openssl生成自签ssl证书

一.手动生成单个ssl证书

1.创建CA和申请证书

使用openssl工具创建CA证书和申请证书时，需要先查看配置文件，因为配置文件中对证书的名称和存放位置等相关信息都做了定义，具体可参考 /etc/pki/tls/openssl.cnf 文件。

1. [root@VM-0-114-centos ~]# vim /etc/pki/tls/openssl.cnf

2. ####################################################################

3. [ ca ]

4. default_ca = CA_default # The default ca section

6. ####################################################################

7. [ CA_default ]

9. dir = /etc/pki/CA # Where everything is kept

10. certs = $dir/certs # Where the issued certs are kept

11. crl_dir = $dir/crl # Where the issued crl are kept

12. database = $dir/index.txt # database index file.

13. #unique_subject = no # Set to 'no' to allow creation of

14. # several ctificates with same subject.

15. new_certs_dir = $dir/newcerts # default place for new certs.

17. certificate = $dir/cacert.pem # The CA certificate

18. serial = $dir/serial # The current serial number

19. crlnumber = $dir/crlnumber # the current crl number

20. # must be commented out to leave a V1 CRL

21. crl = $dir/crl.pem # The current CRL

22. private_key = $dir/private/cakey.pem# The private key

23. RANDFILE = $dir/private/.rand # private random number file

25. x509_extensions = usr_cert # The extentions to add to the cert

26. # Comment out the following two lines for the "traditional"

27. # (and highly broken) format.

28. name_opt = ca_default # Subject Name options

29. cert_opt = ca_default # Certificate field options

31. # Extension copying option: use with caution.

32. # copy_extensions = copy

34. # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs

35. # so this is commented out by default to leave a V1 CRL.

36. # crlnumber must also be commented out to leave a V1 CRL.

37. # crl_extensions = crl_ext

39. default_days = 365 # how long to certify for

40. default_crl_days= 30 # how long before next CRL

41. default_md = sha256 # use SHA-256 by default

42. preserve = no # keep passed DN ordering

44. # A few difference way of specifying how similar the request should look

45. # For type CA, the listed attributes must be the same, and the optional

46. # and supplied fields are just that :-)

47. policy = policy_match

49. # For the CA policy

50. [ policy_match ]

51. countryName = match

52. stateOrProvinceName = match

53. organizationName = match

54. organizationalUnitName = optional

55. commonName = supplied

56. emailAddress = optional

（1）、创建自签证书

第一步：创建为 CA 提供所需的目录及文件

1. [root@VM-0-114-centos CA]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts,private}

2. [root@VM-0-114-centos CA]# touch /etc/pki/CA/{serial,index.txt}

3. [root@VM-0-114-centos CA]# tree

4. .

5. ├── certs

6. ├── crl

7. ├── index.txt

8. ├── newcerts

9. ├── private

10. └── serial

12. 4 directories, 2 files

第二步：指明证书的开始编号

]# echo 01 >> serial 

第三步：生成私钥，私钥的文件名与存放位置要与配置文件中的设置相匹配；

1. [root@VM-0-114-centos CA]# (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)

2. Generating RSA private key, 4096 bit long modulus

3. .....................................................................................................................................................................................................................++

4. ..........................................................++

5. e is 65537 (0x10001)

6. [root@VM-0-114-centos CA]# ll private/

7. 总用量 4

8. -rw------- 1 root root 3243 10月 18 21:03 cakey.pem

第四步：生成自签证书，自签证书的存放位置也要与配置文件中的设置相匹配，生成证书时需要填写相应的信息；

1. [root@VM-0-114-centos CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3650

2. You are about to be asked to enter information that will be incorporated

3. into your certificate request.

4. What you are about to enter is what is called a Distinguished Name or a DN.

5. There are quite a few fields but you can leave some blank

6. For some fields there will be a default value,

7. If you enter '.', the field will be left blank.

8. -----

9. Country Name (2 letter code) [XX]:CN

10. State or Province Name (full name) []:ShengZhen

11. Locality Name (eg, city) [Default City]:shenzhen

12. Organization Name (eg, company) [Default Company Ltd]:keyao

13. Organizational Unit Name (eg, section) []:mage

14. Common Name (eg, your name or your server's hostname) []:*.tapd.demo.com

15. Email Address []:httpd@keyao.com

16. [root@VM-0-114-centos CA]# ll /etc/pki/CA/cacert.pem

17. -rw-r--r-- 1 root root 2118 10月 18 21:11 /etc/pki/CA/cacert.pem

命令中用到的选项解释：

-new：表示生成一个新证书签署请求

-x509：专用于CA生成自签证书，如果不是自签证书则不需要此项

-key：生成请求时用到的私钥文件

-out：证书的保存路径

-days：证书的有效期限，单位是day（天），默认是365天

（2）颁发证书

在需要使用证书的主机上生成证书请求，以 httpd 服务为例，步骤如下：

第一步：在需要使用证书的主机上生成私钥，这个私钥文件的位置可以随意定

第二步：生成证书签署请求

第三步：将请求通过可靠方式发送给 CA 主机

1. [root@VM-0-114-centos test]# (umask 077;openssl genrsa -out httpd.key 4096)

2. Generating RSA private key, 4096 bit long modulus

3. ............................................................................................................................................................................................................................................++

4. ..........................++

5. e is 65537 (0x10001)

6. [root@VM-0-114-centos test]# openssl req -new -key httpd.key -out httpd.csr -days 365

7. You are about to be asked to enter information that will be incorporated

8. into your certificate request.

9. What you are about to enter is what is called a Distinguished Name or a DN.

10. There are quite a few fields but you can leave some blank

11. For some fields there will be a default value,

12. If you enter '.', the field will be left blank.

13. -----

14. Country Name (2 letter code) [XX]:CN

15. State or Province Name (full name) []:Shenzhen

16. Locality Name (eg, city) [Default City]:shenzhen

17. Organization Name (eg, company) [Default Company Ltd]:keyao

18. Organizational Unit Name (eg, section) []:*.tapd.demo.com

19. Common Name (eg, your name or your server's hostname) []:www.tapd.demo.com

20. Email Address []:https@keyao.com

22. Please enter the following 'extra' attributes

23. to be sent with your certificate request

24. A challenge password []:

25. An optional company name []:

26. [root@VM-0-114-centos test]# ll

27. 总用量 8

28. -rw-r--r-- 1 root root 1765 10月 18 21:26 httpd.csr

29. -rw------- 1 root root 3243 10月 18 21:23 httpd.key

第四步：CA 服务器拿到证书签署请求文件后颁发证书，这一步是在 CA 服务器上做的

1. [root@VM-0-114-centos /]# ls

2. bin dev lost+found opt run storage usr

3. boot etc lib media proc sbin sys var

4. data home lib64 mnt root srv tmp

6. [root@VM-0-114-centos /]# openssl ca -in /httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365

7. Using configuration from /etc/pki/tls/openssl.cnf

8. Check that the request matches the signature

9. Signature ok

10. Certificate Details:

11. Serial Number: 2 (0x2)

12. Validity

13. Not Before: Oct 19 13:28:38 2021 GMT

14. Not After : Oct 19 13:28:38 2022 GMT

15. Subject:

16. countryName = CN

17. stateOrProvinceName = ShenZhen

18. organizationName = keyao

19. organizationalUnitName = yaoke.com

20. commonName = www.yaoke.com

21. emailAddress = httpd@magedu.com

22. X509v3 extensions:

23. X509v3 Basic Constraints:

24. CA:FALSE

25. Netscape Comment:

26. OpenSSL Generated Certificate

27. X509v3 Subject Key Identifier:

28. A7:23:5A:30:09:64:4D:D8:51:3A:BB:C9:B6:E0:F6:80:87:5C:E0:2F

29. X509v3 Authority Key Identifier:

30. keyid:36:55:4C:EE:B6:FA:90:67:AF:91:71:77:25:D0:A9:91:54:B3:68:06

32. Certificate is to be certified until Oct 19 13:28:38 2022 GMT (365 days)

33. Sign the certificate? [y/n]:y

36. 1 out of 1 certificate requests certified, commit? [y/n]y

37. Write out database with 1 new entries

38. Data Base Updated

39. [root@VM-0-114-centos /]# ls

40. bin dev httpd.csr lost+found opt run storage usr

41. boot etc lib media proc sbin sys var

42. data home lib64 mnt root srv tmp

查看证书信息的命令为：

1. [root@VM-0-114-centos /]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subject

2. serial=02

3. subject= /C=CN/ST=ShenZhen/O=keyao/OU=yaoke.com/CN=www.yaoke.com/emailAddress=httpd@magedu.com

（3）吊销证书

吊销证书的步骤也是在CA服务器上执行的，以刚才新建的 httpd.crt 证书为例，吊销步骤如下：

第一步：在客户机上获取要吊销证书的 serial 和 subject 信息 

第二步：根据客户机提交的 serial 和 subject 信息，对比其余本机数据库 index.txt 中存储的是否一致 

第三步：执行吊销操作

1. [root@VM-0-114-centos CA]# openssl ca -revoke /etc/pki/CA/newcerts/01.pem

2. Using configuration from /etc/pki/tls/openssl.cnf

3. Revoking Certificate 01.

4. Data Base Updated

第四步：生成吊销证书的吊销编号 （第一次吊销证书时执行）

]# echo 01 > /etc/pki/CA/crlnumber

第五步：更新证书吊销列表

]# openssl ca -gencrl -out /etc/pki/CA/crl/ca.crl

查看 crl 文件命令：

]# openssl crl -in /etc/pki/CA/crl/ca.crl -noout -text

二.脚本生成单个CA ssl证书

1. ~]#vim aaaCA.cnf

2. [ req ]

3. distinguished_name = req_distinguished_name

4. x509_extensions = root_ca

6. [ req_distinguished_name ]

8. # 以下内容可随意填写

9. countryName = CN (2 letter code)

10. countryName_min = 2

11. countryName_max = 2

12. stateOrProvinceName = Guangdong

13. localityName = Shenzhen

14. 0.organizationName = TC

15. organizationalUnitName = technology

16. 0.commonName = aaa.xxx.co

17. 0.commonName_max = 64

18. 1.commonName = aaa.xxx.pro

19. 1.commonName_max = 64

20. 2.commonName = aaa.xxx.co

21. 2.commonName_max = 64

22. 3.commonName = aaa.xxx.pro

23. 3.commonName_max = 64

24. 4.commonName = aaa.xxx.me

25. 4.commonName_max = 64

26. 5.commonName = aaa.xxx.me

27. 5.commonName_max = 64

28. 6.commonName = aaa.xxx.me

29. 6.commonName_max = 64

30. 7.commonName = aaa.xxx.me

31. 7.commonName_max = 64

32. 8.commonName = aaa.xxx.me

33. 8.commonName_max = 64

34. 9.commonName = aaa.xxx.com

35. 9.commonName_max = 64

36. emailAddress = admin@tapd.cn

37. emailAddress_max = 64

39. [ root_ca ]

40. basicConstraints = critical, CA:true

1. ~]# vim tapdLocalExt.cnf

2. subjectAltName = @alt_names

3. extendedKeyUsage = serverAuth

5. [alt_names]

7. DNS.1 = *.xxx.xxx.com

8. DNS.2 = xxx.xxx.com

9. IP.1 = ingress的ip

10. IP.2 = lb的ip

#私有CA
openssl req -x509 -newkey rsa:2048 -out CA.cer -outform PEM -keyout CA.pvk -days 10000 -verbose -config CA.cnf -nodes -sha256 -subj "/CN=aaa CA"

#私钥
openssl req -newkey rsa:2048 -keyout aaa.pvk -out aaa.req -subj "/CN=*.xxx.xxx.com" -sha256 -nodes

#公钥
openssl x509 -req -CA  CA.cer -CAkey CA.pvk -in aaa.req -out aaa.cer -days 10000 -extfile aaaLocalExt.cnf -sha256 -set_serial 0x1113

注：该脚本修该的地方就是 enerate_ca.sh你的私钥，tapdCA.cnf应答文件,tapdLocalExt.cnf你要解析的ip地址

三.脚本自动生成通配符ssl证书

1. 新建文件 gencert.sh ，编辑并加入以下内容：

3. #!/usr/bin/env bash

4. #

5. # Copyright 2020 Liu Hongyu (eliuhy@163.com)

6. #

7. # Licensed under the Apache License, Version 2.0 (the "License");

8. # you may not use this file except in compliance with the License.

9. # You may obtain a copy of the License at

10. #

11. # http://www.apache.org/licenses/LICENSE-2.0

12. #

13. # Unless required by applicable law or agreed to in writing, software

14. # distributed under the License is distributed on an "AS IS" BASIS,

15. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

16. # See the License for the specific language governing permissions and

17. # limitations under the License.

18. #

19. set -e

21. DOMAIN="$1"

22. WORK_DIR="$(mktemp -d)"

24. if [ -z "$DOMAIN" ]; then

25. echo "Domain name needed."

26. exit 1

27. fi

29. echo "Temporary working dir is $WORK_DIR "

30. echo "Gernerating cert for $DOMAIN ..."

32. #

33. # Fix the following error:

34. # --------------------------

35. # Cannot write random bytes:

36. # 139695180550592:error:24070079:random number generator:RAND_write_file:Cannot open file:../crypto/rand/randfile.c:213:Filename=/home/eliu/.rnd

37. #

38. [ -f $HOME/.rnd ] || dd if=/dev/urandom of=$HOME/.rnd bs=256 count=1

40. openssl genrsa -out $WORK_DIR/ca.key 4096

42. openssl req -x509 -new -nodes -sha512 -days 3650 \

43. -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=$DOMAIN" \

44. -key $WORK_DIR/ca.key \

45. -out $WORK_DIR/ca.crt

47. openssl genrsa -out $WORK_DIR/server.key 4096

49. openssl req -sha512 -new \

50. -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=$DOMAIN" \

51. -key $WORK_DIR/server.key \

52. -out $WORK_DIR/server.csr

54. cat > $WORK_DIR/v3.ext <<-EOF

55. authorityKeyIdentifier=keyid,issuer

56. basicConstraints=CA:FALSE

57. keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

58. extendedKeyUsage = serverAuth

59. subjectAltName = @alt_names

61. [alt_names]

62. DNS.1=$DOMAIN

63. DNS.2=*.$DOMAIN

64. EOF

66. openssl x509 -req -sha512 -days 3650 \

67. -extfile $WORK_DIR/v3.ext \

68. -CA $WORK_DIR/ca.crt -CAkey $WORK_DIR/ca.key -CAcreateserial \

69. -in $WORK_DIR/server.csr \

70. -out $WORK_DIR/server.crt

72. openssl x509 -inform PEM -in $WORK_DIR/server.crt -out $WORK_DIR/$DOMAIN.cert

74. mkdir -p ./$DOMAIN

75. cp $WORK_DIR/server.key $WORK_DIR/server.crt ./$DOMAIN

假设我们要为 example.com 生成证书，执行如下命令：

./gencert.sh example.com

生成的后的目录结构如下：

1. .

2. ├── example.com

3. │ ├── server.crt

4. │ └── server.key

5. └── gencert.sh

然后查看通配符ssl

for i in `find . -maxdepth 2 -name "*.crt"`;do openssl x509 -in $i -text -noout;done

四.导出证书

sz server.crt server.key