如果你想創(chuàng)建自測(cè)用的ssl證書，只需要簡(jiǎn)單一條命令搞定（不包括CA根證書）脆栋。
req 是openssl證書請(qǐng)求和證書生成命令球匕。
x509 輸出證書而不是證書請(qǐng)求杉适。
newkey [rsa:]nbits生成大小為nbits的rsa私鑰。
keyout 生成的私鑰會(huì)寫入到該文件中鸟辅。
out 生成的證書會(huì)寫入到該文件中氛什。
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem
$ openssl req -x509 -newkey rsa:2048 -keyout key.pem -out req.pem
Generating a 2048 bit RSA private key
..................+++
..............+++
writing new private key to 'key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) []:beijing
Organization Name (eg, company) []:tantan
Organizational Unit Name (eg, section) []:momo
Common Name (eg, fully qualified host name) []:xiaoyi
Email Address []:861072742@qq.com
openssl 官方命令demo
image.png
openssl 生成證書相關(guān)文檔
生成證書以及CA根證書
1.生成CA私鑰
2.生成CA根證書
3.生成私鑰
4.生成證書請(qǐng)求
5.根據(jù)證書請(qǐng)求、CA根證書匪凉、CA私鑰生成證書（pem格式）枪眉。
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem -subj "/C=US/ST=Utah/L=Lehi/O=Your Company, Inc./OU=IT/CN=rootca.com"
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/C=US/ST=Utah/L=Lehi/O=Your Company, Inc./OU=IT/CN=test-redis"
openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.pem -days 1000 -sha256
server.pem證書
server.key 證書私鑰
rootCA.pem CA根證書
rootCA.key CA根證書私鑰
