linux 生成 ca 证书

自建证书

创建用私钥签名的证书

生成私钥

openssl genrsa -out private.key 2048

生成证书请求

openssl req -new -key private.key -out server.csr

这一步需要填写证书信息，如

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GD
Locality Name (eg, city) [Default City]:GZ
Organization Name (eg, company) [Default Company Ltd]:GZGZ
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:XXXXX.XXXX.com
Email Address []:xxxxxxxx@xx.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

其中，Common Name 填写证书绑定的域名，否则证书不能通过信任验证。

生成服务器的私钥

openssl rsa -in private.key -out server.key

使用私钥生成服务器证书

openssl x509 -req -in server.csr -out server.crt -outform pem -signkey server.key -days 365 -sha256

下面的 gitlab 的自建证书过程

Generation of a Self Signed Certificate
Generation of a self-signed SSL certificate involves a simple 3-step procedure:

STEP 1: Create the server private key

openssl genrsa -out gitlab.key 2048

STEP 2: Create the certificate signing request (CSR)

openssl req -new -key gitlab.key -out gitlab.csr

STEP 3: Sign the certificate using the private key and CSR

openssl x509 -req -days 3650 -in gitlab.csr -signkey gitlab.key -out gitlab.crt

Congratulations! You now have a self-signed SSL certificate valid for 10 years.

Strengthening the server security
This section provides you with instructions to strengthen your server security. To achieve this we need to generate stronger DHE parameters.

openssl dhparam -out dhparam.pem 2048