自签名CA证书创建过程

生成根证书：

1. 生成根证书私钥
   openssl genrsa -aes256 -out private/cakey.pem 1024
2. 生产根证书签名请求
   openssl req -new -key private/cakey.pem -out private/ca.csr -subj “/C=CN/ST=gd/L=sz/O=bank/OU=openflatform/CN=jz”
3. 生产根证书
   openssl x509 -req -days 10000 -sha1 -extensions v3_ca -signkey private/cakey.pem -in private/ca.csr -out certs/ca.cer

生成服务器证书

1. 生产服务器证书私钥
   openssl genrsa -aes256 -out private/server-key.pem 1024
2. 生产服务器证书签名请求
   openssl req -new -key private/server-key.pem -out private/server.csr -subj “/C=CN/ST=gd/L=sz/O=bank/OU=bank/CN=bank”
3. 生产服务器证书
   openssl x509 -req -days 10000 -sha1 -extensions v3_req -CA certs/ca.cer -CAkey private/cakey.pem -CAcreateserial -in private/server.csr -out certs/server.cer

生成客户端证书

1. 生产客户端证书私钥
   openssl genrsa -aes256 -out private/client-key.pem 1024
2. 生产客户端证书签名请求
   openssl req -new -key private/client-key.pem -out private/client.csr -subj “/C=CN/ST=gd/L=sz/O=bank/OU=bank/CN=bank”
3. 生产客户端证书
   openssl x509 -req -days 10000 -sha1 -extensions v3_req -CA certs/ca.cer -CAkey private/cakey.pem -CAserial ca.srl -in private/client.csr -out certs/client.cer

导出客户端/服务器端证书仓库

1. 导出客户端证书仓库
   openssl pkcs12 -export -clcerts -name client -inkey private/client-key.pem -in certs/client.cer -out certs/client.keystore
2. 导出服务器端证书仓库
   openssl pkcs12 -export -clcerts -name client -inkey private/server-key.pem -in certs/server.cer -out certs/server.keystore

格式转换

1. 客户端证书转换为pkcs8格式
   openssl pkcs8 -topk8 -nocrypt -in private/client-key.pem -out private/client.pem
2. 服务器端证书转换为pkcs8格式
   openssl pkcs8 -topk8 -nocrypt -in private/server-key.pem -out private/server.pem