自签泛域名或多域名SSL证书

泛域名

自签泛域名SSL证书，使用openssl命令如下：

# 生成CA Key证书
openssl genrsa 2048 > ca-key.pem

# 生成CA Cert证书
openssl req -new -x509 -nodes -days 3650 -key ca-key.pem -out ca-cert.pem -subj=/C=CN/ST=Beijing/L=Beijing/O=ExampleO/OU=ExampleOU/CN=ExampleRootCA/emailAddress=admin@example.com

# 生成server证书签发请求和server private key证书；在此命令中修改CN（Common Name）用来创建域名证书请求
openssl req -newkey rsa:2048 -nodes -days 3650 -keyout server-key.pem -out server-req.pem -subj=/C=CN/ST=Beijing/L=Beijing/O=ExampleO/OU=ExampleOU/CN=*.example.com/emailAddress=admin@example.com

# 签发server证书请求，生成server cert证书；注意修改subjectAltName的值
openssl x509 -req -extfile <(printf "subjectAltName=DNS:*.example.com") -days 3650 -CAcreateserial -in server-req.pem -out server-cert.pem -CA ca-cert.pem -CAkey ca-key.pem

多域名

自签多域名SSL证书，使用openssl命令如下：

# 生成CA Key证书
openssl genrsa 2048 > ca-key.pem

# 生成CA Cert证书
openssl req -new -x509 -nodes -days 3650 -key ca-key.pem -out ca-cert.pem -subj=/C=CN/ST=Beijing/L=Beijing/O=ExampleOrganization/OU=ExampleOU/CN=ExampleRootCA/emailAddress=admin@example-domain.com

# 生成server证书签发请求和server private key证书；在此命令中填写多个CN（Common Name）用来创建多域名证书请求
openssl req -newkey rsa:2048 -nodes -days 3650 -keyout server-key.pem -out server-req.pem -subj=/C=CN/ST=Beijing/L=Beijing/O=ExampleOrganization/OU=ExampleOU/CN=*.example-domain.cn/CN=*.example-domain.com/emailAddress=admin@example-domain.com

# 签发server证书请求，生成server cert证书；注意修改subjectAltName的值，添加或减少多域名
openssl x509 -req -extfile <(printf "subjectAltName=DNS:*.example-domain.cn,DNS:*.example-domain.com") -days 3650 -CAcreateserial -in server-req.pem -out server-cert.pem -CA ca-cert.pem -CAkey ca-key.pem