Git Bash OpenSSL – Generate Self Signed Certificate
前言
以前就写过了, 只是写的太乱, 这篇是一个整理版. 以前的文章:
我已经没有用 PowerSheel 做证书了, 所以就不介绍了.
参考:
generate-trusted-ssl-certificate
Git Bash OpenSSL
OpenSSL 是最终使用的 tool, 它是 Linux 世界的东西, 要跑它最好是通过 Git.
安装 Git. Git 里面又有一个冬冬叫 Bash.
所以 Git > Bash > OpenSSL
Create .sh and .cnf
创建一个 folder 和 2 个 files
1. openssl.cnf

[ req ] default_bits = 2048 default_md = sha256 default_days = 825 encrypt_key = no distinguished_name = subject req_extensions = req_ext x509_extensions = x509_ext string_mask = utf8only prompt = no # The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description). # Its sort of a mashup. For example, RFC 4514 does not provide emailAddress. [ subject ] countryName = MY stateOrProvinceName = Johor localityName = Skudai organizationName = Stooges Web Design OU = Engineering # Use a friendly name here because it's presented to the user. The server's DNS # names are placed in Subject Alternate Names. Plus, DNS names here is deprecated # by both IETF and CA/Browser Forums. If you place a DNS name here, then you # must include the DNS name in the SAN too (otherwise, Chrome and others that # strictly follow the CA/Browser Baseline Requirements will fail). commonName = 192.168.1.152 emailAddress = stoogeswebdesign@gmail.com # Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ... [ x509_ext ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer # You only need digitalSignature below. *If* you don't allow # RSA Key transport (i.e., you use ephemeral cipher suites), then # omit keyEncipherment because that's key transport. basicConstraints = critical, CA:TRUE keyUsage = critical, digitalSignature, keyEncipherment, cRLSign, keyCertSign subjectAltName = @alternate_names extendedKeyUsage = serverAuth # RFC 5280, Section 4.2.1.12 makes EKU optional # CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused # In either case, you probably only need serverAuth. #extendedKeyUsage = TLS Web Server Authentication # Section req_ext is used when generating a certificate signing request. I.e., openssl req ... [ req_ext ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alternate_names nsComment = "OpenSSL Generated Certificate" # RFC 5280, Section 4.2.1.12 makes EKU optional # CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused # In either case, you probably only need serverAuth. # extendedKeyUsage = serverAuth, clientAuth [ alternate_names ] IP.1 = 192.168.1.152 DNS.1 = *.192.168.1.152 DNS.2 = 192.168.1.152
它是一个 config file, 把 IP 和公司信息换掉就可以了。
2. generate.sh
它是一个 command file, 内容是
#!/bin/bash openssl req -days 825 -config openssl.cnf -new -x509 -out 192.168.1.152.crt -keyout 192.168.1.152.key
config link to 上面的 openssl.cnf, IP 换掉就可以了。
825 days 是因为 IOS 的限制,不能放太久。
openssl.cnf 里虽然也 set 了 default_days 但是,那个好像不适用于 openssl req command,所以这里还需要 set 一次。
for localhost
如果是做 localhost certificate,openssl.cnf 里的 IP.1 需要放 127.0.0.1,其它的地方把 192.168.1.152 换成 localhost 就可以了。
Run command
对着 folder 打开 Git Bash
然后输入 command
bash generate.sh
它会生成 2 个 files, .crt 和 .key.
Convert to .pfx
继续输入 command
openssl pkcs12 -export -out 192.168.1.152.pfx -inkey 192.168.1.152.key -in 192.168.1.152.crt
在输入密码就可以了.
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】博客园社区专享云产品让利特惠,阿里云新客6.5折上折
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 在鹅厂做java开发是什么体验
· 百万级群聊的设计实践
· WPF到Web的无缝过渡:英雄联盟客户端的OpenSilver迁移实战
· 永远不要相信用户的输入:从 SQL 注入攻防看输入验证的重要性
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
2015-03-20 Entity Framewor 学习笔记 (include + where)