环境：ubuntu 16.04
OpenSSL 1.0.2g 1 Mar 2016
为了方便创建10年的证书，如果你需要更长自行修改3650为自己想要的天数
准备部分
1.创建目录
mkdir -p /tmp/https_crt && cd /tmp/https_crt
2.创建生成证书时需要的文件夹和文件
mkdir -p ./demoCA/newcerts
touch ./demoCA/index.txt
echo 00 > ./demoCA/serial
- 证书应答文件 cat>https.conf<<EOF [ req ] default_bits = 4096 prompt = no default_md = sha256 distinguished_name = dn
[ dn ] C = CN ST = yourstate L = yourcity O = yourcommpany OU = yourcommpany CN = yourdomain.com EOF
4.生成CA私钥 openssl genrsa -out ca.key 4096 openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -config https.conf
5.生成证书私钥 openssl genrsa -out server.pem 4096
6.制作解密后的证书私钥 openssl rsa -in server.pem -out server.key 7.生成签名请求 openssl req -new -key server.pem -out server.csr -config https.conf 8.用CA 进行签名 openssl ca -policy policy_anything -days 3650 -cert ca.crt -keyfile ca.key -in server.csr -out server.crt<<EOF y y EOF
