Sertifikatlar va PKI

export LC_ALL=C TZ=UTC

# 1. Sertifikat markazining kaliti va o'zi-imzolangan sertifikati
openssl ecparam -name prime256v1 -genkey -noout -out ca.key 2>/dev/null
openssl req -x509 -new -key ca.key -sha256 -days 3650 \
  -subj "/C=UZ/O=Namuna Lab CA/CN=Namuna Ildiz CA" -out ca.crt 2>/dev/null

# 2. Server kaliti va sertifikat so'rovi (CSR)
openssl ecparam -name prime256v1 -genkey -noout -out srv.key 2>/dev/null
openssl req -new -key srv.key \
  -subj "/C=UZ/O=Namuna/CN=xizmat.namuna.uz" -out srv.csr 2>/dev/null

# 3. Kengaytmalar - qaysi domenlar va qanday maqsad uchun
cat > srv.ext <<'EXT'
subjectAltName=DNS:xizmat.namuna.uz,DNS:www.xizmat.namuna.uz
basicConstraints=critical,CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
EXT

# 4. Markaz so'rovni imzolaydi
openssl x509 -req -in srv.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -days 90 -sha256 -extfile srv.ext -out srv.crt 2>/dev/null

openssl x509 -in srv.crt -noout -subject -issuer

openssl x509 -in srv.crt -noout -ext subjectAltName
openssl x509 -in srv.crt -noout -ext keyUsage
openssl x509 -in srv.crt -noout -ext extendedKeyUsage
openssl x509 -in srv.crt -noout -ext basicConstraints

# 1. Zanjir to'g'rimi
openssl verify -CAfile ca.crt srv.crt

# 2. Domen mos keladimi
openssl verify -CAfile ca.crt -verify_hostname xizmat.namuna.uz srv.crt

# 3. Muddati o'tmaganmi
openssl x509 -in srv.crt -noout -checkend 0 >/dev/null \
  && echo "srv.crt: muddati amal qiladi" \
  || echo "srv.crt: muddati otgan"

# 1. Boshqa domen so'raymiz
openssl verify -CAfile ca.crt -verify_hostname boshqa.namuna.uz srv.crt 2>&1

# 2. Begona markazga ishonamiz
openssl ecparam -name prime256v1 -genkey -noout -out ca2.key 2>/dev/null
openssl req -x509 -new -key ca2.key -sha256 -days 3650 \
  -subj "/CN=Begona CA" -out ca2.crt 2>/dev/null

openssl verify -CAfile ca2.crt srv.crt 2>&1

# 3. Muddati o'tgan sertifikat yasaymiz
openssl x509 -req -in srv.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -not_before 20200101000000Z -not_after 20210101000000Z \
  -sha256 -extfile srv.ext -out eski.crt 2>/dev/null

openssl x509 -in eski.crt -noout -checkend 0 >/dev/null \
  && echo "eski.crt: amal qiladi" \
  || echo "eski.crt: MUDDATI OTGAN"

openssl verify -CAfile ca.crt eski.crt 2>&1

# Ildiz oraliq markazni imzolaydi
openssl ecparam -name prime256v1 -genkey -noout -out oraliq.key 2>/dev/null
openssl req -new -key oraliq.key -subj "/C=UZ/O=Namuna/CN=Namuna Oraliq CA"   -out oraliq.csr 2>/dev/null

cat > oraliq.ext <<'EXT'
basicConstraints=critical,CA:TRUE,pathlen:0
keyUsage=critical,keyCertSign,cRLSign
EXT

openssl x509 -req -in oraliq.csr -CA ca.crt -CAkey ca.key -CAcreateserial   -days 1825 -sha256 -extfile oraliq.ext -out oraliq.crt 2>/dev/null

# Oraliq markaz server sertifikatini imzolaydi
openssl x509 -req -in srv.csr -CA oraliq.crt -CAkey oraliq.key   -CAcreateserial -days 90 -sha256 -extfile srv.ext -out srv2.crt 2>/dev/null

echo "--- faqat ildiz bilan (oraliq yuborilmagan):"
openssl verify -CAfile ca.crt srv2.crt 2>&1

echo "--- oraliq bilan birga:"
openssl verify -CAfile ca.crt -untrusted oraliq.crt srv2.crt 2>&1

cat srv2.crt oraliq.crt > fullchain.pem

echo "--- fullchain ichida nechta sertifikat:"
grep -c "BEGIN CERTIFICATE" fullchain.pem

echo "--- har birining egasi va imzolovchisi:"
openssl crl2pkcs7 -nocrl -certfile fullchain.pem 2>/dev/null   | openssl pkcs7 -print_certs -noout 2>/dev/null

echo "Sertifikat muddatidan oldin bekor qilish usullari:"
echo
printf "%-12s %-32s %s\n" "USUL" "QANDAY ISHLAYDI" "MUAMMOSI"
printf "%-12s %-32s %s\n" "CRL" "bekor qilinganlar royxati" "katta, kech yangilanadi"
printf "%-12s %-32s %s\n" "OCSP" "har ulanishda sorov" "maxfiylik, kechikish"
printf "%-12s %-32s %s\n" "Stapling" "server javobni ozi keltiradi" "sozlash kerak"
printf "%-12s %-32s %s\n" "Qisqa muddat" "sertifikat tez eskiradi" "avtomatlashtirish shart"

cat > tekshir.php <<'PHP'
<?php
declare(strict_types=1);

$pem = file_get_contents('srv.crt');
$malumot = openssl_x509_parse($pem);

printf("subject CN:  %s\n", $malumot['subject']['CN']);
printf("issuer CN:   %s\n", $malumot['issuer']['CN']);
printf("SAN:         %s\n", $malumot['extensions']['subjectAltName']);
printf("CA mi:       %s\n", $malumot['extensions']['basicConstraints']);
printf("imzo algo:   %s\n", $malumot['signatureTypeSN']);

// Muddat tekshiruvi - vaqtga bog'liq, shuning uchun mantiqiy javob
$hozir = time();
$amal = $hozir >= $malumot['validFrom_time_t']
     && $hozir <= $malumot['validTo_time_t'];
printf("amal qiladi: %s\n", $amal ? 'ha' : 'yoq');
PHP

php tekshir.php