openssl req和x509命令及配置文件

1. req 命令及配置

openssl req -utf8 -new -config client/req.cnf -key client/client-key.pem -sha1 -out client/client-req.csr 

client/req.cnf文件内容: 

[req]
prompt = no
distinguished_name = dn
input_password = 123456

[dn]
O = 企业名称
1.OU = 部门名称1
2.OU = 部门名称2
emailAddress = 邮箱地址
CN = 用户名称

2. x509命令及配置

openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -extfile client/x509.cnf -sha1 -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 365 

client/x509.cnf文件内容: 

extensions = ext

[ext]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
#subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:名称
#subjectAltName = DNS:www.feistyduck.com,DNS:feistyduck.com
subjectAltName = @alt_names

[alt_names]
#DNS.1   = www.foo.com
#DNS.2   = www.bar.org
#IP.1    = 192.168.1.1
#IP.2    = 192.168.69.144
#email = [e-mail]
otherName = 1.3.6.1.4.1.311.20.2.3;UTF8:名称

3.  证书生成完整命令

//================================================================================
// 生成ca证书  

// 生成密钥
openssl genrsa -out ca/ca-key.pem 2048 

openssl dsaparam -out ca/dsa.pem 2048
openssl gendsa -out ca/ca-key.pem ca/dsa.pem

// 生成请求
openssl req -utf8 -new -config ca/ca.cnf -key ca/ca-key.pem -sha1 -out ca/ca-req.csr 

// 查看请求(可选)
openssl req -text -in ca/ca-req.csr -noout

// 自签署证书
openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -sha1 -days 365 

// 检查证书(可选)
openssl x509 -text -in ca/ca-cert.pem -noout

// 导出证书
openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12 

openssl genrsa -out ca/ca-key.pem 2048 
openssl req -utf8 -new -config ca/ca.cnf -key ca/ca-key.pem -sha1 -out ca/ca-req.csr 
openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -sha1 -days 365 
openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12 

//====================================================================================
// 生成client证书

// 生成密钥
openssl genrsa -out client/client-key.pem 2048 

// 生成请求
openssl req -utf8 -new -config client/req.cnf -key client/client-key.pem -sha1 -out client/client-req.csr 

// 查看请求(可选)
openssl req -text -in client/client-req.csr -noout

// 自签署证书
openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -extfile client/x509.cnf -sha1 -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 365 

// 检查证书(可选)
openssl x509 -text -in client/client-cert.pem -noout

// 导出证书
openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12 

openssl genrsa -out client/client-key.pem 2048 
openssl req -utf8 -new -config client/req.cnf -key client/client-key.pem -sha1 -out client/client-req.csr 
openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -extfile client/x509.cnf -sha1 -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 365
openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12