openssl证书 自签发 和私有CA证书几签发

openssl证书 自签发 

# server 端自签发证书

?

1 2	openssl genrsa -out server.key 2048 openssl req -new   -days 3650 -subj "/C=GB/L=China/O=gobook/CN=server.io"  -key server.key  -out server.csr

# client 客户端 自签发证书

?

1 2	openssl genrsa -out client.key 2048 openssl req -new -x509 -days 3650 -subj "/C=GB/L=China/O=gobook/CN=client.io" -key client.key -out client.crt

　

# 通过服务器ca证书签发机构签发证书

# 服务器ca证书签发

?

1 2	openssl  genrsa -out ca.key 2048 openssl req -new -x509 -days 3650 -subj "/C=GB/L=China/O=gobook/CN=github.com" -key ca.key -out ca.crt

# server端签发证书

?

1 2	openssl req -new    -subj "/C=GB/L=China/O=gobook/CN=server.io"  -key server.key  -out server.csr openssl x509 -req -sha256  -CA ca.crt -CAkey ca.key  -CAcreateserial -days 3650 -in server.csr  -out server.crt

# client 端签发证书

?

1 2	openssl  req -new  -subj "/C=GB/L=China/O=gobook/CN=client.io" -key client.key -out client.csr openssl x509 -req -sha256  -CA ca.crt -CAkey ca.key  -CAcreateserial -days 3650 -in client.csr -out client.cr

 

签发证书进行验证

?

1 2 3 4

root@localhost:~/ca# openssl verify    -CAfile ca.crt  client.crt client.crt: OK root@localhost:~/ca# openssl verify    -CAfile ca.crt  server.crt server.crt: OK