Device : EP1C3T144C8
Timing Models : Final
Total logic elements : 412 / 2,910 ( 14 % )
Total pins : 46 / 104 ( 44 % )
Total virtual pins : 0
Total memory bits : 20,510 / 59,904 ( 34 % )
Total PLLs : 0 / 1 ( 0 % )

openssl req -x509 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -days 365

#!/bin/bash -xe

export OPENSSL_CONF=cnf

a="$1"
shift || true
n="$1"
o="$2"

cd "`dirname $0`"
umask 0007

case "$a" in
  gen)
    test -n "$n"
    openssl genrsa 2048 >private/$n

    cp "$OPENSSL_CONF"{,.tmp}
    export OPENSSL_CONF="$OPENSSL_CONF.tmp"
    echo '[ alt_names ]' >> "$OPENSSL_CONF"
    cnt=1
    while (( "$#" )); do
        echo "DNS.$cnt = $1" >> "$OPENSSL_CONF"
        (( cnt++ ))
        shift
    done
    
    openssl req -new -key private/$n -subj "/C=RU/ST=Belgorod/O=IVTBSU/OU=CA/CN=$n" >csr.$n
    openssl req -text -noout <csr.$n
    openssl ca -batch -notext -extensions server -in csr.$n >cert/$n
    rm csr.$n
  ;;
  genca)
    mkdir ca cert private dh || true
    openssl genrsa 4096 >ca/key
    openssl req -new -key ca/key -subj "/C=RU/ST=Belgorod/O=IVTBSU/OU=CA/CN=ivt.su" >ca/csr
    openssl x509 -req -days 10000 -in ca/csr -signkey ca/key >ca/crt
    rm ca/csr
    echo 100001 >ca/srl
    echo 100001 >ca/crlnum
    touch ca/index
    openssl ca -gencrl >ca/crl
  ;;
  gendh)
    test -r cert/$n
    openssl dhparam -in cert/$n 1024 >dh/$n
  ;;
  revoke)
    test -r cert/$n
    openssl ca -revoke cert/$n
    openssl ca -gencrl >ca/crl
    rm cert/$n private/$n
  ;;
  public)
    openssl rsa -in cert/$n -pubout
  ;;
  info)
    openssl x509 -in cert/$n -text
  ;;
  chown)
    test -n "$o"
    for i in dh cert private; do
      test -r "$i/$n" || continue
      chmod 0400 "$i/$n"
      chown $o:wheel "$i/$n"
    done  
  ;;
  *)
    echo "Usage: $0 "
    exit 1
  ;;
esac

[ ca ]
default_ca = myca

[ crl_ext ]
# issuerAltName=issuer:copy  #this would copy the issuer name to altname
authorityKeyIdentifier = keyid:always

[ myca ]
dir              = ./ca
new_certs_dir    = $dir
unique_subject   = no
certificate      = $dir/crt
database         = $dir/index
private_key      = $dir/key
serial           = $dir/srl
default_days     = 730
default_md       = sha256
policy           = myca_policy
x509_extensions  = myca_extensions
crlnumber        = $dir/crlnum
default_crl_days = 730

[ myca_policy ]
commonName             = supplied
stateOrProvinceName    = supplied
countryName            = optional
emailAddress           = optional
organizationName       = supplied
organizationalUnitName = optional

[ myca_extensions ]
basicConstraints       = CA:false
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always
keyUsage               = digitalSignature,keyEncipherment
extendedKeyUsage       = serverAuth
crlDistributionPoints  = URI:http://CHANGE.ME/root.crl
nsComment              = "OpenSSL Generated Certificate"
subjectAltName         = @alt_names


[ req ]
default_md             = sha256
distinguished_name     = req_distinguished_name
#attributes            = req_attributes
x509_extensions        = v3_ca
req_extensions         = v3_req
[ v3_req ]
subjectAltName         = @alt_names
[ v3_ca ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints       = CA:true

[ req_distinguished_name ]
countryName                  = Country?
countryName_default          = RU
stateOrProvinceName          = State?
stateOrProvinceName_default  = Belgorod obl.
localityName                 = City?
localityName_default         = Belgorod
0.organizationName           = Organization?
0.organizationName_default   = Home
commonName                   = Domain?
commonName_default           = change.me
emailAddress                 = Email?
emailAddress_default         = ca@change.me

[ server ]
basicConstraints       = CA:FALSE
nsCertType             = server
nsComment              = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer:always
extendedKeyUsage       = serverAuth
keyUsage               = digitalSignature, keyEncipherment
subjectAltName         = @alt_names

[ client ]
basicConstraints       = CA:FALSE
nsComment              = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer:always
extendedKeyUsage       = clientAuth
keyUsage               = digitalSignature

 pkg install acme-tiny

# mkdir -p /var/www/le
# mkdir /etc/ssl/le
# cd /etc/ssl/le
# openssl genrsa 4096 >LE.key

#!/bin/sh -e

cd "$(dirname $0)"


isok() {
  name="$1"; domains="$4"
  test -r "$name.key" || return 1
  test -r "$name.crt" || return 1
  openssl x509 -in "$name.crt" -checkend 2592000 -noout || return 1
  f1="`mktemp`"; echo "$domains" |tr : '\n' |sort >"$f1"
  f2="`mktemp`"; openssl x509 -in "$name.crt" -text |egrep -m1 '^ +DNS:' |sed -e 's/ *DNS://g' |tr , '\n' |sort >"$f2"
  set +e
  diff -q "$f1" "$f2" >/dev/null
  ret=$?
  set -e
  rm "$f1" "$f2"
  test "$ret" = 0 || return 1
  return 0
}

upd() {
  name="$1"; group="$2"; service="$3"; domains="$4"
  echo "Generating $name..." >&2
  cnff="`mktemp`"
  test -r "$name.key" || openssl genrsa 4096 >"$name.key"
  cat /etc/ssl/openssl.cnf >"$cnff"
  echo "$domains" | awk -vRS=: 'BEGIN{printf "[SAN]\nsubjectAltName="}notfirst==1{printf ","}{printf "DNS:"$0; notfirst=1} ' >>"$cnff"
  openssl req -new -sha256 -key $name.key -subj "/" -reqexts SAN -config "$cnff" > "$name.csr"
  rm "$cnff"
  acme_tiny --account-key LE.key --csr "$name.csr" --acme-dir /var/www/le/ > "$name.crt"
  rm "$name.csr"
  curl -s https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem >> "$name.crt"
  cat "$name.crt" "$name.key" >"$name.pem"
  chgrp "$group" "$name.key" "$name.crt" "$name.pem"
  chmod o-rwx    "$name.key" "$name.crt" "$name.pem"
  test "$service" = '-' || service "$service" reload
}

cat << EOF |grep -v -e^# -e^$ |while read i; do isok $i || upd $i; done

# name    group    service    dns1.example.com:dns2.example.com
web       www      nginx      err200.net:www.err200.net:ftp.err200.net
imap      dovecot  dovecot    imap.err200.net:pop3.err200.net:pop.err200.net
irc       ircd     inspircd   irc.err200.net
EOF

@monthly /etc/ssl/le/upd.sh

listen 443 ssl http2;

add_header Strict-Transport-Security "max-age=31536000";

location ^~ /.well-known/acme-challenge/ {
    alias /var/www/le/;
    try_files $uri =404;
    auth_basic off;
}

include lessl.conf;

ssl_certificate /etc/ssl/le/web.crt;
ssl_certificate_key /etc/ssl/le/web.key;

proxy_redirect default;
proxy_redirect http:// $scheme://;

http-response replace-value Location http://(.*) https://\1 if { dst_port 443 }

define host {
    use                 generic-server
    host_name           my-server-1234
    address             1.2.3.4
}

define service {
    use                 service-ping
    host_name           my-server-1234
}

define service {
    use                 service-ssh
    host_name           my-server-1234
    _port               2222
}

define service {
    use                 service-tcp
    host_name           my-server-1234
    service_description SSH honeypot
    _port               22
}

define service {
    use                 service-users
    host_name           my-server-1234
}

... и ещё около сотни строк в таком же духе

add( my-server-1234, 1.2.3.4, (), (
    ( ping ),
    ( ssh, _port 2222 ),
    ( tcp, service_description SSH honeypot, _port 22 ),
    ( users ),
    ( procs ),
    ( mem ),
    ( load ),
    ( conns ),
    ( disk ),
    ( proc, service_description App servers, _warn 1:1, _crit 1:1, _proc java ),
    ( filelines, service_description App users, _file /var/db/app/usersdump.txt, _pattern Nobody online, _args -v ),
))

• После редактирования конфигурации необходимо не забывать запускать m4;
• Некоторые символы и слова требуют специального внимания т.к. могут быть интерпретированы в m4.

openssl_conf = openssl_def

[openssl_def]
engines = engine_section

[engine_section]
gost = gost_section

[gost_section]
engine_id = gost
dynamic_path = /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgost.so
default_algorithms = ALL
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet

wget http://cryptocom.ru/opensource/stunnel-4.55-cp2.diff
mkdir -p /opt/stunnel-gost/src/
cd /opt/stunnel-gost/src/
tar xzvf ~/stunnel-4.55.tar.gz
patch -p1 <~/stunnel-4.55-cp2.diff
./configure --prefix=/opt/stunnel-gost/
make install

diff -Nur -X - stunnel-4.55/src/ssl.c stunnel-gost/src/ssl.c
--- stunnel-4.55/src/ssl.c      2012-08-10 01:44:18.000000000 +0400
+++ stunnel-gost/src/ssl.c     2015-08-19 16:01:41.000000000 +0300
@@ -59,6 +59,9 @@
 }
 
 int ssl_configure(GLOBAL_OPTIONS *global) { /* configure global SSL settings */
+    OPENSSL_config(NULL);
+    OpenSSL_add_all_algorithms();
+    SSLeay_add_ssl_algorithms();
 #ifdef USE_FIPS
     if(FIPS_mode()!=global->option.fips) {
         RAND_set_rand_method(NULL); /* reset RAND methods */

foreground = yes
debug = 6
setuid = proxy
setgid = proxy
pid = /tmp/stunnel.pid

socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

verify = 3
cert = /opt/stunnel-gost/etc/stunnel/clientcert.pem
key = /opt/stunnel-gost/etc/stunnel/clientprivatekey.pem
CAfile = /opt/stunnel-gost/etc/stunnel/servercert.pem

[n1]
client = yes
accept  = 1443
connect = int223.zakupki.gov.ru:443
ciphers = GOST2001-GOST89-GOST89
TIMEOUTclose = 0

[n2]
client = yes
accept  = 1444
connect = intfz04.lanit.ru:443
ciphers = GOST2001-GOST89-GOST89
TIMEOUTclose = 0

start on runlevel [2345]
stop on runlevel [016]
respawn
respawn limit 10 5
setuid root
setgid root
chdir /opt/stunnel-gost
exec /opt/stunnel-gost/bin/stunnel /opt/stunnel-gost/etc/stunnel/stunnel.conf