CA - Index

infini

Announcement

For more information,please click the more button.

More

264 words

1 minute

CA

2025-11-05

certificate

self-signed certificate

快速生成自签证书#

1
openssl req -x509 \
2
  -newkey rsa:2048 \
3
  -keyout /etc/nginx/ssl/service.lan.key \
4
  -out /etc/nginx/ssl/service.lan.crt \
5
  -days 365 \
6
  -nodes \
7
  -subj "/C=CN/ST=ShangHai/L=Shanghai/O=Myhomw/OU=Myhome/CN=*.service.lan" \
8
  -addext "subjectAltName = DNS:*.service.lan,DNS:service.lan
9
  # req -x509 创建一个自签名的X.509证书
10
  # -nodes 私钥文件不加密

创建本地CA并签发证书#

1
sudo mkdir -p /etc/nginx/ssl/service.lan
2
cd /etc/nginx/ssl/service.lan

创建本地CA

生成CA私钥

1
sudo openssl genrsa -out ca.key 4096

生成CA根证书

1
sudo openssl req -x509 -new -nodes -key ca.key -days 3650 -out ca.crt \
2
-subj "/C=CN/ST=ShangHai/L=Shanghai/O=LocalCA/OU=Dev/CN=Local Root CA"
3
# ca.crt是要导入到浏览器的根证书

为域名生成证书请求(CSR)

生成服务私钥

1
sudo openssl genrsa -out service.lan.key 2048

创建一个service.lan.conf,指定SAN

1
[req]
2
default_bits    = 2048
3
prompt          = no
4
default_md      = sha256
5
req_extensions  = req_ext
6
distinguished_name = dn
7

8
[dn]
9
C=CN
10
ST=Shanghai
11
L=Shanghai
12
O=Myhome
13
OU=Myhome
14
CN=app.service.lan
15

16
[req_ext]
17
subjectAltName = @alt_name
18

19
[alt_name]
20
DNS.1 = app.service.lan
21
DNS.2 = *.service.lan

生成CSR

1
sudo openssl req -new -key service.lan.key -out service.lan.csr -config service.lan.conf

用CA签发证书

1
sudo openssl x509 -req -in service.lan.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
2
-out service.lan.crt -days 3650 -sha256 -extensions req_ext -extfile service.lan.conf