openssl生免费证书--亲自实践有效

openssl生免费证书

1.创建文件夹并且创建证书私钥

makdir -p /data/cert
cd /data/cert
openssl genrsa -des3 -out server.key 2048

效果如下,会让你输入密码并确认密码记住后边有用。

Generating RSA private key, 2048 bit long modulus
......................................................................................................................+++
..........+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

2.根据证书私钥进行生成证书

openssl req -new -key server.key -out server.csr

效果如下，填写上边的密码，然后填写个人信息，可以随便天写

[root@zjdk cert]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
# 国家CN
Country Name (2 letter code) [XX]:CN 
# 省 
State or Province Name (full name) []:beijing 
# 城市
Locality Name (eg, city) [Default City]:beijing
# 组织名称
Organization Name (eg, company) [Default Company Ltd]:xxxx
# 单位名称
Organizational Unit Name (eg, section) []:xxxx
# 域名
Common Name (eg, your name or your server's hostname) []:crazyk.com.cn
# 邮箱
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
# 不需要，剩下的两个直接回车就可以
A challenge password []:
An optional company name []:

3.备份私钥

cp server.key server.key.org

4.转换证书

#转换为证书
openssl rsa -in server.key.org -out server.key

效果如下，这个还是需要输入最开始填写的密码

[root@zjdk cert]# openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:
writing RSA key

5.给证书签名

#给证书签名
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

效果如下，表示成功，完结撒花

[root@zjdk cert]# openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=xx/OU=cre.com/CN=cer.com/emailAddress=code_dking.com
Getting Private key