生成自签证书2
Generate your CA Root 根证书
openssl genpkey -algorithm RSA -out rootkey.pem -pkeyopt rsa_keygen_bits:4096
openssl req -new -key rootkey.pem -days 5480 -extensions v3_ca -batch -out root.csr -utf8 -subj '/C=CN/ST=Guangdong/L=Guangzhou/O=zhihong.Co/OU=zhihong.technology'
vi openssl.root.cnf
basicConstraints = critical, CA:TRUE
keyUsage = keyCertSign, cRLSign
subjectKeyIdentifier = hash
nameConstraints = permitted;DNS:aizhan.com,permitted;DNS:aizhan.net
openssl x509 -req -sha256 -days 5479 -in root.csr -signkey rootkey.pem -set_serial 01 -extfile openssl.root.cnf -out root.pem
openssl x509 -in root.pem -out root.crt
Generate your Intermediate cert
openssl genpkey -algorithm RSA -out intkey.pem -pkeyopt rsa_keygen_bits:3072
openssl req -new -key intkey.pem -days 4383 -extensions v3_ca -batch -out int.csr -utf8 -subj '/C=CN/ST=Guangdong/L=Guangzhou/O=zhihong.Co.Develop/OU=zhihong.technology.Develop/CN=a'
vi openssl.int.cnf
basicConstraints = critical, CA:TRUE
authorityKeyIdentifier = keyid, issuer
subjectKeyIdentifier = hash
keyUsage = keyCertSign, cRLSign
extendedKeyUsage =serverAuth
authorityInfoAccess = OCSP;URI:http://ocsp.aizhan.com/
subjectAltName = DNS:aizhan.com, DNS:*.aizhan.com
openssl x509 -req -sha256 -days 4383 -in int.csr -CAkey rootkey.pem -CA root.pem -set_serial 01 -out int.pem -extfile openssl.int.cnf
openssl x509 -in int.pem -out int.crt
Generate the end entity certificate
openssl genpkey -algorithm RSA -out eekey.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -in eekey.pem -out entkey.pem
openssl req -new -key entkey.pem -days 3653 -extensions v3_ca -batch -out ent.csr -utf8 -subj '/O=zhihong.Co.Develop/OU=zhihong.technology.Develop/CN=aaaizhan.com'
vi openssl.ss.cnf
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
basicConstraints = critical, CA:FALSE
extendedKeyUsage =serverAuth
authorityInfoAccess = OCSP;URI:http://ocsp.aizhan.com:80/
subjectAltName = @alt_names
[alt_names]
DNS.1=aa.aizhan.com
openssl x509 -req -sha256 -days 3653 -in ent.csr -CAkey intkey.pem -CA int.pem -set_serial 01 -out ent.pem -extfile openssl.ss.cnf
#转换成crt文件
openssl x509 -in ent.pem -out ent.crt
#查看证书信息
openssl x509 -in ent.pem -text -noout
openssl x509 -in ent.pem -text -noout -purpose
在NGINX中使用entkey.pem、ent.pem
相关链接： https://wiki.mozilla.org/SecurityEngineering/x509Certs
问题来源