使用OpenSSL生成自签名证书相关命令

心已赠人 2023-02-27 05:56 46阅读 0赞

在用于小范围测试等目的的时候，用户也可以自己生成数字证书，但没有任何可信赖的机构签名，此类数字证书称为自签名证书。证书一般采用X.509标准格式。下面通过OpenSSL相关命令介绍如何生成自签证书。

1. 生成自签名根证书(一级证书):

(1).产生长度为2048的rsa私钥root.key，PEM格式:

LD_LIBRARY_PATH=../lib ./openssl genrsa -out root.key 2048

(2).验证私钥root.key:执行结果如下图所示

LD_LIBRARY_PATH=../lib ./openssl rsa -in root.key -check

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70][]

(3).创建根证书签名请求(Certificate Signing Request)文件root2.csr，PEM格式：输入以下命令回车后，需要依次填入相关信息，例子如下，每行的冒号后为需要填写的，若不填写则可直接回车跳过，采用默认值，如下图所示：

LD_LIBRARY_PATH=../lib ./openssl req -new -out root2.csr -key root.key

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 1][]

也可以通过增加选项-subj来生成证书签名请求，命令如下：root.csr和root2.csr内容完全一致

LD_LIBRARY_PATH=../lib ./openssl req -new -out root.csr -key root.key -subj "/C=cn/ST=beijing/L=haidian/O=FBC/OU=test/CN=fengbingchun/emailAddress=fengbingchun@163.com"

(4).验证root.csr，查看证书签名请求详细信息:执行结果如下图所示

LD_LIBRARY_PATH=../lib ./openssl req -text -in root.csr -noout -verify

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 2][]

(5)创建根证书root.crt,PEM格式：执行结果如下图所示

LD_LIBRARY_PATH=../lib ./openssl x509 -req -in root.csr -out root.crt -signkey root.key -days 3650

![20200716170448642.png][]

(6).将root.crt由PEM格式转换到DER格式：

LD_LIBRARY_PATH=../lib ./openssl x509 -outform der -in root.crt -out root.der

(7).验证root.crt，查看证书详细信息：执行结果如下图所示

LD_LIBRARY_PATH=../lib ./openssl x509 -text -in root.crt -noout

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 3][]

(8).验证root.key, root.csr, root.crt是否具有相同的公钥：执行结果如下图所示，输出结果一致

LD_LIBRARY_PATH=../lib ./openssl rsa -modulus -in root.key -noout | LD_LIBRARY_PATH=../lib ./openssl sha256
    LD_LIBRARY_PATH=../lib ./openssl req -modulus -in root.csr -noout | LD_LIBRARY_PATH=../lib ./openssl sha256
    LD_LIBRARY_PATH=../lib ./openssl x509 -modulus -in root.crt -noout | LD_LIBRARY_PATH=../lib ./openssl sha256

![20200716171448215.png][]

2. 由自签名根证书颁发服务器端证书(二级证书)：

(1).产生长度为2048的rsa私钥server.key，PEM格式:

LD_LIBRARY_PATH=../lib ./openssl genrsa -out server.key 2048

(2).验证私钥server.key:

LD_LIBRARY_PATH=../lib ./openssl rsa -in server.key -check

(3).创建服务器端证书签名请求server.csr, PEM格式：CN填写本地测试机的IP或域名

LD_LIBRARY_PATH=../lib ./openssl req -new -out server.csr -key server.key -subj "/C=cn/ST=beijing/L=haidian/O=Spring/OU=server_test/CN=10.4.96.33/emailAddress=Spring@server_test.com"

(4).验证server.csr，查看证书签名请求详细信息:

LD_LIBRARY_PATH=../lib ./openssl req -text -in server.csr -noout -verify

(5).创建服务器端证书server.crt,PEM格式：

LD_LIBRARY_PATH=../lib ./openssl x509 -req -in server.csr -out server.crt -signkey server.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650

(6).验证server.crt，查看证书详细信息:执行结果如下图所示，注意与root.crt的差异

LD_LIBRARY_PATH=../lib ./openssl x509 -text -in server.crt -noout

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 4][]

(7).将server.crt由PEM格式转换到DER格式：

LD_LIBRARY_PATH=../lib ./openssl x509 -outform der -in server.crt -out server.der

(8).验证server.key, server.csr, server.crt是否具有相同的公钥：

LD_LIBRARY_PATH=../lib ./openssl rsa -modulus -in server.key -noout | LD_LIBRARY_PATH=../lib ./openssl sha256
    LD_LIBRARY_PATH=../lib ./openssl req -modulus -in server.csr -noout | LD_LIBRARY_PATH=../lib ./openssl sha256
    LD_LIBRARY_PATH=../lib ./openssl x509 -modulus -in server.crt -noout | LD_LIBRARY_PATH=../lib ./openssl sha256

(9).使用根证书root.crt来校验服务器端证书server.crt:执行结果如下图所示

LD_LIBRARY_PATH=../lib ./openssl verify -CAfile root.crt server.crt

![20200716174222656.png][]

3. 由自签名根证书颁发客户端证书(二级证书)：

(1).产生长度为2048的rsa私钥client.key，PEM格式:

LD_LIBRARY_PATH=../lib ./openssl genrsa -out client.key 2048

(2).验证私钥client.key:

LD_LIBRARY_PATH=../lib ./openssl rsa -in client.key -check

(3).创建客户端证书签名请求client.csr,PEM格式：

LD_LIBRARY_PATH=../lib ./openssl req -new -out client.csr -key client.key -subj "/C=cn/ST=beijing/L=haidian/O=Spring/OU=client_test/CN=Chun/emailAddress=test@client_test.com"

(4).验证client.csr，查看证书签名请求详细信息:

LD_LIBRARY_PATH=../lib ./openssl req -text -in client.csr -noout -verify

(5).创建客户端证书client.crt,PEM格式：

LD_LIBRARY_PATH=../lib ./openssl x509 -req -in client.csr -out client.crt -signkey client.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650

(6).验证client.crt，查看证书详细信息:

LD_LIBRARY_PATH=../lib ./openssl x509 -text -in client.crt -noout

(7).将client.crt由PEM格式转换到DER格式：

LD_LIBRARY_PATH=../lib ./openssl x509 -outform der -in client.crt -out client.der

(8).验证client.key, client.csr, client.crt是否具有相同的公钥：

LD_LIBRARY_PATH=../lib ./openssl rsa -modulus -in client.key -noout | LD_LIBRARY_PATH=../lib ./openssl sha256
    LD_LIBRARY_PATH=../lib ./openssl req -modulus -in client.csr -noout | LD_LIBRARY_PATH=../lib ./openssl sha256
    LD_LIBRARY_PATH=../lib ./openssl x509 -modulus -in client.crt -noout | LD_LIBRARY_PATH=../lib ./openssl sha256

(9).使用根证书root.crt来校验客户端证书client.crt:执行结果如下图所示

LD_LIBRARY_PATH=../lib ./openssl verify -CAfile root.crt client.crt

![20200716183712631.png][]

**GitHub**：[https://github.com//fengbingchun/OpenSSL\_Test][https_github.com_fengbingchun_OpenSSL_Test]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70]: /images/20230209/76fd4cd8d0e64c7cadb04d2d3a646e64.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 1]: /images/20230209/11c3d0eeaf004bba940542d47807daeb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 2]: /images/20230209/d55cfce4b937424a81487b821c50d9a1.png
[20200716170448642.png]: /images/20230209/506d1a436cd7447697fb9ab87855d98a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 3]: /images/20230209/aec6e726b7da460a8761c3ec7176af0c.png
[20200716171448215.png]: /images/20230209/318f17a07e4b4ed2a7e6b11993dc0d66.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdiaW5nY2h1bg_size_16_color_FFFFFF_t_70 4]: /images/20230209/09a4e2fb985a4b2c939e152bf2e5730c.png
[20200716174222656.png]: /images/20230209/165296722fbd4998a6065d3a0b27bfb1.png
[20200716183712631.png]: /images/20230209/31f7783a0c004782885ae5dfe33776ad.png
[https_github.com_fengbingchun_OpenSSL_Test]: https://github.com//fengbingchun/OpenSSL_Test