shell脚本生成证书SAN证书，chrome自签名证书无效。

san证书是什么：

SAN(Subject Alternative Name) 是 SSL 标准 x509 中定义的一个扩展。使用了 SAN 字段的 SSL 证书，可以扩展此证书支持的域名，使得一个证书可以支持多个不同域名的解析。

不含该扩展的证书，已经被chrome识别为不安全了，那么现在就要生成带SAN扩展的证书。

#!/bin/bash

C=CN
ST=HeNan
L=ZhengZhhou
O=FreeNet
CAOU=CA
CACN=ca.test.com
SERVERCN=test.jackadam.top
CLIENTCN=client.test.com
emailAddress=test@sina.com


echo "生成CA证书"
echo "创建CA私钥"
openssl genrsa -out ./ca.pem 4096 

echo "创建CA签名请求"
openssl req -new -key ./ca.pem -out ./ca.csr -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${CAOU}/CN=${CACN}/emailAddress=${emailAddress}"

echo "生成自签名CA证书(ca.cert)"
openssl x509 -req -days 3650 -in ./ca.csr -signkey ./ca.pem -out ./ca.crt


echo "生成Server证书"
echo "生成服务端私钥(server.pem)"
openssl genrsa -out ./server.pem 4096

echo "生成服务端证书签名请求(server.csr)"
openssl req -new -key ./server.pem -out ./server.csr -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${CAOU}/CN=${SERVERCN}/emailAddress=${emailAddress}"

echo "使用ca证书签署服务端csr以生成服务端证书(server.cert)"
openssl x509 -req -in ./server.csr -CA ./ca.crt -CAkey ./ca.pem -CAcreateserial -out ./server.crt -days 3650



echo "生成Client证书（用于双向认证）"
echo "生成客户端私钥(client.pem)"
openssl genrsa -out ./client.pem 4096

echo "生成客户端证书签名请求(client.csr)"
openssl req -new -key ./client.pem -out ./client.csr -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${CAOU}/CN=${CLIENTCN}/emailAddress=${emailAddress}"

echo "使用ca证书签署客户端csr以生成客户端证书(client.cert)"
openssl x509 -req -in ./client.csr -CA ./ca.crt -CAkey ./ca.pem -CAcreateserial -out ./client.crt -days 3650


echo "SAN证书"
echo "SANserver私钥"
openssl genrsa -out ./SANserver.pem 4096


echo "SANserver证书请求"
openssl req -new -sha256 -key ./SANserver.pem \
    -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${CAOU}/CN=${CLIENTCN}/emailAddress=${emailAddress}" \
    -extensions v3_req \
    -config <(cat /etc/pki/tls/openssl.cnf \
        <(printf "[req]\nreq_extensions = req_ext\n[req_ext]\nsubjectAltName=DNS:${SERVERCN}")) \
    -out SANserver.csr 
    
echo "Openssl 不带入请求中的san扩展"
openssl x509 -req -in ./SANserver.csr -CA ./ca.crt -CAkey ./ca.pem -CAcreateserial -out ./SANserver.crt -days 3650


    
echo "查看请求文件"
openssl req -noout -text -in SANserver.csr 

echo "查看证书"
openssl x509 -text -noout -in SANserver.crt



echo "Openssl，手动配置san扩展"
echo "openssl,无法从csr证书请求文件中复制x509选项，必须手动配置进去。"
openssl genrsa -out ./test.pem 1024 
echo "证书请求"
openssl req -new -sha256 \
    -key ./test.pem \
    -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${CAOU}/CN=${CLIENTCN}/emailAddress=${emailAddress}" \
    -extensions v3_req \
    -config <(cat /etc/pki/tls/openssl.cnf \
        <(printf "[v3_req]\nsubjectAltName=DNS:${SERVERCN}")) \
    -out test.csr 
echo "签名证书"
openssl req -new -sha256  \
    -x509 \
    -days 10000 \
    -key ./test.pem \
    -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${CAOU}/CN=${CLIENTCN}/emailAddress=${emailAddress}" \
    -extensions SAN \
    -config <(cat /etc/pki/tls/openssl.cnf \
        <(printf "[SAN]\nsubjectAltName=DNS:${SERVERCN}")) \
    -out test.crt
openssl req -noout -text -in test.csr 
openssl x509 -text -noout -in test.crt