openssl生免費證書--親自實踐有效

openssl生免費證書

1.建立文件夾而且建立證書私鑰

makdir -p /data/cert
cd /data/cert
openssl genrsa -des3 -out server.key 2048

效果以下,會讓你輸入密碼並確認密碼記住後邊有用。

Generating RSA private key, 2048 bit long modulus
......................................................................................................................+++
..........+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

2.根據證書私鑰進行生成證書

openssl req -new -key server.key -out server.csr

效果以下，填寫上邊的密碼，而後填寫我的信息，能夠隨便天寫

[root@zjdk cert]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
# 國家CN
Country Name (2 letter code) [XX]:CN 
# 省 
State or Province Name (full name) []:beijing 
# 城市
Locality Name (eg, city) [Default City]:beijing
# 組織名稱
Organization Name (eg, company) [Default Company Ltd]:xxxx
# 單位名稱
Organizational Unit Name (eg, section) []:xxxx
# 域名
Common Name (eg, your name or your server's hostname) []:crazyk.com.cn
# 郵箱
Email Address []:code_dking@163.com
Please enter the following 'extra' attributes
to be sent with your certificate request
# 不須要，剩下的兩個直接回車就能夠
A challenge password []:
An optional company name []:

3.備份私鑰

cp server.key server.key.org

4.轉換證書

#轉換爲證書
openssl rsa -in server.key.org -out server.key

效果以下，這個仍是須要輸入最開始填寫的密碼

[root@zjdk cert]# openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:
writing RSA key

5.給證書籤名

#給證書籤名
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

效果以下，表示成功，完結撒花

[root@zjdk cert]# openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=xx/OU=cre.com/CN=cer.com/emailAddress=code_dking.com
Getting Private key