微信搜索superit|邀请体验:大数据, 数据管理、OLAP分析与可视化平台 | 赞助作者:赞助作者

签名

架构 aide_941 3℃

https://www.cnblogs.com/zhangmingcheng/p/18412749
https://www.cnblogs.com/suterfo/p/13693909.html
证书颁发
需要openssl 3.x以上。v1.1.1不可以。
CA证书(含私钥)生成,按提示操作输入国家、省份、公司等
网站证书(含私钥)生成,一定需要altname的IP或者域名(DNS)

openssl genrsa -out ./out/ca.key 2048
openssl req -x509 -new -nodes -key ./out/ca.key -subj "/CN=WSY" -days 1000 -out ./out/ca.crt
openssl genrsa -out ./out/server.key 2048

openssl req -new -key ./out/server.key -out ./out/server.csr -config csr.conf

openssl x509 -req -in ./out/server.csr -CA ./out/ca.crt -CAkey ./out/ca.key -CAcreateserial -out ./out/server.crt -days 10000 -extensions v3_ext -extfile csr.conf

openssl x509 -noout -text -in ./out/server.crt


openssl pkcs12 –export –in [用户证书文件] -certfile [CA根证书文件] -inkey [用户私钥文件] –passout pass:[P12文件的加密密码] –out [P12文件] -name [用户证书别名] –caname [CA证书别名]

openssl pkcs12 -export -in ./out/ca.crt -certfile ./out/ca.crt -inkey ./out/ca.key -password pass:12345 -out ./out/ca.pfx
openssl pkcs12 -export -in ./out/server.crt -certfile ./out/ca.crt -inkey ./out/server.key -password pass:12345 -out ./out/server.pfx
openssl pkcs12 -export -in ./out/client.crt -certfile ./out/ca.crt -inkey ./out/client.key -password pass:12345 -out ./out/client.pfx


openssl req -new -x509 -out ca.crt -noenc -keyout ca.pkey
openssl req -new -x509 -out ./out/web.crt -noenc -keyout ./out/web.pkey -CA ./out/ca.crt -CAkey ./out/ca.key -addext "subjectAltName = IP.0:10.161.22.84, DNS.1:naiya-dev.edu.cn"
openssl pkcs12 -export -in ./out/web.crt -certfile ./out/ca.crt -inkey ./out/web.pkey -password pass:12345 -out ./out/web.pfx

转载请注明:SuperIT » 签名

喜欢 (0)or分享 (0)