OpenSSL自签根证书 - Githubissues

ourfor commented 3 years ago

openssl req -x509 -nodes -new -sha256 -days 365 -newkey rsa:2048 -keyout RootCA.key -out RootCA.pem -subj "/OU=ourfor/CN=${USER}/ST=Beijing/C=CN/CN=Kitty Inc CA"
openssl x509 -outform pem -in RootCA.pem -out RootCA.crt

openssl req -new -nodes -newkey rsa:2048 -keyout localhost.key -out localhost.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=Kitty Inc/CN=localhost"
openssl x509 -req -sha256 -days 365 -in localhost.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -extfile domains.ext -out localhost.crt

domains.ext

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
DNS.2 = fake1.local
DNS.3 = fake2.local
DNS.4 = mb3admin.com

证书的有效期不要超过13个月
domians.ext里面需要包含使用的域名
只需要信任根证书即可

ourfor commented 3 years ago

Linux安装自签名证书将证书复制到/etc/pki/ca-trust/source/anchors/目录下面，然后运行命令update-ca-trust，系统会将证书写到受信任的证书列表中，也就是 /etc/ssl/certs 下的文件中。有些语言，比如java和c#有自己信任的证书目录，需要自己更新下

ourfor commented 2 years ago

合并生成p12文件

openssl pkcs12 -export -in snail.lan.crt -inkey snail.lan.key -certfile RootCA.pem -out snail.lan.p12

ourfor commented 1 year ago

/etc/ssl/certs/ca-certificates.crt

ourfor / blog

OpenSSL自签根证书 #52