CENTOS6环境用GmSSL制作SM2国密证书，以期代替用RSA算法制作的SSL证书

# unzip master.zip

2、编译安装GmSSL

# ./config

# make

# make install

# ln -s /usr/local/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1

# ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1

3、检查GmSSL版本

# gmssl version -a

4、测试GmSSL加密

SM3 digest generation（哈希算法，类似MD5）

# echo -n "abc" | gmssl sm3

(stdin)= 66c7f0f462eeedd9d1f2d46bdc10e4e24167c4875cf2f7a2297da02b8f4ba8e0

SM4 encryptiona and decryption（对称算法，类似AES、3DES）

# gmssl sms4 -in README.md -out README.sms4

# gmssl sms4 -d -in README.sms4

SM2 private key generation（非对称算法，类似RSA）

# gmssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:sm2p256v1 -pkeyopt ec_param_enc:named_curve -out skey.pem

Derive the public key from the generated SM2 private key:

# gmssl pkey -pubout -in skey.pem -out vkey.pem

SM2 signature generation and verification:

# gmssl sm3 -binary README.md | gmssl pkeyutl -sign -pkeyopt ec_scheme:sm2 -inkey skey.pem -out README.md.sig

# gmssl sm3 -binary README.md | gmssl pkeyutl -verify -pkeyopt ec_scheme:sm2 -pubin -inkey vkey.pem -sigfile README.md.sig

# gmssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:sm2p256v1 -pkeyopt ec_param_enc:named_curve -out dkey.pem

# gmssl pkey -pubout -in dkey.pem -out ekey.pem

# echo "Top Secret" | gmssl pkeyutl -encrypt -pkeyopt ec_scheme:sm2 -pubin -inkey ekey.pem -out ciphertext.sm2

# gmssl pkeyutl -decrypt -pkeyopt ec_scheme:sm2 -inkey dkey.pem -in ciphertext.sm2

Self-signed SM2 certificate generation:

# gmssl req -new -x509 -key skey.pem -out cert.pem

# touch index.txt

# echo "01" > serial

2、将通过以下自签名生成的放到demoCA目录下，

放到demoCA/private

3、创建公私钥和证书请求：

# gmssl ecparam -genkey -name sm2p256v1 -out

# gmssl req -new -sm3 -key -out cacsr.pem

4、自签名

# gmssl req -x509 -sm3 -days 3650 -key -in cacsr.pem -out

# gmssl x509 -req -days 3650 -sm3 -in cacsr.pem -signkey -out

5、把pem转化成cer

# gmssl x509 -inform pem -in -outform der -out cacert.cer

6、ca签名（在demoCA的父目录下执行）

# gmssl ca -md sm3 -in client_csr.pem -out client_cert.pem -days 3650

7、显示证书信息：

# gmssl x509 -text -noout -in

# gmssl req -in cacsr.pem -noout -text

8、证书通信测试命令

SERVER:

# gmssl s_server -key server_key.pem -cert server_cert.pem -CAfile -cipher ECDHE-SM4-SM3 -verify 1

CLIENT:

# gmssl s_client -key client_key.pem -cert client_cert.pem -CAfile -cipher ECDHE-SM4-SM3 -verify 1