使用openssl 工具生成 rsa及ecdsa证书链，公钥，私钥，签名，验证，root CA，证书链，中间证书验证

#!/bin/sh

USE_RSA=0
SIGNATURE_HASH=0
ECDSA_CURVE=secp384r1
DIGEST_ALGORITHM=sha384

if [ "$1" == "rsa" ];then
    USE_RSA=1
    DIGEST_ALGORITHM=sha256
elif [ "$1" == "256" ];then
    ECDSA_CURVE=prime256v1
    DIGEST_ALGORITHM=sha256
elif [ "$1" == "384" ];then
    ECDSA_CURVE=secp384r1
    DIGEST_ALGORITHM=sha384
elif [ "$1" == "512" ];then
    ECDSA_CURVE=secp521r1
    DIGEST_ALGORITHM=sha512
fi

if [ $USE_RSA == 1 ];then
    echo "Generate RSA certificate"
	echo ""
else
    echo "Generate ECDSA certificate"
	echo "Curve: $ECDSA_CURVE"
	echo "Digest: $DIGEST_ALGORITHM"
fi

CONFIG_FILE=opensslroot.cfg

function prepare()
{
echo "authorityKeyIdentifier=keyid,issuer
subjectKeyIdentifier=hash
basicConstraints = CA:true,pathlen:0
keyUsage = cRLSign, keyCertSign" > v3.ext

echo "authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:false,pathlen:0
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment" > v3_attest.ext
}

prepare

#--------------------------------------------------------------------------------------------------------------
# Generate rootCA key
#
if [ ${USE_RSA} == 1 ];then
    openssl genrsa -out qpsa_rootca.key 2048
else
    openssl ecparam -out qpsa_rootca.key -name ${ECDSA_CURVE} -genkey
fi

# use below command to query the supported parameter for ecdsa,
# usally use: prime256v1（NIST P-256），secp384r1（NIST P-384），secp521r1（NIST P-521）
# openssl ecparam -list_curves

#Generate certificate for rootCA
openssl req -new -key qpsa_rootca.key -x509 -out qpsa_rootca.crt \
-subj "/C=US/ST=California/L=San Diego/OU=General Use Test Key (for testing only)/OU=CDMA Technologies/O=None/CN=Generated Root CA 1" \
-days 7300 -set_serial 1 -config ${CONFIG_FILE} -${DIGEST_ALGORITHM}

#Convert crt format to der
openssl x509 -inform PEM -in