opnessl命令生成证书

//创建根证书，并采用自签名签署它

方法1：
//创建私钥
openssl genrsa -out root/root-key.pem 1024
//创建证书请求
openssl req -new -out root/root-req.csr -key root/root-key.pem
//自签署根证书
openssl x509 -req -in root/root-req.csr -out root/root-cert.pem -signkey root/root-key.pem -days 3650
方法2：
//创建私钥
openssl genrsa -out root/root-key.pem 1024
//创建证书请求，并自签署根证书
openssl req -new -x509 -days 3650 -key root/root-key.pem -out root/root-cert.pem -subj "/C=CN,..."
方法3：
//创建私钥，创建证书请求，并自签署根证书
openssl req -new -x509 -keyout root/root-key.pem -out root/root-cert.pem -config openssl.cnf

//将根证书导出成浏览器支持的.p12（PKCS12）格式
openssl pkcs12 -export -clcerts -in root/root-cert.pem -inkey root/root-key.pem -out root/root.p12

//创建服务器证书，并采用根证书签署它
//创建私钥
openssl genrsa -out server/server-key.pem 1024
//创建证书请求
openssl req -new -out server/server-req.csr -key server/server-key.pem
//签署服务器证书
openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -CA root/root-cert.pem -CAkey root/root-key.pem -CAcreateserial -days 3650
//将客户证书导出成浏览器支持的.p12（PKCS12）格式
openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12

//创建客户证书，并采用根证书签署它
//创建私钥
openssl genrsa -out client/client-key.pem 1024
//创建证书请求
openssl req -new -out client/client-req.csr -key client/client-key.pem
//签署客户证书
openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -CA root/root-cert.pem -CAkey root/root-key.pem -CAcreateserial -days 3650
//将客户证书导出成浏览器支持的.p12（PKCS12）格式
openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12
//将根证书导入到trustStore中
keytool -import -v -trustcacerts -storepass password -alias root -file root-cert.pem -keystore root.jksv
//创建P7B证书链
openssl crl2pkcs7 -out ca/cert-p7b.p7b -nocrl -certfile server/server-cert.crt -certfile root/root-cert.crt -certfile

// p12 to private key
openssl pkcs12 -in cert.p12 -out pri.key
// p12 to pem
openssl pkcs12 -in cert.p12 -out cert.pem
// p12 to public key
openssl rsa -in cert.pem -pubout -out pub.key

// rsautl use
// sign
openssl rsautl -sign -in test.txt -inkey pri.key -out test.sign
// verify by private or public key
openssl rsautl -verify -in test.sign -inkey pri.key
openssl rsautl -verify -in test.sign -inkey cert.pem -certin
// encrypt or decrypt
openssl rsautl -encrypt -in test.txt -out test.enc -pubin -inkey pub.key
openssl rsautl -decrypt -in test.enc -inkey pri.key