openssl

openssl

1.生成私钥
openssl genrsa -des3 -out server.key 1024


除去口令
openssl rsa -in server.key -out server.key

2.生成CSR
openssl req -new -key server.key -out server.csr

3.生成CRT
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

4.客服端同理
openssl genrsa -des3 -out client.key 1024
openssl req -new -key client.key -out client.csr -config openssl.cnf
Openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf

5.合成pem
cat ca.crt ca.key> ca.pem
cat server.crt server.key > server.pem

备注:
对于nginx, 使用key和crt也够了, 可以不合成pem


查看证书
--------------------------------------------------
openssl rsa -noout -text -in server.key
openssl req -noout -text -in server.csr

openssl x509 -noout -text -in server.crt

验证证书
openssl verify server.crt