为域名快速生成证书
1. 下面这个脚本不能,有 bug
会出现这种问题:
x509 cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs.
原因是脚本里面的命令没有把 IP 地址写到证书里面。
若想生成没有错误的证书可以参考这个: https://blog.csdn.net/wan212000/article/details/120762210
2. 用法
./gencert.sh example.com
3. 脚本 gencert.sh
#!/usr/bin/env bash
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# example: ./gencert.sh example.com
set -e
DOMAIN="$1"
WORK_DIR="$(mktemp -d)"
if [ -z "$DOMAIN" ]; then
echo "Domain name needed."
exit 1
fi
echo "Temporary working dir is $WORK_DIR "
echo "Gernerating cert for $DOMAIN ..."
#
# Fix the following error:
# --------------------------
# Cannot write random bytes:
# 139695180550592:error:24070079:random number generator:RAND_write_file:Cannot open file:../crypto/rand/randfile.c:213:Filename=/home/eliu/.rnd
#
[ -f $HOME/.rnd ] || dd if=/dev/urandom of=$HOME/.rnd bs=256 count=1
openssl genrsa -out $WORK_DIR/ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=$DOMAIN" \
-key $WORK_DIR/ca.key \
-out $WORK_DIR/ca.crt
openssl genrsa -out $WORK_DIR/server.key 4096
openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=$DOMAIN" \
-key $WORK_DIR/server.key \
-out $WORK_DIR/server.csr
cat > $WORK_DIR/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=$DOMAIN
DNS.2=*.$DOMAIN
EOF
openssl x509 -req -sha512 -days 3650 \
-extfile $WORK_DIR/v3.ext \
-CA $WORK_DIR/ca.crt -CAkey $WORK_DIR/ca.key -CAcreateserial \
-in $WORK_DIR/server.csr \
-out $WORK_DIR/server.crt
openssl x509 -inform PEM -in $WORK_DIR/server.crt -out $WORK_DIR/$DOMAIN.cert
mkdir -p ./$DOMAIN
cp $WORK_DIR/ca.key $WORK_DIR/ca.crt $WORK_DIR/server.key $WORK_DIR/server.crt ./$DOMAIN