4.1 带证书的成功调用使用client.crt /client.key这一套客户端证书来调用服务器端。

#--cert指定客户端公钥证书的路径

#--key指定客户端私钥文件的路径

#-k 使用本参数不校验证书的合法性，因为我们用的是自签名证书

#可以使用-v来观察具体的SSL握手过程

curl --cert ./client.crt --key ./client.key https://integration-fred2.fredhuang.com -k -v

* Rebuilt URL to: https://47.93.XX.XX/

* Trying 47.93.XX.XX...

* TCP_NODELAY set

* Connected to 47.93.XX.XX (47.93.XX.XX) port 443 (#0)

* ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

* CAfile: /etc/ssl/cert.pem

CApath: none

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS handshake, Server key exchange (12):

* TLSv1.2 (IN), TLS handshake, Request CERT (13):

* TLSv1.2 (IN), TLS handshake, Server finished (14):

* TLSv1.2 (OUT), TLS handshake, Certificate (11):

* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

* TLSv1.2 (OUT), TLS handshake, CERT verify (15):

* TLSv1.2 (OUT), TLS change cipher, Client hello (1):

* TLSv1.2 (OUT), TLS handshake, Finished (20):

* TLSv1.2 (IN), TLS change cipher, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Finished (20):

* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384

* ALPN, server accepted to use http/1.1

* Server certificate:

* subject: C=CN; ST=BJ; L=BJ; O=Alibaba; OU=Test; CN=integration-fred2.fredhuang.com; emailAddress=a@alibaba.com

* start date: Nov 2 01:01:34 2019 GMT

* expire date: Oct 30 01:01:34 2029 GMT

* issuer: C=CN; ST=BJ; L=BJ; O=Alibaba; OU=Test; CN=root; emailAddress=a@alibaba.com

* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

> GET / HTTP/1.1

> host:integration-fred2.fredhuang.com

> User-Agent: curl/7.54.0

> Accept: */*

>

< HTTP/1.1 200 OK

< Server: nginx/1.17.5

< Date: Sat, 02 Nov 2019 02:39:43 GMT

< Content-Type: text/html

< Content-Length: 612

< Last-Modified: Wed, 30 Oct 2019 11:29:45 GMT

< Connection: keep-alive

< ETag: "5db97429-264"

< Accept-Ranges: bytes

<

Welcome to nginx!

If you see this page, the nginx web server is successfully installed and

working. Further configuration is required.

For online documentation and support please refer to

nginx.org.

Commercial support is available at

nginx.com.

Thank you for using nginx.

* Connection #0 to host 47.93.XX.XX left intact使用client2.crt / client2.key这一套客户端证书来调用服务器端。

curl --cert ./client2.crt --key ./client2.key https://integration-fred2.fredhuang.com -k

Welcome to nginx!

If you see this page, the nginx web server is successfully installed and

working. Further configuration is required.

For online documentation and support please refer to

nginx.org.

Commercial support is available at

nginx.com.

Thank you for using nginx.