Linux上使用OpenSSL生成SSL证书

生成过程

检查是否安装OpenSSL

openssl version

创建生成证书目录

mkdir sky

生成私钥文件

openssl genrsa -out private.key 2048

生成一个2048位的RSA私钥

生成证书请求文件（CSR）

openssl req -new -key private.key -out server.csr

输入此命令后，会有此提示，随意填写就好

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:jn
Locality Name (eg, city) [Default City]:jn
Organization Name (eg, company) [Default Company Ltd]:jn
Organizational Unit Name (eg, section) []:bj
Common Name (eg, your name or your server's hostname) []:bj
Email Address []:xxx@xxx.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:bj

生成自签名证书

openssl x509 -req -days 365 -in server.csr -signkey private.key -out server.crt

配置Nginx

 server {
        listen 8103;#http是8103接口
        listen 8443 ssl; #https是8443接口。
        server_name  133.70.34.138;
        ssl_certificate        ./server.crt;#crt文件的绝对路径
        ssl_certificate_key    ./private.key;#key文件的绝对路径
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
}

重启ng

./nginx -s reload