生成自签名SAN/UCC证书

一、环境介绍
操作系统：
CentOS Linux release 7.6.1810 (Core)
openssl 版本：
OpenSSL 1.0.2k-fips 26 Jan 2017
二、生成自签名证书过程
以 opssl.com为例子

# 建立工作目录
[root@hsspuat ~]# mkdir /opt/ssl_san && cd /opt/ssl_san
[root@hsspuat ssl_san]# mkdir ca cert && cd ca
   # 生成CA私钥
[root@hsspuat ca]# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
....................................................................+++
....+++
e is 65537 (0x10001)
# 生成CA证书
[root@hsspuat ca]# openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/C=CN/ST=HuBei/L=WuHan/O=opssl/OU=uat/emailAddress=uat@com.cn"
    # 生成nginx私钥
[root@hsspuat ca]# cd ../cert/
[root@hsspuat cert]# openssl genrsa -out opssl.com_san_key.key 2048
Generating RSA private key, 2048 bit long modulus
...................................................................................................................+++
..................................+++
e is 65537 (0x10001)

# 生成san证书配置文件,不同证书，需要创建用对应的san配置，如网关(opssl.com)的需要生成san.cfg
[root@hsspuat cert]# vim san.cfg
[ req ]
default_bits       = 2048
default_keyfile    = opssl.com_san_key.key # name of the keyfile
distinguished_name = req_distinguished_name
req_extensions     = req_ext
[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = HuBei
localityName                = Locality Name (eg, city)
localityName_default        = WuHan
organizationName            = Organization Name (eg, company)
organizationName_default    = opssl
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
organizationalUnitName      = Organizational Unit Name (eg, section)
organizationalUnitName_default  = uat
commonName          = Common Name (eg, YOUR name)
commonName_default      = opssl.com
commonName_max          = 64
emailAddress            = Email Address
emailAddress_max        = 64
emailAddress_default    = uat@com.cn
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 = opssl.com
DNS.2 = localhost
IP.1 = 127.0.0.1
IP.2 = 10.11.11.11 # 自己的ip
   
 
# 生成请求(csr)文件，如果要购买权威机构证书的话，将csr文件提交给权威机构即可。
[root@hsspuat cert]# openssl req -new -key opssl.com_san_key.key -out opssl.com_san_csr.csr  -config san.cfg  -subj "/C=CN/ST=HuBei/L=WuHan/O=opssl/OU=uat/CN=opssl.com"
# 检查生成的请求文件。
[root@hsspuat cert]# openssl req -in opssl.com_san_csr.csr -text -noout | grep DNS
                DNS:opssl.com, DNS:localhost, IP Address:127.0.0.1, IP Address:10.11.11.11
# 用自己的CA证书签名(crt/cer)
#openssl x509 -req -in opssl.com_san_csr.csr -CA ../ca/ca.crt -CAkey ../ca/ca.key -CAcreateserial -out opssl.com_san_crt.crt -extensions req_ext -extfile san.cfg
#openssl x509 -req -in opssl.com_san_csr.csr -CA ../ca/ca.crt -CAkey ../ca/ca.key -CAcreateserial -out opssl.com_san_cer.cer -extensions req_ext -extfile san.cfg
# 检查签名的证书
#openssl x509 -in opssl.com_san_crt.crt -text -noout | grep DNS