openssl生成证书
准备工作
- 根据openssl.cnf,新建相应目录结构
cd /etc/ssl
vim openssl.cnf
mkdir demoCA
cd demoCA
mkdir private crl certs newcerts
echo "01" > serial
touch index.txt
CA 根证书
- 生成CA根证书私钥
openssl genrsa -out private/cakey.pem 2048
- 生成CA根证书
openssl req -new -x509 -key private/cakey.pem -out cacert.pem -subj "/C=CN/ST=GD/L=SZ/O=david/OU=dev/CN=david2code.com/emailAddress=lushanbest@126.com"
SSL 服务器证书
- 生成服务器证书私钥
openssl genrsa -out private/server.key 2048
- 生成服务器证书请求文件
openssl req -new -key private/server.key -out crl/server.csr -subj "/C=CN/ST=GD/L=SZ/O=david/OU=dev/CN=david2code.com/emailAddress=lushanbest@126.com"
- 签署服务器证书
cd ..
openssl ca -in demoCA/crl/server.csr -out demoCA/certs/server.crt
SSL 客户端证书
openssl genrsa -out private/client.key 2048
openssl req -new -key private/client.key -out crl/client.csr -subj "/C=CN/ST=GD/L=SZ/O=david/OU=dev/CN=client.com/emailAddress=lushanbest@126.com"
cd ..
openssl ca -in demoCA/crl/client.csr -out demoCA/certs/client.crt
windows下生成证书
http://slproweb.com/download/Win64OpenSSL_Light-3_0_1.exe
安装后,就可以在命令行执行命令生成证书。跟Linux中差不多