If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN ← 国度名目，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省名，拼音
Locality Name (eg, city) []:BeiJing ← 市名，拼音Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 能够不输入Common Name (eg, YOUR name) []:om ← 服务器主机名，若填写不准确，博览器会报告证书无效，但并不波及利用
Email Address []:admin@mycompany ← ，可容易填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 能够不输入
An optional company name []: ← 能够不输入
6. 创立自目前日期起管用期为期两年的服务器证书：openssl x509 -req -days 730 -sha1 -extensions v3_req - -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -
输出内容为：
[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req - -CAkey root.key -CAcreateserial -in server.csr - 1. 创立根证书密钥文件(自己做CA)root.key：
openssl genrsa -des3 -out root.key
输出内容为：
[lenin@archer ~]$ openssl genrsa -des3 -out root.key Generating RSA private key, 512 bit long modulus ……………..++++++++++++
..++++++++++++
e is 65537 (0×10001)
Enter pass phrase for root.key: ← 输入一个新密码
Verifying – Enter pass phrase for root.key: ← 重新输入一遍密码
2. 创立根证书的申请文件root.csr：
openssl req -new -key root.key -out root.csr
输出内容为：
[lenin@archer ~]$ openssl req -new -key root.key -out root.csr Enter pass phrase for root.key: ← 输入前面创立的密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.whflsc’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN ← 国度代号，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音
Locality Name (eg, city) []:BeiJing ← 市的全名，拼音Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 能够不输入Common Name (eg, YOUR name) []: ← 此刻不输入
Email Address []:admin@mycompany ← ，可容易填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 能够不输入
An optional company name []: ← 能够不输入
3. 创立一个自目前日期起为期十年的根证书：openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -q -
输出内容为：
[lenin@archer ~]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./emailAddress=admin@mycompany
Getting Private key
Enter pass phrase for root.key: ← 输入前面创立的密码4. 创立服务器证书密钥server.key：
openssl genrsa –des3 -out server.key 2048
输出内容为：
[lenin@archer ~]$ openssl genrsa -out server.key 2048 Generating RSA private key, 2048 bit long modulus
….+++
…………………………………………..+++
e is 65537 (0×10001)
运行时会提醒输入密码，此密码用于加密key文件(参数des3便是指加密算法，当然也能够拨取其他你感受平安的算法.)，尔后每当需读取此文件(穿越openssl供给的号召或API)都需输入口令.万一感受不得体，也能够肃清这个口令，但定然要批准其他的防御措施!
肃清key文件口令的号召:
openssl rsa -in server.key -out server.key
5.创立服务器证书的申请文件server.csr：
openssl req -new -key server.key -out server.csr
输出内容为：
[lenin@archer ~]$ openssl req -new -key server.key -q You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
了一个.pem文件（直接拷贝过去就行了）Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany
Corp./CN=om/emailAddress=admin@mycompany
Getting CA Private Key
Enter pass phrase for root.key: ← 输入前面创立的密码
7. 创立客户端证书密钥文件client.key：
openssl genrsa -des3 -out client.key 2048
输出内容为：
免费ssl证书永久生成[lenin@archer ~]$ openssl genrsa -des3 -out client.key 2048
Generating RSA private key, 2048 bit long modulus
……………………………………………………………………
………..+++
……………………………………………………………………
………………………………….+++
e is 65537 (0×10001)
Enter pass phrase for client.key: ← 输入一个新密码
Verifying – Enter pass phrase for client.key: ← 重新输入一遍密
码
8. 创立客户端证书的申请文件client.csr：
openssl req -new -key client.key -out client.csr
输出内容为：
[lenin@archer ~]$ openssl req -new -key client.key -out client.csr
Enter pass phrase for client.key: ← 输入上一步中创立的密码
You are about to be asked to enter information that will be
incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN ← 国度名目，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省名目，拼音
Locality Name (eg, city) []:BeiJing ← 市名目，拼音Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 能够不填Common Name (eg, YOUR name) []:Lenin ← 自己的英文名，能够容易填
Email Address []:admin@mycompany ← ，能够容易填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 能够不填
An optional company name []: ← 能够不填
9. 创立一个自目前日期起管用期为两年的客户端证书bf.0431bf：
openssl x509 -req -days 730 -sha1 -extensions v3_req - -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -
输出内容为：
[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req - -CAkey root.key -CAcreateserial -in client.csr -
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=om/emailAddress=admin@mycompany
Getting CA Private Key
Enter pass phrase for root.key: ← 输入上面创立的密码
10. 将客户端证书文件和客户端证书密钥文件client.key并合成客户端证书安装包client.pfx：
openssl pkcs12 -export - -inkey client.key -out client.pfx
输出内容为：
[lenin@archer ~]$ openssl pkcs12 -export -in -inkey client.key -out client.pfx Enter pass phrase for client.key: ← 输入上面创立的密码
Enter Export Password: ← 输入一个新的密码，用作客户端证书的防御密码，在客户端安装证书时必需输入此密码Verifying – Enter Export Password: ← 确认密码
11. 保留生成的文件备用，其中和server.key是搭配单向SSL时必需利用的证书文件，是搭配双向SSL 时必需利用的证书文件，client.pfx是搭配双向SSL时必需客户端安装的证书文件
.crt文件和.key能够合到一个文件里面，把2个文件融合

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。