vim /etc/pki/tls/openssl.cnf

cd /etc/pki/CA

#創(chuàng)建配置文件信息中所需的目錄及文件

mkdir -pv {certs,crl,newcerts,private}

touch {serial,index.txt}

echo 01 >> serial

# 生成CA私鑰(ca.key)
openssl genrsa -des3 -out ca.key 2048 
# 生成CA證書簽名請求(ca.csr)
openssl req -new -key ca.key -out ca.csr
# 生成自簽名CA證書(ca.cert)
openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt

# 生成服務端私鑰(server.key)
openssl genrsa -des3 -out server.key 2048 
# 生成服務端證書簽名請求(server.csr)
openssl req -new -key server.key -out server.csr
# 使用ca證書簽署服務端csr以生成服務端證書(server.cert)
openssl ca -days 3650 -in server.csr -out server.crt -cert ca.crt -keyfile ca.key

# 生成客戶端私鑰(client.key)
openssl genrsa -des3 -out client.key 2048
# 生成客戶端證書簽名請求(client.csr)
openssl req -new -key client.key -out client.csr
# 使用ca證書簽署客戶端csr以生成客戶端證書(client.cert)
openssl ca -days 3650 -in client.csr -out client.crt -cert ca.crt -keyfile ca.key

openssl x509 -in server.crt -noout -text

openssl x509 -in ca.crt -out ca.pem -outform PEM

openssl x509 -in server.crt -out server.pem -outform PEM

openssl x509 -in client.crt -out client.pem -outform PEM

openssl rsa -in server.key -out serverkey.pem

openssl rsa -in client.key -out clientkey.pem