OpenSSL生成证书申请-增加可选名称

1.修改

修改vim /etc/pki/tls/openssl.cnf

# 取消req下被注释的第2行
[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req

 

# 删除req_distinguished_name下的0.xxx 的标签，把0.xxx的0. 去掉
[ req_distinguished_name ]
countryName              = Country Name (2 letter code)
countryName_default = CN
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default = ShangHai
localityName              = Locality Name (eg, city)
localityName_default = ShangHai
organizationalUnitName             = Organizational Unit Name (eg, section)
organizationalUnitName_default = Domain Control Validated
commonName         = Internet Widgits Ltd
commonName_max = 64

 

# 在[ v3_req ]下新增最后一行内容 subjectAltName = @alt_names
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

 

# 新增 alt_names,注意括号前后的空格，DNS.x 的数量可以自己加
[ alt_names ]
DNS.1 = *.test.com
DNS.2 = a.test.cn

 

2.生成私钥和证书申请文件：

openssl genrsa -out private.key 1024

openssl req -new -key private.key -out cert.csr

cert.csr即为证书申请文件