生成openssl绑定服务段IP地址证书

在linux系统使用shell脚本生成CA根证书，与客户端、服务端证书

#!/bin/sh
 
# Generate the openssl configuration files.
echo "创建openssl.cnf------------------->"
 
cat > openssl.cnf << EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = CN
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = HN
localityName = Locality Name (eg, city)
localityName_default = ZZ
organizationalUnitName  = Organizational Unit Name (eg, section)
organizationalUnitName_default  = xxx
commonName = commonName
commonName_default = xxx
commonName_max  = 64
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:TRUE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
IP.1 = 192.168.3.35（服务端ip地址）
#IP.2 = 192.168.3.35
EOF
 
echo "创建v3.ext------------------->"
cat > v3.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage=digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=@alt_names
[alt_names]
IP.1 = 192.168.3.35（服务端ip地址）
#IP.2 = 192.168.3.35
EOF
 
echo "创建CA 根证书------------------------->"
echo "创建私钥 ca.key"
openssl genrsa -out ca.key 2048
 
echo "创建CA证书 ca.crt"
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
 
echo "生成服务器证书----------------->"
echo "创建私钥 server.key"
openssl genrsa -out server.key 2048
 
echo "创建服务器证书请求文件 server.csr"
openssl req -new -days 3650 -key server.key -out server.csr -config openssl.cnf
 
echo "创建服务器证书 server.crt"
openssl x509 -days 3650 -req -sha256 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt
 
echo "创建pem------------------------>"
cat server.crt server.key > server.pem
 
echo "创建p12----------------------->"
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name "server"

echo "创建创建客户端证书client.csr----------------------->"
openssl req -newkey rsa:2048 -nodes -keyout client.key -out client.csr

echo "创建创建客户端证书client.crt----------------------->"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 3650

echo "将CA证书导入到新人库----------------------->"
keytool -importcert -alias ca -file ca.crt -keystore truststore.jks
 
echo "转换服务端证书和密钥----------------------->"
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name server -CAfile ca.crt -caname root

echo "转换客户端证书和密钥----------------------->"
openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -name client -CAfile ca.crt -caname root

将客户端证书ca.crt,client.crt,client.key给客户端，进行校验

将服务端证书与信任证书放到springboot项目的资源目录下，然后在配置文件增加如下配置，就可以使用根证书进行验证了

在服务器端的 application.properties（或 application.yml）中添加以下配置：
properties
server.ssl.key-store=classpath:server.p12
server.ssl.key-store-password=your_password
server.ssl.key-store-type=PKCS12
server.ssl.client-auth=need
server.ssl.trust-store=classpath:truststore.jks
server.ssl.trust-store-password=your_password
server.ssl.trust-store-type=JKS
服务器配置中使用了 PKCS12 格式的密钥库。
在客户端的 application.properties 中添加以下配置：
properties
server.ssl.trust-store=classpath:client.p12
server.ssl.trust-store-password=your_password
server.ssl.trust-store-type=PKCS12