SSL证书生成方法【转】

转自

SSL证书生成方法 - fyang的专栏 - 博客频道 - CSDN.NET
http://blog.csdn.net/fyang2007/article/details/6180361

通常状况下，若是能找到可用的证书，就能够直接使用，只不过会因证书的某些信息不正确或与部署证书的主机不匹配而致使浏览器提示证书无效，但这并不影响使用。

须要手工生成证书的状况有：

1. 找不到可用的证书
2. 须要配置双向SSL，但缺乏客户端证书
3. 须要对证书做特别的定制

首先，不管是在Linux下仍是在Windows下的Cygwin中，进行下面的操做前都须确认已安装OpenSSL软件包。

1. 建立根证书密钥文件(本身作CA)root.key：

openssl genrsa -des3 -out root.key

输出内容为：

[lenin@archer ~]$ openssl genrsa -des3 -out root.key 
Generating RSA private key, 512 bit long modulus 
……………..++++++++++++ 
..++++++++++++ 
e is 65537 (0×10001) 
Enter pass phrase for root.key: ← 输入一个新密码 
Verifying – Enter pass phrase for root.key: ← 从新输入一遍密码

2. 建立根证书的申请文件root.csr：

openssl req -new -key root.key -out root.csr

输出内容为：

[lenin@archer ~]$ openssl req -new -key root.key -out root.csr 
Enter pass phrase for root.key: ← 输入前面建立的密码 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For some fields there will be a default value, 
If you enter ‘.’, the field will be left blank. 
—– 
Country Name (2 letter code) [AU]:CN ← 国家代号，中国输入CN 
State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音 
Locality Name (eg, city) []:BeiJing ← 市的全名，拼音 
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名 
Organizational Unit Name (eg, section) []: ← 能够不输入 
Common Name (eg, YOUR name) []: ← 此时不输入 
Email Address []:admin@mycompany.com ← 电子邮箱，可随意填

Please enter the following ‘extra’ attributes 
to be sent with your certificate request 
A challenge password []: ← 能够不输入 
An optional company name []: ← 能够不输入

3. 建立一个自当前日期起为期十年的根证书root.crt：

openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.req -out root.crt

输出内容为：

[lenin@archer ~]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt 
Signature ok 
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./emailAddress=admin@mycompany.com
Getting Private key 
Enter pass phrase for root.key: ← 输入前面建立的密码

4. 建立服务器证书密钥server.key：

openssl genrsa –des3 -out server.key 2048

输出内容为：

[lenin@archer ~]$ openssl genrsa -out server.key 2048 
Generating RSA private key, 2048 bit long modulus 
….+++ 
…………………………………………..+++ 
e is 65537 (0×10001)

运行时会提示输入密码,此密码用于加密key文件(参数des3即是指加密算法,固然也能够选用其余你认为安全的算法.),之后每当需读取此文件(经过openssl提供的命令或API)都需输入口令.若是以为不方便,也能够去除这个口令,但必定要采起其余的保护措施! 
去除key文件口令的命令: 
openssl rsa -in server.key -out server.key

5.建立服务器证书的申请文件server.csr：

openssl req -new -key server.key -out server.csr

输出内容为：

[lenin@archer ~]$ openssl req -new -key server.key -out server.req 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For some fields there will be a default value, 
If you enter ‘.’, the field will be left blank. 
—– 
Country Name (2 letter code) [AU]:CN ← 国家名称，中国输入CN 
State or Province Name (full name) [Some-State]:BeiJing ← 省名，拼音 
Locality Name (eg, city) []:BeiJing ← 市名，拼音 
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名 
Organizational Unit Name (eg, section) []: ← 能够不输入 
Common Name (eg, YOUR name) []:www.mycompany.com ← 服务器主机名，若填写不正确，浏览器会报告证书无效，但并不影响使用 
Email Address []:admin@mycompany.com ← 电子邮箱，可随便填

Please enter the following ‘extra’ attributes 
to be sent with your certificate request 
A challenge password []: ← 能够不输入 
An optional company name []: ← 能够不输入

6. 建立自当前日期起有效期为期两年的服务器证书server.crt：

openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -out server.crt

输出内容为：

[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in server.csr -out server.crt 
Signature ok 
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=www.mycompany.com/emailAddress=admin@mycompany.com 
Getting CA Private Key 
Enter pass phrase for root.key: ← 输入前面建立的密码

7. 建立客户端证书密钥文件client.key：

openssl genrsa -des3 -out client.key 2048

输出内容为：

[lenin@archer ~]$ openssl genrsa -des3 -out client.key 2048 
Generating RSA private key, 2048 bit long modulus 
……………………………………………………………………………..+++ 
……………………………………………………………………………………………………….+++ 
e is 65537 (0×10001) 
Enter pass phrase for client.key: ← 输入一个新密码 
Verifying – Enter pass phrase for client.key: ← 从新输入一遍密码

8. 建立客户端证书的申请文件client.csr：

openssl req -new -key client.key -out client.csr

输出内容为：

[lenin@archer ~]$ openssl req -new -key client.key -out client.csr 
Enter pass phrase for client.key: ← 输入上一步中建立的密码 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For some fields there will be a default value, 
If you enter ‘.’, the field will be left blank. 
—– 
Country Name (2 letter code) [AU]:CN ← 国家名称，中国输入CN 
State or Province Name (full name) [Some-State]:BeiJing ← 省名称，拼音 
Locality Name (eg, city) []:BeiJing ← 市名称，拼音 
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名 
Organizational Unit Name (eg, section) []: ← 能够不填 
Common Name (eg, YOUR name) []:Lenin ← 本身的英文名，能够随便填 
Email Address []:admin@mycompany.com ← 电子邮箱，能够随便填

Please enter the following ‘extra’ attributes 
to be sent with your certificate request 
A challenge password []: ← 能够不填 
An optional company name []: ← 能够不填

9. 建立一个自当前日期起有效期为两年的客户端证书client.crt：

openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -out client.crt

输出内容为：

[lenin@archer ~]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAcreateserial -in client.csr -out client.crt 
Signature ok 
subject=/C=CN/ST=BeiJing/L=BeiJing/O=MyCompany Corp./CN=www.mycompany.com/emailAddress=admin@mycompany.com 
Getting CA Private Key 
Enter pass phrase for root.key: ← 输入上面建立的密码

10. 将客户端证书文件client.crt和客户端证书密钥文件client.key合并成客户端证书安装包client.pfx：

openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx

输出内容为：

[lenin@archer ~]$ openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx 
Enter pass phrase for client.key: ← 输入上面建立的密码 
Enter Export Password: ← 输入一个新的密码，用做客户端证书的保护密码，在客户端安装证书时须要输入此密码 
Verifying – Enter Export Password: ← 确认密码

11. 保存生成的文件备用，其中server.crt和server.key是配置单向SSL时须要使用的证书文件，client.crt是配置双向SSL时须要使用的证书文件，client.pfx是配置双向SSL时须要客户端安装的证书文件

     .crt文件和.key能够合到一个文件里面，把2个文件合成了一个.pem文件（直接拷贝过去就好了）