1. 制作根證書密鑰

openssl genrsa -aes256 -passout pass:123456 -out root.key 2048

2. 制作證書申請文件

openssl req -new -key root.key -out root.csr

執(zhí)行命令后，會提示你輸入一些內(nèi)容，請按照提示輸入，每一項(xiàng)輸入的內(nèi)容需要自己記住

Enter pass phrase for root.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SH
Locality Name (eg, city) [Default City]:SH
Organization Name (eg, company) [Default Company Ltd]:XJ
Organizational Unit Name (eg, section) []:XJ
Common Name (eg, your name or your server's hostname) []:LDW XJ

3. 制作根證書

openssl x509 -req -days 365 -sha256 -extfile root.ext -extensions v3_ca -in root.csr -signkey root.key -out root.crt

其中root.ext手動創(chuàng)建，內(nèi)容如下:

[v3_ca]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true

4. 制作中間證書

openssl genrsa -out middle.key 4096
openssl req -new -key middle.key -out middle.csr
openssl x509 -req -extfile ca_intermediate.ext -extensions v3_intermediate_ca -days 365 -sha256 -CA root.crt -CAkey root.key -CAcreateserial -CAserial serial -in middle.csr -out middle.crt

中間證書的制作過程與根證書類似，這里直接將命令貼上。
這里涉及到一個(gè)ca_intermediate.ext，和root.ext類似，需要手動創(chuàng)建，內(nèi)容如下

# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

5. 中間證書的驗(yàn)證

openssl verify -CAfile root.crt middle.crt 

輸出結(jié)果應(yīng)該如下所示

middle.crt: OK

進(jìn)一步輸入一下命令進(jìn)行驗(yàn)證

openssl x509 -noout -text -in middle.crt

結(jié)果中必須包含如下類容

X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0

6. 基于中間證書生成服務(wù)端證書

中間證書的制作過程與根證書類似，這里直接將命令貼上。

openssl genrsa -aes256 -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -extfile server.ext -extensions v3_server -days 365 -sha256 -CA middle.crt -CAkey middle.key -CAserial serial -in server.csr -out server.crt

這里涉及到一個(gè)server.ext，這是為了適應(yīng)現(xiàn)代瀏覽器SSL證書標(biāo)準(zhǔn)。和root.ext類似，需要手動創(chuàng)建，內(nèi)容如下

[ v3_server ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

7. 服務(wù)端證書驗(yàn)證

cat middle.crt root.crt > middle-chain.crt
openssl verify -CAfile middle-chain.crt server.crt

執(zhí)行結(jié)果應(yīng)該和下面一致文章來源地址http://www.zghlxwxcb.cn/news/detail-489190.html

server.crt: OK

到了這里，關(guān)于openssl 生成自簽名證書以及CA證書鏈的文章就介紹完了。如果您還想了解更多內(nèi)容，請?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！