CA 证书自签证-域名版本-nginx

douchunrong

于 2023-12-05 17:16:55 发布

阅读量103

点赞数

文章标签： nginx 运维

本文链接：https://blog.csdn.net/douchunrong/article/details/134812529

版权

文章介绍了在CenOS7环境中使用openssl创建自签名CA证书和服务器私钥的步骤，包括vimca.sh脚本的编写，以及如何将证书集成到nginx的SSL配置中。还提及了DNS服务的搭建，如使用docker和dnsmasq。

摘要由CSDN通过智能技术生成

环境介绍

cenos 7
openssl

编写脚本

vim ca.sh

#!/bin/bash
openssl req -x509  -nodes -days 3650 -newkey rsa:2048 -subj "/C=CN/ST=BJ/L=BJ/O=SADC/OU=IT/CN=CSU" -keyout CA_private.key -out CA_certificate.crt -reqexts v3_req -extensions v3_ca
openssl genrsa -out private.key 2048
openssl req -new -key private.key -subj "/C=CN/ST=BJ/L=BJ/O=SADC/OU=IT/CN=*.my.web.com" -sha256 -out private.csr

cat <<EOF > private.ext
[ req ]
default_bits = 1024
distinguished_name = req_distinguished_name
req_extensions = san
extensions = san

[ req_distinguished_name  ]
contryName = CN
stateOrProvinceName = bj
localityName = bj
organizationName = bj

[ san ]
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
subjectKeyIdentifier = hash

[ alt_names ]
DNS.1 = *.web.com
DNS.2 = *.my.web.com
EOF

openssl x509 -req -days 3650 -in private.csr -CA CA_certificate.crt -CAkey CA_private.key -CAcreateserial -sha256 -out private.crt -extfile private.ext -extensions san

注意修改上面的域名为自己的域名。

使用方式：

chmod +x ca.sh && sh ca.sh

查看生成结果:

执行 ca.sh 结果

nginx 配置

ssl on;
ssl_certificate /usr/local/ssl/private.crt;
ssl_certificate_key /usr/local/ssl/private.key;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNUKK:!MD5;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;