1

openssl genrsa -out server.key 2048

1

openssl req -new -sha256 -x509 -days 3650 -key server.key -out server.crt

1

openssl req -new -key server.key -out server.csr

1

openssl genrsa -des3 -out ca.key 4096

1

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

[ ca ]
default_ca       = ca_default
[ ca_default ]
dir          = /etc/ssl/diyca # 指定了CA的根目录
certs        = $dir/certs            # 已经签发的证书的存储目录
crl_dir      = $dir/crl            # 存储证书吊销列表的目录
database     = $dir/index.txt      # 数据库的索引文件，用来存放签发证书的信息。
#unique_subject  = no               #设置为’no’表示允许同时创建多个相同主题的证书。
new_certs_dir = $dir/newcerts        # 设置存放新签发的证书的默认位置
Certificate   = $dir/cacert.pem # 指定CA证书
serial        = $dir/serial          # 指定存放当前序列号的文件,写入00即可
crl           = $dir/crl.pem         # 当前的CRL
private_key   = $dir/private/cakey.pem # CA的私钥
default_md = md5
RANDFILE      = $dir/private/.rand   #指明一个用来读写时候产生random key的seed文件。
policy= policy_match

[ policy_match ]
countryName= match
stateOrProvinceName= match
organizationName= match
organizationalUnitName= optional
commonName= supplied
emailAddress= optional

[ policy_anything ]
countryName = optional
stateOrProvinceName= optional
localityName= optional
organizationName = optional
organizationalUnitName = optional
commonName= supplied
emailAddress= optional

1

openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -days 3650

1

cp /etc/ssl/diyca/newcerts/00.pem server.pem