open ssl 生成自签名证书

本节向您展示如何使用’ openssl '工具从命令行生成所有必要的文件。

1. 使用实例生成2048位的RSA私钥，用于对流量进行解密。（这里的私钥没有使用加密，安全起见可以加密私钥）

$ sudo openssl genrsa -out /etc/grafana/grafana.key 2048

加密参数如下：

[root@localhost ~]# openssl genrsa --help
usage: genrsa [args] [numbits]
 -des            encrypt the generated key with DES in cbc mode
 -des3           encrypt the generated key with DES in ede cbc mode (168 bit key)
 -idea           encrypt the generated key with IDEA in cbc mode
 -seed
                 encrypt PEM output with cbc seed
 -aes128, -aes192, -aes256
                 encrypt PEM output with cbc aes
 -camellia128, -camellia192, -camellia256
                 encrypt PEM output with cbc camellia
 -out file       output the key to 'file
 -passout arg    output file pass phrase source
 -f4             use F4 (0x10001) for the E value
 -3              use 3 for the E value
 -engine e       use engine e, possibly a hardware device.
 -rand file:file:...
                 load the file (or the files in the directory) into
                 the random number generator

2. 执行以下命令，使用上一步中的私钥生成证书。（csr这个里面包含公钥，所以这里需要私钥来生成对应的公钥）

$ sudo openssl req -new -key /etc/grafana/grafana.key -out /etc/grafana/grafana.csr

当提示时，回答问题，其中可能包括您的完全合格域名，电子邮件地址，国家代码等。下面的示例与您将看到的提示类似。

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Virginia
Locality Name (eg, city) []:Richmond
Organization Name (eg, company) [Internet Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:subdomain.mysite.com
Email Address []:me@mysite.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3. 使用私钥自签名证书，证书有效期为365天。（颁发证书）

sudo openssl x509 -req -days 365 -in /etc/grafana/grafana.csr -signkey /etc/grafana/grafana.key -out /etc/grafana/grafana.crt

4. 执行如下命令为文件设置相应的权限:

sudo chown grafana:grafana /etc/grafana/grafana.crt
sudo chown grafana:grafana /etc/grafana/grafana.key
sudo chmod 400 /etc/grafana/grafana.key /etc/grafana/grafana.crt