Skip to content

Instantly share code, notes, and snippets.

@willard1218

willard1218/few.md

Last active June 21, 2018 09:42
Show Gist options
  • Save willard1218/83eed91249f65b8cfe94e6c329847e85 to your computer and use it in GitHub Desktop.
Save willard1218/83eed91249f65b8cfe94e6c329847e85 to your computer and use it in GitHub Desktop.
Download ZIP
fewfw
Raw
few.md

https步驟

  1. 先將 MyEThttp.cpp::103 改成 http，點綠色按鈕跑一次， 再打開瀏覽器輸入 網址 http://localhost:50175，看到網頁就代表server跑起來了。 網頁內容目前是寫在 MyEThttp.cpp::103 ，是靜態的，單純測試用。

  2. 建立 self-signed 憑證

使用系統管理員身份 打開 PowerShell，　　 輸入指令 New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -FriendlyName "TestCert" -NotAfter (Get-Date).AddYears(10) -Subject "localhost" -DnsName "localhost"

CertStoreLocation: 憑證的存放位置，是存在 "開始" -> "搜尋" -> 輸入　mmc -> 檔案 -> 新增/移除嵌入管理單元 -> 選最下方的憑證 -> 會有兩個

  1. 如果這邊打 "LocalMachine" 就對應到 "憑證 - 目前使用者"
  2. 如果這邊打 "CurrentUser" 是對應到 mmc 裡面的 "憑證 - 目前使用者"

然後第二層　My　是對應到 "個人" 資料夾

所有可能的值的列表：　　　 https://msdn.microsoft.com/zh-tw/library/system.security.cryptography.x509certificates.storename(v=vs.110).aspx

這部分是參考　　 https://www.oshyn.com/blogs/2017/november/how-to-create-self-signed-certificates-in-windows-10 New-SelfSignedCertificate 的詳細介紹　　 https://docs.microsoft.com/en-us/powershell/module/pkiclient/new-selfsignedcertificate?view=win10-ps

  1. 設定憑證到 50175 port 使用系統管理員身份打開 cmd，
    輸入指令　　 netsh http add sslcert ipport=0.0.0.0:50175 certhash=69623CBB15D16A7FC3B73AAE3FB016ECB3B1EF60 appid={6FE593E9-45CF-42E7-88D5-DBFAED4516EB} clientcertnegotiation=enable

certhash : 是上個步驟憑證產生的指紋(Thumbprint)
appid : 是 application id，我也不知道要怎麼拿到

netsh 這指令用法我是參考 https://social.msdn.microsoft.com/Forums/en-US/b00f06e5-f719-435c-b06c-b591d0c07879/using-microsoft-http-server-api-to-create-https-server-application-problem-with-enabling-ssl

更詳細的說明 https://docs.microsoft.com/zh-tw/dotnet/framework/wcf/feature-details/how-to-configure-a-port-with-an-ssl-certificate

  1. 設定信任剛剛建立的憑證　// 這部分我也不知道要不要做

按開始，輸入 mmc -> 檔案 -> 新增/移除嵌入管理單元 -> 選最下方的憑證 -> 選本機電腦的 下一步，開始找剛剛建立的憑證，拉到 受信任的根憑證授權單，然後右鍵匯出，到 chrome 匯入憑證 詳細說明在這網站的 Step1, 2 https://www.sslsupportdesk.com/how-to-enable-or-disable-all-puposes-of-root-certificates-in-mmc/

基本上就是先找到憑證，在拖曳到 Trusted Root Certification Authorities (不需要import，因為已經產生了)

  1. MyEThttp.cpp::136 是要改成 第2步產生的指紋，MyEThttp.cpp::140 是第3步的appid， 把第1步的網址改成https，跑起來後輸入 https://localhost:50175 ，這時應該就不行了

// willard add 之間的程式碼 都是為了ssl新加的，是參考以下網址 https://stackoverflow.com/questions/46039203/windows-http-server-api-https-server https://stackoverflow.com/questions/7464860/ssl-with-winhttp https://stackoverflow.com/questions/10638272/microsoft-http-server-api-using-ssl-how-to-demand-client-certificate

補充

New-SelfSignedCertificate 指令

如果 -CertStoreLocation "cert:CurrentUser\Root" 裡面的 "CurrentUser" 是對應到 mmc 裡面的 "憑證 - 目前使用者"

另外一個則是 "cert:LocalMachine\Root" 裡面的 "LocalMachine" 是對應到 mmc 裡面的 "憑證 - 本機電腦"

然後 "Root" 是對應到 受信任的根憑證授權單位 所有可能的值是

Certificate store names are as follows (source):

AddressBook: Certificate store for other people and resources.
AuthRoot: Certificate store for third-party certification authorities (CAs).
CertificationAuthority: Certificate store for intermediate certification authorities (CAs).
Disallowed: Certificate store for certificates that have been revoked so they aren't forgotten.
My: Certificate store for your personal certificates that you use and is where most custom certificates.
Root: Certificate store for certificate authorities (CA) that you trust.
TrustedPeople: Certificate store for other people and resources that you trust.
TrustedPublisher: Certificate store for application publishers that you trust.

所有可能的值是

文件 : https://msdn.microsoft.com/zh-tw/library/system.security.cryptography.x509certificates.storename(v=vs.110).aspx

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment