1、创建私钥:
openssl genrsa -out private.pem 1024 //密钥长度,1024觉得不够安全的话可以用2048,但是代价也相应增大
2、创建公钥:
//为方便测试,还是需要公钥的。正常情况下,拿到证书就可以了
openssl rsa -in private.pem -pubout -out public.pem
3、创建证书请求:
//使用私钥生成一个证书请求,证书请求提交到CA认证中心后会得到一份证书,当然,测试用时,就不必提交CA认证中心(收费)
openssl req -new -out cert.csr -key private.pem
4、自签署根证书:
//自签署,就是不通过CA认证中心自行进行证书签名,这里用是x509
openssl x509 -req -in cert.csr -out public.der -outform der -signkey private.pem -days 3650 //10年有效
格式转换:(证书、私钥、公钥)(PEM DER)
openssl x509 -in ca-cert.pem -inform PEM -out ca-cert.der -outform DER
openssl rsa -in ca-key.pem -inform PEM -out ca-key.der -outform DER
openssl rsa -pubin -in pub-key.pem -inform PEM -pubout -out pub-key.der -outform DER
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
创建私钥RSA
openssl genrsa -out private_key.pem 1024
创建证书请求文件
openssl req -new -key private_key.pem -out rsaCertReq.csr
创建crt证书
openssl x509 -req -days 3650 -in rsaCertReq.csr -signkey private_key.pem -out rsaCert.crt
创建公共秘钥der
openssl x509 -outform der -in rsaCert.crt -out public_key.der
或者pem
openssl rsa -in private_key.pem -pubout -out public_key.pem
创建p12证书
openssl pkcs12 -export -out private_key.p12 -inkey private_key.pem -in rsaCert.crt
创建android使用的公共秘钥
openssl rsa -in private_key.pem -out rsa_public_key.pem -pubout
创建android使用的私钥
openssl pkcs8 -topk8 -in private_key.pem -out pkcs8_private_key.pem -nocrypt
openssl pkcs8 -topk8 -inform PEM -in private_key.pem -outform PEM -nocrypt -out private_key_pkcs8.pem
// 反过来直接去除pkcs8, onvert pkcs8 to pkcs#1 private key
openssl pkcs8 -in pkcs8_private_key.pem -out private_key_ios.pem -nocrypt
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
生成RSA私钥
openssl genrsa -out rsa_private_key.pem 1024
将RSA私钥转换成PKCS8格式,然后在命令行模式下复制到txt文件,供最后解密使用,以下二选一即可(服务端使用pem私钥解密)
openssl pkcs8 -topk8 -inform PEM -in rsa_private_key.pem -outform PEM -nocrypt
openssl pkcs8 -topk8 -inform PEM -in rsa_private_key.pem -outform PEM -out rsa_private_key_pkcs8.pem -nocrypt
生成RSA pem格式公钥(Android使用pem公钥加密)
openssl rsa -in rsa_private_key.pem -pubout -out rsa_public_key.pem
根据私钥(注:或者是pkcs8编码下的pem,即2(2))生成csr文件,这里面会输入相关地址及公司密码等信息
openssl req -new -key rsa_private_key.pem -out company.csr
openssl req -new -key rsa_private_key_pkcs8.pem -out company.csr
根据私钥(注:或者是2(2))以及csr文件生成一个10年有效期的der格式公钥(IOS使用der公钥加密)
openssl x509 -req -in company.csr -out rsa_public_key.der -outform der -signkey rsa_private_key.pem -days 3650
p12证书文本化
openssl pkcs12 -in private_key.p12 -out private_key.txt
屏幕模式显式:(证书、私钥、公钥)
openssl x509 -in private_key.pem -noout -text -modulus
openssl rsa -in private_key.pem -noout -text -modulus
openssl rsa -in public_key.pem -noout -text -modulus
读取证书的内容,显示在屏幕上
openssl x509 -in server.cer -noout -subject -nameopt RFC2253
将der格式的证书转成pem格式
openssl x509 -inform PEM -outform DER -in server.der -out server.pem
convert pkcs8 to pkcs#1 private key
---------------pkcs#1----------------
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQC9XrJWcWbj0LhDBzN4uwEOLA/UJKmCkkbvlVgN/qei3e/jVFpx
R6D3fzshnv5QNB4+BJ/rjRWbbxCJ0djzPxsLS1dJ+bDwagZWZ9hNXARTq4K0uxw6
Ol5jGD9Od6w5n5uxyaEk9/edvYwMhthIxC/uADRp2pNSutwyLX3bUJnHZwIDAQAB
AoGANN3S+7788my6hDvmarYKPWKfqKHzkLg1hX0z7/Q/6H/9EIHkHevZTD8AywoQ
BWQHbVjtLF1ewt3myBMFdiMP8UOx0WVErcyuVRh8AUcRZIEwz73jmLmpRd8fVAzy
8uoijKvExt/fdu9aIfVmV4nXvL5dDpsoL/mVRDgNCZ+9mMECQQDzWLnqty25mgEs
73rJ8mhehifwblg44uO+9xpmKZhG3NFZW+beG1iPZklBVlaQ6m53e77VbVotC+LF
efsaOtU7AkEAxzd3q0REhF/FaFcq9TV3Eu3C4B/aqARKgkpJKiaCC4tnAqny7Rvd
/anxLBf8DFPYjPMkPrNqXoDA8rAC9TwDxQJBAPF6mHOMdvl5E7WNp6GCxYMXScbT
GQTKUgoMl8vNdujK84vjIMRDCqyyaftGO/zuRdSXnZWZQCT3aH9iPoWW4EUCQB1r
NYLXK/8YXYCRDsjzQkhLUDHkwld5er9O1QsicKXfyjB8hGE7ckbZZ8IJMLFpWFtI
NJwFxrl57gRotacdW7kCP2r3MkJqtHdrjUbaCJJCnHmX9BhYcBhaYS2yGFW9uyNT
5TGOrrzjz+CXBNrif3JkDbDYv2z/cCgd7kqV1kPl/g==
-----END RSA PRIVATE KEY-----
------------------------------------
-------------pkcs8------------------
-----BEGIN PRIVATE KEY-----
MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAL1eslZxZuPQuEMH
M3i7AQ4sD9QkqYKSRu+VWA3+p6Ld7+NUWnFHoPd/OyGe/lA0Hj4En+uNFZtvEInR
2PM/GwtLV0n5sPBqBlZn2E1cBFOrgrS7HDo6XmMYP053rDmfm7HJoST39529jAyG
2EjEL+4ANGnak1K63DItfdtQmcdnAgMBAAECgYA03dL7vvzybLqEO+Zqtgo9Yp+o
ofOQuDWFfTPv9D/of/0QgeQd69lMPwDLChAFZAdtWO0sXV7C3ebIEwV2Iw/xQ7HR
ZUStzK5VGHwBRxFkgTDPveOYualF3x9UDPLy6iKMq8TG399271oh9WZXide8vl0O
mygv+ZVEOA0Jn72YwQJBAPNYueq3LbmaASzvesnyaF6GJ/BuWDji4773GmYpmEbc
0Vlb5t4bWI9mSUFWVpDqbnd7vtVtWi0L4sV5+xo61TsCQQDHN3erRESEX8VoVyr1
NXcS7cLgH9qoBEqCSkkqJoILi2cCqfLtG939qfEsF/wMU9iM8yQ+s2pegMDysAL1
PAPFAkEA8XqYc4x2+XkTtY2noYLFgxdJxtMZBMpSCgyXy8126Mrzi+MgxEMKrLJp
+0Y7/O5F1JedlZlAJPdof2I+hZbgRQJAHWs1gtcr/xhdgJEOyPNCSEtQMeTCV3l6
v07VCyJwpd/KMHyEYTtyRtlnwgkwsWlYW0g0nAXGuXnuBGi1px1buQI/avcyQmq0
d2uNRtoIkkKceZf0GFhwGFphLbIYVb27I1PlMY6uvOPP4JcE2uJ/cmQNsNi/bP9w
KB3uSpXWQ+X+
-----END PRIVATE KEY-----