如何制作和使用自签名证书

简单方式制作和使用自签名证书

#!/bin/bash
UTPUT_FILENAME="dev-XXX.net"

[req]
prompt                  = no
default_bits            = 4096
default_md              = sha256
encrypt_key             = no
string_mask             = utf8only

distinguished_name      = cert_distinguished_name
req_extensions          = req_x509v3_extensions
x509_extensions         = req_x509v3_extensions

[ cert_distinguished_name ]
C  = CN
ST = BJ
L  = BJ
O  = HomeLab
OU = HomeLab
CN = lab.com

[req_x509v3_extensions]
basicConstraints        = critical,CA:true
subjectKeyIdentifier    = hash
keyUsage                = critical,digitalSignature,keyCertSign,cRLSign #,keyEncipherment
extendedKeyUsage        = critical,serverAuth #, clientAuth
subjectAltName          = @alt_names

[alt_names]
DNS.1 = dev-XXX.net
DNS.2 = XXX.net
DNS.3 = *XXX.net  #根据情况可进行增减

openssl req -x509 -newkey rsa:2048 -keyout ssl/XXX.key -out ssl/XXX.crt -days 3650 -nodes -config ssl/XXX.net.conf