Guomi SM2 SSL Certificate Nginx Installation Guide Linux Version

Published: 2023-09-20

1. Guomi certificate 4 certificate files

2. Guomi certificate 2 certificate files

I. Obtain Guomi certificate (4-certificate Guomi configuration method signature + encryption)

1. After you complete the process of applying for a West GDCA server certificate, downloading the certificate will obtain a certificate package, as follows:

*.***.com_sign.crt: Signing certificate

*.***.com_sign.key: Signing certificate private key

*.***.com_encrypt.crt: Encryption certificate

*.***.com_encryptKeyData.txt: Content is the encrypted private key fragment of the encryption certificate

2. Decrypt the encryption certificate

Online decryption: https://myssl.com/key_encryption_decryption.html#tc_cert

The signing private key corresponds to the key in the downloaded certificate (three files).

Create the *.**.com_encrypt.key file and fill in the obtained decrypted certificate private key content.

II. Deploy Guomi nginx

Guomi OpenSSL and Guomi Nginx

gmssl_openssl_1.1_bxx.tar.gz

Seamless nginx Guomi transformation, supports nginx1.6+

Compilation and deployment (taking nginx-1.18.0 as an example)

1) Download wget http://download.myhostadmin.net/gmssl/gmssl_openssl_1.1_b8.tar.gz to /root/xxxxxxxx
(Alternate download address:http://downinfo.myhostadmin.net/gmssl/gmssl_openssl_1.1_b8.tar.gz)

2) Extract tar xzfm gmssl_openssl_1.1_b8.tar.gz -C /usr/local
3) Download wget http://download.myhostadmin.net/gmssl/nginx-1.18.0.zip to /root/

(Alternate download address:http://downinfo.myhostadmin.net/gmssl/nginx-1.18.0.zip)

4) Extract unzip nginx-1.18.0.zip

Note: You may need to use yum install pcre-devel to install pcre-devel

5) Enter directory cd /root/nginx-1.18.0

6) Compile configuration

./configure \
--without-http_gzip_module \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-http_v2_module \
--with-file-aio \
--with-openssl="/usr/local/gmssl" \
--with-cc-opt="-I/usr/local/gmssl/include" \
--with-ld-opt="-lm"

7) Compile and install
make install
8) /usr/local/nginx is the generated nginx directory

9) After compilation and installation is complete, cd into the /usr/local/nginx/sbin directory and use the ./nginx -t command to check whether it is normal, as follows:

Configuration example (Guomi one-way, 4 certificates, signature + encryption)

*.***.com_sign.crt: Signing certificate

*.***.com_sign.key: Signing certificate private key

*.***.com_encrypt.crt: Encryption certificate

*.***.com_encrypt.key : Encryption certificate private key

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;
  ssl_verify_client off;

  ssl_certificate /usr/local/nginx/conf/*.***.com_sign.crt;
  ssl_certificate_key /usr/local/nginx/conf/*.***.com_sign.key;

  ssl_certificate /usr/local/nginx/conf/*.***.com_encrypt.crt;
  ssl_certificate_key /usr/local/nginx/conf/*.***.com_encrypt.key;

  location /
  {
    root html;
    index index.html index.htm;
  }
}

Configuration example (Guomi one-way, 2 certificates, only signing certificate)

Only the first item needs to be configured

Configuration example (Guomi/RSA one-way adaptive)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;
  ssl_verify_client off;

  ssl_certificate /usr/local/nginx/conf/*.***.com.crt;
  ssl_certificate_key /usr/local/nginx/conf/*.***.com.key;

ssl_certificate /usr/local/nginx/conf/*.***.com_sign.crt;
  ssl_certificate_key /usr/local/nginx/conf/*.***.com_sign.key;

  ssl_certificate /usr/local/nginx/conf/*.***.com_encrypt.crt;
  ssl_certificate_key /usr/local/nginx/conf/*.***.com_encrypt.key;  location /
  {
    root html;
    index index.html index.htm;
  }
}

Test whether the configuration is correct /usr/local/nginx/sbin/nginx -t

Start /usr/local/nginx/sbin/nginx

III. Access test

1. 360 Enterprise Browser settings. Open the browser and click the button in the upper right corner -> "Options" -> "Security Settings". Ensure that the "Guomi communication protocol" section is checked

"Enable Guomi SSL protocol support" checkbox, as follows:

Access effect example: