openssl证书命令行

openssl x509部分命令
打印出证书的内容：
openssl x509 -in cert.pem -noout -text
打印出证书的系列号
openssl x509 -in cert.pem -noout -serial
打印出证书的拥有者名字
openssl x509 -in cert.pem -noout -subject
以RFC2253规定的格式打印出证书的拥有者名字
openssl x509 -in cert.pem -noout -subject -nameopt RFC2253
在支持UTF8的终端一行过打印出证书的拥有者名字
openssl x509 -in cert.pem -noout -subject -nameopt oneline -nameopt -escmsb
打印出证书的MD5特征参数
openssl x509 -in cert.pem -noout -fingerprint
打印出证书的SHA特征参数
openssl x509 -sha1 -in cert.pem -noout -fingerprint
把PEM格式的证书转化成DER格式
openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
把一个证书转化成CSR
openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem
给一个CSR进行处理，颁发字签名证书，增加CA扩展项
openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca -signkey key.pem -out cacert.pem
给一个CSR签名，增加用户证书扩展项
openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr -CA cacert.pem -CAkey key.pem -CAcreateserial
查看csr文件细节：

openssl req -in my.csr -noout -text

 

生成RSA私钥

openssl genrsa -out RootCA.key 2048/1024

私钥生成公钥

openssl rsa -in RootCA.key -pubout -out RootCA_public_key.pem

生成证书链

生成根CA并自签(Common Name填RootCA)

openssl genrsa -des3-out keys/RootCA.key 2048

openssl req -new-x509 -days 3650 -key keys/RootCA.key -out keys/RootCA.crt

生成二级CA(Common Name填secondCA)

openssl genrsa-des3 -out keys/secondCA.key 2048

openssl rsa -inkeys/secondCA.key -out keys/secondCA.key

openssl req -new-days 3650 -key keys/secondCA.key -out keys/secondCA.csr

openssl ca-extensions v3_ca -in keys/secondCA.csr -config /etc/pki/tls/openssl.cnf -days3650 -out keys/secondCA.crt -cert keys/RootCA.crt -keyfile keys/RootCA.key

生成三级CA(Common Name填thirdCA)

openssl genrsa-des3 -out keys/thirdCA.key 2048

openssl rsa -inkeys/thirdCA.key -out keys/thirdCA.key

openssl req -new-days 3650 -key keys/thirdCA.key -out keys/thirdCA.csr

openssl ca-extensions v3_ca -in keys/thirdCA.csr -config /etc/pki/tls/openssl.cnf -days3650 -out keys/thirdCA.crt -cert keys/secondCA.crt -keyfile keys/secondCA.key

使用三级CA签发服务器证书

openssl genrsa-des3 -out keys/server.key 2048

openssl rsa -inkeys/server.key -out keys/server.key

openssl req -new-days 3650 -key keys/server.key -out keys/server.csr

openssl ca -inkeys/server.csr -config /etc/pki/tls/openssl.cnf -days 3650 -outkeys/server.crt -cert keys/thirdCA.crt -keyfile keys/thirdCA.key