pzg's blog

记录一下最近测试服务自签证书的相关命令

生成根秘钥及根证书：

openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha512 -days 36666 -out ca.crt -subj “/C=CN/ST=Beijing/L=Beijing/O=MyTestCA/OU=Security/CN=MyTestRootCA”

使用根证书生成服务端证书

openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -subj “/C=CN/ST=Beijing/L=Beijing/O=MyServer/OU=Security/CN=Server”
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 36665 -sha512

使用根证书生成客户端证书及客户端p12文件

openssl genrsa -out client.key 4096
openssl req -new -key client.key -out client.csr -subj “/C=CN/ST=Beijing/L=Beijing/O=MyClient/OU=Security/CN=Client”
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 36665 -sha512
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12 -name “MyClientCert”

测试时使用IP证书的输出命令

openssl genrsa -out ipserver.key 4096

openssl req -new -key ipserver.key -out ipserver.csr \
-subj “/C=CN/ST=Beijing/L=Beijing/O=MyServer/OU=Security/CN=1.2.3.4” \
-addext “subjectAltName=IP:1.2.3.4” \
-addext “keyUsage=digitalSignature,keyEncipherment” \
-addext “extendedKeyUsage=serverAuth”

openssl x509 -req -in ipserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
-out ipserver.crt -days 36665 -sha512 \
-extfile <(printf “subjectAltName=IP:1.2.3.4\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth”)