http://internal-1:8080"},
    
    # 可改造的旧系统：网关代理
    "app2.example.com": {"scheme": "https", "backend": "http://internal-2:8080"},
    
    # 不可改造的系统：网关做 TLS 终止
    "legacy.example.com": {"scheme": "https", "backend": "http://legacy:80"},
    
    # 需要国际兼容的入口：双套件
    "public.example.com": {"scheme": "both", "backend": "http://public:8080"},
}