苹果p12证书转换[通俗易懂]

大家好，又见面了，我是你们的朋友全栈君。

先生成本地的key

openssl genrsa -out aps_development.key 2048

# 将key转换导出csr证书
openssl req -new -sha256 -key aps_development.key -out aps_development.csr

拿着 aps_development.csr 在 苹果开发者网站 去得到 cer 然后解析cer

openssl x509 -inform DER -outform PEM -in aps_development.cer -out aps_development.pem

# 导出p12证书
openssl pkcs12 -inkey aps_development.key -in aps_development.pem -export -out aps_development.p12

p12 反向解析

# supersign 是密码
openssl pkcs12 -in ios_distribution.p12 -out newfile.crt.pem -clcerts -nokeys -password pass:supersign
openssl pkcs12 -in  ios_distribution.p12 -out newfile.key.pem -nocerts -nodes -password pass:supersign

nginx的需要key证书需要包含，-----BEGIN RSA PRIVATE KEY-----
他们提供的只有-----BEGIN PRIVATE KEY-----的证书，需要使用工具转换下：
openssl rsa -in 2_abc.com.key -out 2_abc.com_pri.key

给描述文件签名

        cmd = "openssl smime -sign -in %s -out %s -signer %s " \
              "-inkey %s -certfile %s -outform der -nodetach " % (
                  mobilconfig_path, sign_mobilconfig_path, ssl_pem_path, ssl_key_path, ssl_pem_path)

Python实现p12导入导出

import base64,os
from OpenSSL.crypto import (load_pkcs12, dump_certificate_request, dump_privatekey, PKey, TYPE_RSA, X509Req,
dump_certificate, load_privatekey, load_certificate, PKCS12, FILETYPE_PEM, FILETYPE_ASN1)
class P12CertUtils(object):
def __init__(self, my_local_key, app_dev_pem, app_dev_p12):
self.my_local_key = my_local_key
self.app_dev_pem = app_dev_pem
self.app_dev_p12 = app_dev_p12
@staticmethod
def sign_mobileconfig(mobilconfig_path, sign_mobilconfig_path, ssl_pem_path, ssl_key_path):
''' :param mobilconfig_path: 描述文件绝对路径 :param sign_mobilconfig_path: 签名之后的文件绝对路径 :param ssl_pem_path: pem证书的绝对路径 :param ssl_key_path: key证书的绝对路径 :return: '''
cmd = "openssl smime -sign -in %s -out %s -signer %s " \
"-inkey %s -certfile %s -outform der -nodetach " % (
mobilconfig_path, sign_mobilconfig_path, ssl_pem_path, ssl_key_path, ssl_pem_path)
return exec_shell(cmd)
def make_p12_from_cert(self, password):
result = { 
}
try:
certificate = load_certificate(FILETYPE_PEM, open(self.app_dev_pem, 'rb').read())
private_key = load_privatekey(FILETYPE_PEM, open(self.my_local_key, 'rb').read())
p12 = PKCS12()
p12.set_certificate(certificate)
p12.set_privatekey(private_key)
with open(self.app_dev_p12, 'wb+') as f:
f.write(p12.export(password))
if password:
with open(self.app_dev_p12 + '.pwd', 'w') as f:
f.write(password)
return True, p12.get_friendlyname()
except Exception as e:
result["err_info"] = e
return False, result
def write_cert(self):
for file in [self.app_dev_p12, self.app_dev_p12 + '.pwd', self.my_local_key, self.app_dev_pem]:
if os.path.exists(file):
os.rename(file, file + '.' + get_format_time() + '.bak')
os.rename(file + '.bak', file)
def make_cert_from_p12(self, password, p12_content=None):
result = { 
}
try:
if p12_content:
p12_content_list = p12_content.split('data:application/x-pkcs12;base64,')
if len(p12_content_list) == 2:
with open(self.app_dev_p12 + '.bak', 'wb+') as f:
f.write(base64.b64decode(p12_content.split('data:application/x-pkcs12;base64,')[1]))
if password:
with open(self.app_dev_p12 + '.pwd.bak', 'w') as f:
f.write(password)
else:
result["err_info"] = '非法p12证书文件，请检查'
return False, result
else:
result["err_info"] = '证书内容有误，请检查'
return False, result
p12 = load_pkcs12(open(self.app_dev_p12 + '.bak', 'rb').read(), password)
cert = p12.get_certificate()
if cert.has_expired():
result["err_info"] = '证书已经过期'
return False, result
with open(self.my_local_key + '.bak', 'wb+') as f:
f.write(dump_privatekey(FILETYPE_PEM, p12.get_privatekey()))
with open(self.app_dev_pem + '.bak', 'wb+') as f:
f.write(dump_certificate(FILETYPE_PEM, cert))
return True, cert.get_version()
except Exception as e:
for file in [self.app_dev_p12, self.app_dev_p12 + '.pwd', self.my_local_key, self.app_dev_pem]:
if os.path.exists(file + '.bak'):
os.remove(file + '.bak')
result["err_info"] = e
if 'mac verify failure' in str(e):
result["err_info"] = 'p12 导入密码错误，请检查'
return False, result