简单方式制作和使用自签名证书
#!/bin/bash
UTPUT_FILENAME="dev-XXX.net"
[req]
prompt = no
default_bits = 4096
default_md = sha256
encrypt_key = no
string_mask = utf8only
distinguished_name = cert_distinguished_name
req_extensions = req_x509v3_extensions
x509_extensions = req_x509v3_extensions
[ cert_distinguished_name ]
C = CN
ST = BJ
L = BJ
O = HomeLab
OU = HomeLab
CN = lab.com
[req_x509v3_extensions]
basicConstraints = critical,CA:true
subjectKeyIdentifier = hash
keyUsage = critical,digitalSignature,keyCertSign,cRLSign
extendedKeyUsage = critical,serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = dev-XXX.net
DNS.2 = XXX.net
DNS.3 = *XXX.net
openssl req -x509 -newkey rsa:2048 -keyout ssl/XXX.key -out ssl/XXX.crt -days 3650 -nodes -config ssl/XXX.net.conf