如何在linux系统内用openssl 生成 过期的证书

需求：验证过期的证书在系统中不能使用。

问题：如何生成过期的证书呢？

解决方法：1.调整系统时间

                  2.生成证书

                  3.验证证书startdate 和 enddate 是否符合你的预期

1.调整系统时间

          1.Set date from the command line：

 date +%Y%m%d -s "20120418" 

          2.Set time from the command line：

 date +%T -s "11:14:00" 

2. 生成证书

       参考连接：https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

Generate a Self-Signed Certificate

Use this method if you want to use HTTPS (HTTP over TLS) to secure your Apache HTTP or Nginx web server, and you do not require that your certificate is signed by a CA.

This command creates a 2048-bit private key (domain.key) and a self-signed certificate (domain.crt) from scratch:

openssl req \
       -newkey rsa:2048 -nodes -keyout domain.key \
       -x509 -days 365 -out domain.crt

Answer the CSR information prompt to complete the process.

The -x509 option tells req to create a self-signed cerificate. The -days 365 option specifies that the certificate will be valid for 365 days. A temporary CSR is generated to gather information to associate with the certificate.

 生成证书以后,把 domain.key 和 domain.crt 的内容 复制到 cert.pem 中 上面为 private key，下面为 certificate 部分。

3.把系统时间调整到现在的时间。

4.查看证书的开始时间和过期时间是否如你的预期呢？

openssl x509 -startdate -noout -in key.pem