openssl自签发https证书

港控/mmm° 2023-07-17 15:39 16阅读 0赞

**步骤：**

# 生成CA私钥与CA证书
    openssl genrsa -out cakey.pem 2048
    openssl req -new -x509 -sha256  -key cakey.pem -out cacert.pem -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
    # 生成服务端私钥与证书
    openssl genrsa -out server.key 2048
    openssl req -new -sha256 -key server.key -out server.csr -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
    # CA为服务端证书签名
    openssl x509 -req -sha256 -in server.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out server.crt
    #查看证书命令
    openssl x509 -noout -text -in server.crt

**下面是一个完整的过程示例：**

[root@server1 helloworld]# openssl genrsa -out cakey.pem 2048
    Generating RSA private key, 2048 bit long modulus
    ...............+++
    .............................+++
    e is 65537 (0x10001)
    [root@server1 helloworld]# openssl req -new -x509 -sha256  -key cakey.pem -out cacert.pem -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
    [root@server1 helloworld]# openssl genrsa -out server.key 2048
    Generating RSA private key, 2048 bit long modulus
    .....................................................+++
    ....................+++
    e is 65537 (0x10001)
    [root@server1 helloworld]# openssl req -new -sha256 -key server.key -out server.csr -days 3650 -subj /C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
    [root@server1 helloworld]# openssl x509 -req -sha256 -in server.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out server.crt
    Signature ok
    subject=/C=CN/ST=JiangSu/L=NanJing/O=Shanhy/OU=Shanhy/CN=helloworld.shanhy.com
    Getting CA Private Key
    [root@server1 helloworld]# openssl x509 -noout -text -in server.crt

--------------------

（END）