openssl生成证书

openssl生成证书

准备工作

• 根据openssl.cnf，新建相应目录结构

cd /etc/ssl
vim openssl.cnf
mkdir demoCA
cd demoCA
mkdir private crl certs newcerts
echo "01" > serial
touch index.txt

CA 根证书

• 生成CA根证书私钥

openssl genrsa -out private/cakey.pem 2048

• 生成CA根证书

openssl req -new -x509 -key private/cakey.pem  -out cacert.pem -subj "/C=CN/ST=GD/L=SZ/O=david/OU=dev/CN=david2code.com/emailAddress=lushanbest@126.com"

SSL 服务器证书

• 生成服务器证书私钥

openssl genrsa -out private/server.key 2048

• 生成服务器证书请求文件

openssl req -new -key private/server.key -out crl/server.csr  -subj "/C=CN/ST=GD/L=SZ/O=david/OU=dev/CN=david2code.com/emailAddress=lushanbest@126.com"

• 签署服务器证书

cd ..
openssl ca -in demoCA/crl/server.csr -out demoCA/certs/server.crt

SSL 客户端证书

openssl genrsa -out private/client.key 2048
openssl req -new -key private/client.key -out crl/client.csr  -subj "/C=CN/ST=GD/L=SZ/O=david/OU=dev/CN=client.com/emailAddress=lushanbest@126.com"

cd ..
openssl ca -in demoCA/crl/client.csr -out demoCA/certs/client.crt

windows下生成证书

http://slproweb.com/download/Win64OpenSSL_Light-3_0_1.exe
安装后，就可以在命令行执行命令生成证书。跟Linux中差不多