openssl生成证书

1. 生成CA私钥 ca.key

openssl genrsa -out ca.key 2048

2. 生成CA根证书（有效期10年）ca.crt

openssl req -x509 -new -key ca.key -days 3650 -out ca.crt -config ca.cnf

3. 创建服务器证书请求 server.csr

openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -config server.cnf

4. 用CA证书签发服务器证书 server.crt

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -extfile server.cnf -extensions v3_req

5. 生成PFX格式证书(包含私钥和证书)

openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -password pass:1122

6. ca.cnf

# android-ca.cnf - 专为安卓设计的CA证书配置
[req]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
default_bits = 2048
default_md = sha256

# 证书主体信息（根据您的需求修改）
[req_distinguished_name]
C = CN
ST = Beijing
L = Beijing
O = AA AAAAAAAAA
OU = AA AAAAAAAAA
CN = AA AAAAAAAAA  # 这是CA的显示名称

# 关键CA扩展设置（安卓必须的）
[v3_ca]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:TRUE
keyUsage = critical, digitalSignature, keyCertSign, cRLSign

7. server.cnf

# eq.cnf - 用于生成带SAN的自签名证书

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
req_extensions = v3_req
default_bits = 2048
default_md = sha256

[req_distinguished_name]
# 以下信息根据您的实际情况修改
countryName = CN
stateOrProvinceName = Beijing
localityName = Beijing
organizationName = AA AAAAAAAAA
organizationalUnitName = AA AAAAAAAAA
commonName = 192.168.1.9  # 主域名

[v3_req]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

# 在此处添加所有需要的主机名（域名或IP）
[alt_names]
# DNS.1 = localhost       # 主域名
IP.1 = 192.168.1.9         # 服务器IP地址（如果需要）