生成自签证书-MyPC

根证书

Generate your CA Root

openssl genpkey -algorithm RSA -out rootkey.pem -pkeyopt rsa_keygen_bits:4096

openssl req -new -key rootkey.pem -days 5480 -extensions v3_ca -batch -out root.csr -utf8 -subj '/C=CN/ST=Guangdong/L=Guangzhou/O=boyuvm.Co/OU=boyuvm.Technology'

vi openssl.root.cnf
basicConstraints = critical, CA:TRUE
keyUsage = keyCertSign, cRLSign
subjectKeyIdentifier = hash

openssl x509 -req -sha256 -days 5480 -in root.csr -signkey rootkey.pem -set_serial 01 -extfile openssl.root.cnf -out root.pem

openssl x509 -in root.pem -out root.crt

生成中间证书

Generate your Intermediate cert

openssl genpkey -algorithm RSA -out intkey.pem -pkeyopt rsa_keygen_bits:3072

openssl req -new -key intkey.pem -out int.csr -utf8 -subj '/C=CN/ST=Guangdong/L=Guangzhou/O=boyuvm.Co/OU=boyuvm.Technology/CN=boyuvm Intermediate CA'

vi openssl.int.cnf
[v3_ca]
basicConstraints = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer

#用根证书签发中间证书
openssl x509 -req -sha256 -days 4383 -in int.csr -CAkey rootkey.pem -CA root.pem -set_serial 01 -out int.pem -extfile openssl.int.cnf -extensions v3_ca

openssl x509 -in int.pem -out int.crt

#验证中间证书是否正确
openssl x509 -in int.pem -text -noout | grep -E "CA:|Constraints"
#应该输出: X509v3 Basic Constraints: critical CA:TRUE

#验证中间证书是否能被根证书验证
openssl verify -CAfile root.pem int.pem
#应该输出: int.pem: OK

生成最终实体证书

Generate the end entity certificate

openssl genpkey -algorithm RSA -out entkey.pem -pkeyopt rsa_keygen_bits:2048

openssl req -new -key entkey.pem -batch -out ent.csr -utf8 -subj '/CN=*.boyuvm.com/O=boyuvm.Co/OU=boyuvm.Technology'

vi openssl.ss.cnf

[v3_req]
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature, keyEncipherment
basicConstraints = critical, CA:FALSE
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names

# 主题备用名 - 这里配置所有域名和IP
subjectAltName = @alt_names

# 可选：CRL分发点
# crlDistributionPoints = URI:http://crl.boyuvm.com/intermediate.crl

# 可选：OCSP装订
# authorityInfoAccess = OCSP;URI:http://ocsp.boyuvm.com/

subjectAltName = @alt_names
[alt_names]
# 域名部分
DNS.1 = boyuvm.com
DNS.2 = *.boyuvm.com
DNS.3 = localhost
DNS.4 = *.localhost

# IP地址部分
IP.1 = 127.0.0.1
IP.2 = 192.168.88.21
IP.3 = 192.168.88.22
IP.4 = 192.168.88.23
IP.5 = 192.168.88.24
IP.6 = 192.168.88.25
IP.7 = 192.168.88.41
IP.8 = 192.168.88.42
IP.9 = 192.168.88.43
IP.10 = 192.168.88.44
IP.11 = 192.168.88.45

openssl x509 -req -sha256 -days 3653 -in ent.csr -CAkey intkey.pem -CA int.pem -set_serial 01 -out ent.pem -extfile openssl.ss.cnf -extensions v3_req

# 验证完整证书链
openssl verify -CAfile root.pem -untrusted int.pem ent.pem
# 应该输出: ent.pem: OK

#转换成crt文件
openssl x509 -in ent.pem -out ent.crt

#查看证书信息
openssl x509 -in ent.pem -text -noout
openssl x509 -in ent.pem -text -noout -purpose

配置Web服务器（Nginx/Apache）

服务器需要完整的证书链：

# 创建完整的证书链文件（包含终端证书和中间证书）
cat ent.pem int.pem > nginx.cert.pem
# 或包含根证书（但不推荐）
# cat ent.pem int.pem root.pem > nginx.cert_with_root.pem

cp entkey.pem nginx.cert_key.pem

# Nginx配置示例
ssl_certificate     /path/to/nginx.cert.pem;      # 包含 ent.pem + int.pem
ssl_certificate_key /path/to/nginx.cert_key.pem;         # 只包含私钥