openssl手工生成证书

等闲理况下，万一能找到可用的证书，就能够直接利用，只不过会因证书的某些消息不准确或与安排证书的主机不相称而导致博览器提醒证书无效，但这并不波及利用。

必需手工生成证书的情形有：

找不到可用的证书 必需搭配双向SSL，但欠缺客户端证书 必需对证书作尤其的定制

率先，无论是在Linux下还是在Windows下的Cygwin中，举行下面的垄断前都须确认已安装OpenSSL软件包。

1. 创立根证书密钥文件(自己做CA)root.key：

openssl genrsa -des3 -out root.key

输出内容为：

[lenin@archer ~]$ openssl genrsa -des3 -out root.key

Generating RSA private key, 512 bit long modulus

……………..++++++++++++

..++++++++++++

e is 65537 (0×10001)

Enter pass phrase for root.key: ← 输入一个新密码

Verifying – Enter pass phrase for root.key: ← 重新输入一遍密码

2. 创立根证书的申请文件root.csr：

openssl req -new -key root.key -out root.csr

输出内容为：

[lenin@archer ~]$ openssl req -new -key root.key -out root.csr

Enter pass phrase for root.key: ← 输入前面创立的密码

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.whflsc.com’, the field will be left blank.

—–

Country Name (2 letter code) [AU]:CN ← 国度代号，中国输入CN

State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音

Locality Name (eg, city) []:BeiJing ← 市的全名，拼音

Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名

Organizational Unit Name (eg, section) []: ← 能够不输入

Common Name (eg, YOUR name) []: ← 此刻不输入

Email Address []:admin@mycompany.com ← 电子邮箱，可容易填

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []: ← 能够不输入

An optional company name []: ← 能够不输入

3. 创立一个自目前日期起为期十年的根证书root.crt：

openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.req -out root.crt

输出内容为：

[lenin@archer ~]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt

Signature ok

subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./emailAddress=admin@mycompany.com

Getting Private key

Enter pass phrase for root.key: ← 输入前面创立的密码

4. 创立服务器证书密钥server.key：

openssl genrsa –des3 -out server.key 2048

输出内容为：

[lenin@archer ~]$ openssl genrsa -out server.key 2048

Generating RSA private key, 2048 bit long modulus

….+++

…………………………………………..+++

e is 65537 (0×10001)

运行时会提醒输入密码,此密码用于加密key文件(参数des3便是指加密算法,当然也能够拨取其他你感受平安的算法.),尔后每当需读取此文件(穿越openssl供给的号召或API)都需输入口令.万一感受不得体,也能够肃清这个口令,但定然要批准其他的防御措施!

肃清key文件口令的号召:

openssl rsa -in server.key -out server.key

5.创立服务器证书的申请文件server.csr：

openssl req -new -key server.key -out server.csr

输出内容为：

[lenin@archer ~]$ openssl req -new -key server.key -out server.req

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

—–

Country Name (2 letter code) [AU]:CN ← 国度名目，中国输入CN

State or Province Name (full name) [Some-State]:BeiJing ← 省名，拼音

Locality Name (eg, city) []:BeiJing ← 市名，拼音

Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名

Organizational Unit Name (eg, section) []: ← 能够不输入

Common Name (eg, YOUR name) []:om ← 服务器主机名，若填写不准确，博览器会报告证书无效，但并不波及利用

Email Address []:admin@mycompany.com ← 电子邮箱，可容易填

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []: ← 能够不输入

An optional company name []: ← 能够不输入

6. 创立自目前日期起管用期为期两年的服务器证书server.crt：

openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -out server.crt

输出内容为：

[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in server.csr -out server.crt

Signature ok

subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=om/emailAddress=admin@mycompany.com

Getting CA Private Key

Enter pass phrase for root.key: ← 输入前面创立的密码

7. 创立客户端证书密钥文件client.key：

openssl genrsa -des3 -out client.key 2048

输出内容为：

[lenin@archer ~]$ openssl genrsa -des3 -out client.key 2048

Generating RSA private key, 2048 bit long modulus

……………………………………………………………………………..+++

……………………………………………………………………………………………………….+++

e is 65537 (0×10001)

Enter pass phrase for client.key: ← 输入一个新密码

Verifying – Enter pass phrase for client.key: ← 重新输入一遍密码

8. 创立客户端证书的申请文件client.csr：

openssl req -new -key client.key -out client.csr

输出内容为：

[lenin@archer ~]$ openssl req -new -key client.key -out client.csr

Enter pass phrase for client.key: ← 输入上一步中创立的密码

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

—–

Country Name (2 letter code) [AU]:CN ← 国度名目，中国输入CN

State or Province Name (full name) [Some-State]:BeiJing ← 省名目，拼音

Locality Name (eg, city) []:BeiJing ← 市名目，拼音

Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名

Organizational Unit Name (eg, section) []: ← 能够不填

Common Name (eg, YOUR name) []:Lenin ← 自己的英文名，能够容易填

Email Address []:admin@mycompany.com ← 电子邮箱，能够容易填

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []: ← 能够不填

An optional company name []: ← 能够不填

9. 创立一个自目前日期起管用期为两年的客户端证书client.crtbf.0431bf.com：

openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -out client.crt

输出内容为：

[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in client.csr -out client.crt

Signature ok

subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=om/emailAddress=admin@mycompany.com

Getting CA Private Key

Enter pass phrase for root.key: ← 输入上面创立的密码

10. 将客户端证书文件client.crt和客户端证书密钥文件client.key并合成客户端证书安装包client.pfx：

openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx

输出内容为：

[lenin@archer ~]$ openssl pkcs12 -export -in client75.xihuanplaza.com.crt -inkey client.key -out client.pfx

Enter pass phrase for client.key: ← 输入上面创立的密码

Enter Export Password: ← 输入一个新的密码，用作客户端证书的防御密码，在客户端安装证书时必需输入此密码

Verifying – Enter Export Password: ← 确认密码

11. 保留生成的文件备用，其中server.crt和server.key是搭配单向SSL时必需利用的证书文件，client.crt是搭配双向SSL时必需利用的证书文件，client.pfx是搭配双向SSL时必需客户端安装的证书文件

.crt文件和.key能够合到一个文件里面，把2个文件融合了一个.pem文件（直接拷贝过去就行了）