openssl创建自签名SSL证书

# 生成根证书
# 1.生成ca秘钥，得到ca.key
openssl genrsa -out ca.key 4096
# 2.生成ca证书签发请求，得到ca.csr
openssl req -new -key ca.key -out ca.csr -subj "/C=CN/ST=JiangSu/L=NanJing/O=jiyang/OU=RDC/CN=ca.test.com"
# 3、生成ca根证书，得到ca.crt
openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt

# 生成服务端证书
# 1.生成秘钥，得到server.Key
openssl genrsa -out server.key 2048
# 2.服务端CSR
openssl req -new -sha256 -out server.csr -key server.key -subj "/C=CN/ST=JiangSu/L=NanJing/O=example/OU=RDC/CN=192.168.75.128"
# 3.添加扩展信息
echo "subjectAltName=DNS:192.168.75.128,IP:192.168.75.128" > cert_extensions
# 4.用CA证书生成终端用户证书，得到server.crt
openssl x509 -req -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt -extfile cert_extensions