OpenSSL生成证书的命令合集

发表于： 更新于：
字数： 1089 阅读：≈ 3分钟 浏览：

OpenSSL生成证书的命令合集

参考：

查看csr,crt,key​文件的信息

openssl req -noout -text -in server.csr
openssl x509 -noout -text -in server.crt
openssl rsa -noout -text -in server.key

三种生成根证书的等效方法（如果需要带密码，请删除 -nodes​ 选项，或在 genrsa 中添加 -aes256​ 选项，然后手动输入密码）

# 1. 一步到位
openssl req -new -x509 -days 9999 -nodes -newkey rsa:2048 -keyout ca.key -out ca.crt -addext keyUsage=critical,keyCertSign -subj "/C=US/CN=mitmproxy"
# 2. 先生成私钥，再自签名证书
# openssl genrsa -traditional -out ca.key 2048
# openssl req -new -x509 -days 9999 -key ca.key -out ca.crt -addext keyUsage=critical,keyCertSign -subj "/C=US/CN=mitmproxy"
# 3. 先生成私钥，再生成签名请求，再自签名证书
# openssl genrsa -traditional -out ca.key 2048
# openssl req -new -key ca.key -out ca.csr -addext keyUsage=critical,keyCertSign -subj "/C=US/CN=mitmproxy"
# openssl x509 -req -days 9999 -in ca.csr -signkey ca.key -out ca.crt -copy_extensions copyall
cat ca.key ca.crt > ca.pem

自动获取域名证书的信息，并用自己的根证书签发

DOMAIN="music.163.com"
echo | openssl s_client -connect "${DOMAIN}:443" -servername "${DOMAIN}" 2>/dev/null | openssl x509 -text > original_cert.crt
openssl genrsa -traditional -out "${DOMAIN}.key" 2048
openssl x509 -x509toreq -in original_cert.crt -out original_cert.csr -key "${DOMAIN}.key" -copy_extensions copyall
openssl x509 -req -in original_cert.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out "${DOMAIN}.crt" -days 365 -sha256 -copy_extensions copyall
cat "${DOMAIN}.crt" "${DOMAIN}.key" > "${DOMAIN}.pem"
rm original_cert.crt original_cert.csr
rm "${DOMAIN}.crt" "${DOMAIN}.key"

两种使用根证书为域名签发泛域名证书的方法

DOMAIN="music.163.com"
# 1. 先生成私钥和签名请求，再使用根证书签发证书
openssl req -new -nodes -newkey rsa:2048 -keyout "${DOMAIN}.key" -out "${DOMAIN}.csr" -subj "/C=CN/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN},DNS:*.${DOMAIN}" -addext "extendedKeyUsage=serverAuth"
openssl x509 -req -in "${DOMAIN}.csr" -CA ca.crt -CAkey ca.key -CAcreateserial -out "${DOMAIN}.crt" -days 365 -sha256 -copy_extensions copyall
cat "${DOMAIN}.crt" "${DOMAIN}.key" > "${DOMAIN}.pem"
# 2. 先生成私钥，再生成签名请求，再使用根证书签发证书
# openssl genrsa -traditional -out server.key 2048
# openssl req -new -key server.key -out server.csr -subj "/C=CN/CN=*.music.163.com" -addext "subjectAltName=DNS:music.163.com,DNS:*.music.163.com" -addext "extendedKeyUsage=serverAuth"
# openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -sha256 -copy_extensions copyall
# cat server.crt server.key > server.pem

使用根证书为IP签发证书的方法

DOMAIN="1.1.1.1"
# 1. 先生成私钥和签名请求，再使用根证书签发证书
openssl req -new -nodes -newkey rsa:2048 -keyout "${DOMAIN}.key" -out "${DOMAIN}.csr" -subj "/C=CN/CN=${DOMAIN}" -addext "subjectAltName=IP:${DOMAIN}" -addext "extendedKeyUsage=serverAuth"
openssl x509 -req -in "${DOMAIN}.csr" -CA ca.crt -CAkey ca.key -CAcreateserial -out "${DOMAIN}.crt" -days 365 -sha256 -copy_extensions copyall
cat "${DOMAIN}.crt" "${DOMAIN}.key" > "${DOMAIN}.pem"

自签发域名证书

DOMAIN="music.163.com"
openssl req -new -x509 -days 365 -nodes -newkey rsa:2048 -keyout "${DOMAIN}.key" -out "${DOMAIN}.csr" -subj "/C=CN/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN},DNS:*.${DOMAIN}" -addext "extendedKeyUsage=serverAuth"

自签发IP证书

DOMAIN="1.1.1.1"
openssl req -new -x509 -days 365 -nodes -newkey rsa:2048 -keyout "${DOMAIN}.key" -out "${DOMAIN}.csr" -subj "/C=CN/CN=${DOMAIN}" -addext "subjectAltName=IP:${DOMAIN}" -addext "extendedKeyUsage=serverAuth"

一些常见选项说明：

‍