openssl创建及验证证书与搭建服务端测试与curl命令的使用

1、openssl生成证书

1.1 RSA加密

以下步骤生成了CA、服务端和客户端所需要的证书，以实现双向认证

@echo off
set OPENSSL_CONF=/usr/lib/ssl/openssl.cnf   

#CA，不加-des3则不用密码
echo Generate CA key:
openssl genrsa -passout pass:1111 -des3 -out ca.key 4096
echo Generate CA certificate:
openssl req -passin pass:1111 -new -x509 -days 365 -key ca.key -out ca.crt -subj  "/C=CN/ST=FJ/L=XM/O=YaXon/OU=CA/CN=MyRootCA"

#服务端
echo Generate server key:
openssl genrsa -passout pass:1111 -des3 -out server.key 4096
echo Generate server signing request:
openssl req -passin pass:1111 -new -key server.key -out server.csr -subj  "/C=CN/ST=FJ/L=XM/O=YaXon/OU=server/CN=yxserver"
echo Self-sign server certificate:
openssl x509 -req -passin pass:1111 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
echo Remove passphrase from server key:
openssl rsa -passin pass:1111 -in server.key -out server.key

#客户端
echo Generate client key
openssl genrsa -passout pass:1111 -des3 -out client.key 4096
echo Generate client signing request:
openssl req -passin pass:1111 -new -key client.key -out client.csr -subj  "/C=CN/ST=FJ/L=XM/O=YaXon/OU=client/CN=nmclient"
echo Self-sign client certificate:
openssl x509 -passin pass:1111 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
echo Remove passphrase from client key:
openssl rsa -passin pass:1111 -in client.key -out client.key

一个简单点的rsa证书生成

#生成CA私钥
openssl genrsa -out root_ca.key
#生成CA证书请求
openssl req -config /usr/lib/ssl/openssl.cnf -key root_ca.key -new -out root_ca.req -subj  "/C=CN/ST=FJ/L=XM/O=YaXon/OU=CA/CN=NMRootCA"
#生成CA证书
openssl x509 -req -in root_ca.req -signkey root_ca.key -out root_ca.pem

#生成客户端私钥
openssl genrsa -out rsa_client.key
#生成客户端证书请求
openssl req -config /usr/lib/ssl/openssl.cnf -key rsa_client.key -new -out rsa_client.req -subj  "/C=CN/ST=FJ/L=XM/O=YaXon/OU=client/CN=nmclient"
#通过CA私钥签发客户端证书
openssl x509 -req -days 365 -in rsa_clien