工具：OpenSSL 1.1.0g
平台：Ubuntu 18.04
准备工作
检查 OpenSSL 配置文件：
nano /etc/ssl/openssl.cnf
找到 CA 配置部分，确认以下配置：
[ CA_default ] dir = ./demoCA # Where everything is kept certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. new_certs_dir = $dir/newcerts # default place for new certs. certificate = $dir/cacert.pem # The CA certificate serial = $dir/serial # The current serial number crlnumber = $dir/crlnumber # the current crl number crl = $dir/crl.pem # The current CRL private_key = $dir/private/cakey.pem# The private key RANDFILE = $dir/private/.rand # private random number file
初始化目录：
mkdir -p ./demoCA/{private,newcerts} && \ touch ./demoCA/index.txt && \ touch ./demoCA/serial && \ echo 01 > ./demoCA/serial
签发 CA 证书
创建 CA 配置文件：
nano root.conf
写入以下配置：
[ req ] default_bits = 2048 default_keyfile = r.pem default_md = sha256 string_mask = nombstr distinguished_name = req_distinguished_name req_extensions = req_ext x509_extensions = x509_ext [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = CN stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Shanghai localityName = Locality Name (eg, city) localityName_default = Shanghai organizationName = Organization Name (eg, company) organizationName_default = Mashiro LLC commonName = Common Name (e.g. server FQDN or YOUR name) commonName_max = 64 commonName_default = Mashiro Internet Fake Authority CA [ x509_ext ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer basicConstraints = CA:TRUE keyUsage = digitalSignature, keyEncipherment, keyCertSign, cRLSign [ req_ext ] subjectKeyIdentifier = hash basicConstraints = CA:TRUE keyUsage = digitalSignature, keyEncipherment, keyCertSign, cRLSign
参数含义：
| 字段 | 值 |
|---|---|
| countryName | 国家名缩写 |
| stateOrProvinceName | 州或省 |
| localityName | 地点，如城市 |
| organizationName | 组织名 |
| commonName | 商标（证书上显示的 CA 名称） |
* xxx_default 设置该字段默认值，这样等一下生成证书时就不用手动填写信息，直接回车使用默认值就行了。
生成 CA 根密钥：
openssl genrsa -out ./demoCA/private/cakey.pem 2048
自签发 CA 根证书：
openssl req -new -x509 -key ./demoCA/private/cakey.pem -out ./demoCA/cacert.pem -days 7300 -config ./root.conf
将 PEM 格式证书转为常用的 DER 格式：
openssl x509 -inform PEM -in ./demoCA/cacert.pem -outform DER -out ./demoCA/CA.cer
用 CA 证书签发 SSL 证书
创建文件夹方便管理：
mkdir 2heng.xin
创建用户证书配置文件：
nano server.conf
写入以下配置：
[ req ] default_bits = 2048 default_keyfile = r.pem default_md = sha256 string_mask = nombstr distinguished_name = req_distinguished_name req_extensions = req_ext x509_extensions = x509_ext [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = CN stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Shanghai localityName = Locality Name (eg, city) localityName_default = Shanghai organizationName = Organization Name (eg, company) organizationName_default = Mashiro LLC commonName = Common Name (e.g. server FQDN or YOUR name) commonName_max = 64 commonName_default = *.2heng.xin [ x509_ext ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alt_names [ req_ext ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alt_names [ alt_names ] DNS.1 = *.2heng.xin DNS.2 = 2heng.xin IP.1 = 127.0.0.1 IP.2 = 8.8.8.8
注意：
1. 在 [ alt_names ] 下填写要签发证书的域名或 IP，支持通配符；
2. Firefox 下出现 MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY，原因是 basicConstraints 被设置成了 CA:TRUE，改为 CA:FALSE 即可。
生成用户 RSA 密钥：
openssl genrsa -out ./2heng.xin/2heng.xin.key 2048
生成用户证书请求：
openssl req -new -key ./2heng.xin/2heng.xin.key -out ./2heng.xin/2heng.xin.csr -config ./server.conf
签发用户证书：
openssl ca -in ./2heng.xin/2heng.xin.csr -out ./2heng.xin/2heng.xin.crt -days 3650 -extensions x509_ext -extfile ./server.conf
附上证书签发目录结构：
$ tree . ├── demoCA │ ├── CA.cer # CA 证书（DER 格式） │ ├── cacert.pem # CA 证书（PEM 格式） │ ├── index.txt # 签发记录数据库 │ ├── index.txt.attr │ ├── index.txt.old │ ├── newcerts │ │ └── 01.pem │ ├── private │ │ └── cakey.pem # CA 私钥 │ ├── serial │ └── serial.old ├── 2heng.xin │ ├── 2heng.xin.crt # 用户证书 │ ├── 2heng.xin.csr │ └── 2heng.xin.key # 用户证书私钥 ├── root.conf # CA 配置文件 └── server.conf # 用户配置文件
参考：
How to setup your own CA with OpenSSL
SSL证书在线工具SSL Online Tools
https://github.com/mashirozx/Pixiv-Nginx/issues/7
Q.E.D.
