openssl自签发https证书

步骤：

# 生成CA私钥与CA证书
openssl genrsa -out cakey.pem 2048
openssl req -new -x509 -sha256  -key cakey.pem -out cacert.pem -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
# 生成服务端私钥与证书
openssl genrsa -out server.key 2048
openssl req -new -sha256 -key server.key -out server.csr -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
# CA为服务端证书签名
openssl x509 -req -sha256 -in server.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out server.crt
#查看证书命令
openssl x509 -noout -text -in server.crt

下面是一个完整的过程示例：

[root@server1 helloworld]# openssl genrsa -out cakey.pem 2048
Generating RSA private key, 2048 bit long modulus
...............+++
.............................+++
e is 65537 (0x10001)
[root@server1 helloworld]# openssl req -new -x509 -sha256  -key cakey.pem -out cacert.pem -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
[root@server1 helloworld]# openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................................+++
....................+++
e is 65537 (0x10001)
[root@server1 helloworld]# openssl req -new -sha256 -key server.key -out server.csr -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
[root@server1 helloworld]# openssl x509 -req -sha256 -in server.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out server.crt
Signature ok
subject=/C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
Getting CA Private Key
[root@server1 helloworld]# openssl x509 -noout -text -in server.crt

---

（END）