乐趣区

关于环境搭建:openssl生免费证书亲自实践有效

jiezi

openssl 生收费证书

1. 创立文件夹并且创立证书私钥 

makdir -p /data/cert
cd /data/cert
openssl genrsa -des3 -out server.key 2048

成果如下, 会让你输出明码并确认明码记住后边有用。

Generating RSA private key, 2048 bit long modulus
......................................................................................................................+++
..........+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

2. 依据证书私钥进行生成证书 

openssl req -new -key server.key -out server.csr

成果如下，填写上边的明码，而后填写个人信息，能够轻易天写 

[root@zjdk cert]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
# 国家 CN
Country Name (2 letter code) [XX]:CN 
# 省 
State or Province Name (full name) []:beijing 
# 城市
Locality Name (eg, city) [Default City]:beijing
# 组织名称
Organization Name (eg, company) [Default Company Ltd]:xxxx
# 单位名称
Organizational Unit Name (eg, section) []:xxxx
# 域名
Common Name (eg, your name or your server's hostname) []:crazyk.com.cn
# 邮箱
Email Address []:code_dking@163.com
Please enter the following 'extra' attributes
to be sent with your certificate request
# 不须要，剩下的两个间接回车就能够
A challenge password []:
An optional company name []:

3. 备份私钥 

cp server.key server.key.org

4. 转换证书 

# 转换为证书
openssl rsa -in server.key.org -out server.key

成果如下，这个还是须要输出最开始填写的明码 

[root@zjdk cert]# openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:
writing RSA key

5. 给证书签名 

# 给证书签名
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

成果如下，示意胜利，完结撒花 

[root@zjdk cert]# openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=xx/OU=cre.com/CN=cer.com/emailAddress=code_dking.com
Getting Private key
退出移动版