Generate client private key:

1

openssl genrsa -out server.key 2048

Generate client certificate:

1

openssl req -new -sha256 -x509 -days 3650 -key server.key -out server.crt

Certificate application file:

1

openssl req -new -key server.key -out server.csr

Generate CA private key

Use des3 encryption, and enter a password of more than 4 digits:

1

openssl genrsa -des3 -out ca.key 4096

Generate CA certificate

1

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

CA configuration file /private/etc/ssl/openssl.cnf (I am using mac system here) add the following configuration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

[ca]
default_ca = ca_default
[ca_default]
dir = /etc/ssl/diyca # Specifies the root directory of CA
certs = $dir/certs # Storage directory for issued certificates
crl_dir = $dir/crl # Directory for storing certificate revocation lists
database = $dir/index.txt # Database index file, used to store information about issued certificates.
#unique_subject = no #Set to 'no' to allow the creation of multiple certificates with the same subject at the same time.
new_certs_dir = $dir/newcerts # Set the default location for storing newly issued certificates
Certificate = $dir/cacert.pem # Specify the CA certificate
serial = $dir/serial # Specify the file to store the current serial number, just write 00
crl = $dir/crl.pem # Current CRL
private_key = $dir/private/cakey.pem # CA private key
default_md = md5
RANDFILE = $dir/private/.rand # Specify a seed file used to generate a random key when reading and writing.
policy= policy_match [ policy_match ] countryName= match stateOrProvinceName= match organizationName= match organizationalUnitName= optional commonName= supplied emailAddress= optional [ policy_anything ] countryName = optional stateOrProvinceName= optional localityName= optional organizationName = optional organizationalUnitName = optional commonName= supplied emailAddress= optional ```` # CA issues certificate: ````shell openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -days 3650 ``` server.pem is the signed certificate ```shell cp /etc/ssl/diyca/newcerts/00.pem server.pem

Take server.key and server.pem and deploy them on the web server. It should be noted that self-signed certificates may not be trusted by common browsers.