# dmssl_v2

**Repository Path**: zklall/dmssl_v2

## Basic Information

- **Project Name**: dmssl_v2
- **Description**: 快速生成可供达梦使用的ssl证书，基于qsl版本二次开发，增加支持生成ssl等级3以上的证书
- **Primary Language**: Unknown
- **License**: Apache-2.0
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2025-12-12
- **Last Updated**: 2025-12-12

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# Dameng SSL Tool (dmssl)

A command-line tool for generating SSL certificates for Dameng database, with configurable security levels.

## Features

- Generate CA certificates with configurable security levels
- Generate server-side SSL certificates
- Generate client-side SSL certificates for individual users
- Batch generate client SSL certificates
- Initialize system user SSL certificates (SYSDBA, SYSDBO, SYSSSO, SYSAUDITOR)
- View certificate information
- Verify certificate and private key pairs
- Clear generated files and directories
- Reset keystore passwords
- Configurable security levels (1-5)

## Installation

1. Ensure you have OpenSSL and keytool installed
2. Clone or download the dmssl tool to your desired directory
3. Make the script executable:
   ```bash
   chmod +x dmssl.sh
   ```

## Configuration

Edit the `dmssl.config` file to set your default parameters:

```ini
# Global password for all keys and keystores
GLOBAL_PASSWORD=dameng

# CA certificate validity period in days
CERT_DAYS=3650

# CA certificate subject information
CA_SUBJ=/C=CN/ST=BJ/L=Beijing/O=dameng/OU=tech/CN=tech/emailAddress=admin@dmssl.com

# Server certificate subject information
SERVER_SUBJ=/C=CN/ST=BJ/L=Beijing/O=dameng/OU=tech/CN=tech/emailAddress=admin@dmssl.com

# Client certificate subject template
CLIENT_SUBJ=/C=CN/ST=BJ/L=Beijing/O=dameng/OU=tech/CN=${cn}/emailAddress=admin@dmssl.com

# Default client names for batch generation
CLIENT_NAMES=USER1,USER2,USER3

# Debug flag (1=enable, 0=disable)
DEBUG_FLAG=1

# Security level (1-5), higher level means stronger security
# Level 1: RSA 2048, SHA-256
# Level 2: RSA 3072, SHA-384  
# Level 3: RSA 4096, SHA-512
# Level 4: RSA 4096, SHA-512 + stronger parameters
# Level 5: RSA 8192, SHA-512 + strongest parameters
SECURITY_LEVEL=3
```

## Usage

### Initialize OpenSSL Environment
```bash
sh dmssl.sh init
```

### Generate CA Certificate
```bash
sh dmssl.sh ca-cert [key_pass] [subj] [days] [security_level]
```

### Generate Server SSL Certificate
```bash
sh dmssl.sh server [key_pass] [config_file] [security_level]
```

### Generate Client SSL Certificate
```bash
sh dmssl.sh client [CN] [key_pass] [deststorepass] [srcstorepass] [config_file] [security_level]
```

### Generate Multiple Client SSL Certificates
```bash
sh dmssl.sh client-batch [NAMES] [security_level]
```

### Initialize System User SSL Certificates
```bash
sh dmssl.sh init-sysuser [key_pass] [deststorepass] [srcstorepass]
```

### View Certificate Information
```bash
sh dmssl.sh show-cert [cert_path]
```

### Verify Certificate and Private Key Pair
```bash
sh dmssl.sh veri-key-pair [cert_path] [key_path] [key_pass]
```

### Clear Generated Environment
```bash
sh dmssl.sh clear-env
```

### Clear Specific Client SSL Files
```bash
sh dmssl.sh clear-user [CN]
```

### Reset Keystore Password
```bash
sh dmssl.sh reset-keypass [keystore_file] [old_pass] [new_pass]
```

### Show Keystore Information
```bash
sh dmssl.sh show-keystore [keystore_file] [-v]
```

## Security Levels

The tool supports 5 security levels, with higher levels providing stronger security:

| Level | Key Size | Hash Algorithm | Additional Parameters |
|-------|----------|----------------|-----------------------|
| 1     | 2048     | SHA-256        | Basic parameters      |
| 2     | 3072     | SHA-384        | Basic parameters      |
| 3     | 4096     | SHA-512        | Basic parameters      |
| 4     | 4096     | SHA-512        | Stronger parameters   |
| 5     | 8192     | SHA-512        | Strongest parameters  |

## Examples

### Generate CA Certificate with Security Level 5
```bash
sh dmssl.sh ca-cert dameng "/C=CN/ST=BJ/L=Beijing/O=dameng/OU=tech/CN=root" 3650 5
```

### Generate Server SSL with Security Level 4
```bash
sh dmssl.sh server dameng ./openssl.cnf 4
```

### Generate Client SSL for User TESTUSER
```bash
sh dmssl.sh client TESTUSER dameng dameng dameng ./openssl.cnf 3
```

### Generate Multiple Client Certificates
```bash
sh dmssl.sh client-batch USER1,USER2,USER3 5
```

### Initialize System Users with Default Security Level
```bash
sh dmssl.sh init-sysuser
```

## Directory Structure

```
dmssl/
├── dmssl.sh              # Main script
├── dmssl.config          # Configuration file
├── openssl.cnf           # OpenSSL configuration file
├── ca-cert.pem           # Generated CA certificate
├── ca-key.pem            # Generated CA private key
├── server_ssl/           # Server SSL files
│   ├── ca-cert.pem
│   ├── server-cert.pem
│   ├── server-key.pem
│   └── server.cer
├── client_ssl/           # Client SSL files
│   ├── USER1/           # Individual client directories
│   └── USER2/
├── DMSSLBak/            # Backup directory
└── doc/                 # Documentation
```

## Requirements

- OpenSSL 1.1.1+ (for RSA 8192 support)
- keytool (part of Java JDK)
- Bash shell

## Notes

- Always keep your private keys secure
- The default password for all keys and keystores is "dameng" (set in dmssl.config)
- Certificate generation with higher security levels (4-5) may take longer due to larger key sizes
- The tool will create a backup of all generated files before clearing the environment

## License

[Add your license information here]