openssl 生成签名和增加多DNS支持

1. 做为CA机构生成自签名
1.1. 生成RSA私钥 

 

 

openssl genrsa -out ca_rsa_private.key 2048

 

1.2 生成自签名证书

openssl req -new -x509 -days 365 -key ca_rsa_private.key -out ca_cert.crt

 

1.3 把自签名给客户端做为根证书

 

2. 服务器使用

2.1生成RSA私钥

openssl genrsa -out ser_rsa_private.key 2048

2.2 使用 RSA私钥生成 CSR 签名请求

openssl req -new -key ser_rsa_private.key -out server.csr

(请注意：Common Name (e.g. server FQDN or YOUR name) []该值为客户端连接服务器时如果用IP，就写IP，如果用域名，就写域名，不然客户端验证域会失败)

2.3 使用CA证书申请签名

openssl x509 -req -days 3650 -in server.csr -CA ca_cert.crt -CAkey ca_rsa_private.key  -CAcreateserial -out server.crt

这样服务器的证书就好了。可以把证书和私钥放一起。

cat ser_rsa_private.key > server.pem

echo >> server.pem

cat  server.crt  >> server.pem

把server.pem给服务器

 

2.5相看信息

证书：openssl x509  -noout -text -in server.pem

        签名请求:openssl req -noout -text -in server.csr

私钥：openssl rsa -in server.pem -noout -text

 

 

 3.增加多个域

3.1增加文件sign.cof内容如下

subjectAltName = DNS.1:sushj.com,DNS.2:10.106.41.173

 

 

3.2签名时增加-extfile  sign.cof

 

openssl x509 -req -days 3650 -in server.csr -CA ca_cert.crt -CAkey ca_rsa_private.key  -CAcreateserial -out server.crt  -extfile sign.cof

 

另有两个方法，我没验证能不能用，先记录

方法二：
To get your openssl to prompt you for a SubjectAltName field, you have to add your openssl.conf, usually located in /etc/ssl. Search for the section labeled [req] and add this line:
req_extensions = v3_req
Then search for the section labeled [ v3_req ] and add a line like this:
subjectAltName = DNS:www.example.com,DNS:www2.example.com
#Refer to：http://apetec.com/support/GenerateSAN-CSR.htm
方法三：
How can I generate a certificate for that? 
Add the following into your openssl.cnf: 


[ req_distinguished_name ] 
0.commonName = Common Name (eg, YOUR name) 
0.commonName_default = www.domain1.com 
0.commonName_max = 64 
1.commonName = Common Name (eg, YOUR name) 
1.commonName_default = www.domain2.org 
1.commonName_max =64 
2.commonName = Common Name (eg, YOUR name) 
2.commonName_default = shop.domain1.com (only an example of subdomain added to ssl cert) 
2.commonName_max = 64 
3.commonName = Common Name (eg, YOUR name) 
3.commonName_default = My Secure Internet Services (example) 
3.commonName_max = 64 

 

4. 证书链验证

openssl verify -CAfile ca_cert.crt server.crt
openssl verify -CAfile ca_cert.crt server.pem

 

您的支持，是我持续创作的动力！！！！