opensslca证书生成命令集合

《opensslca证书生成命令集合》由会员上传分享，免费在线阅读，更多相关内容在应用文档-天天文库。

1、多级证书平时我们自己签发CA证书再签发服务器证书的场景其实都非常简单。浏览器把自签CA导入后，就可以信任由这个CA直接签发的服务器证书。   但是实际上网站使用的证书肯定都不是由根CA直接签发的，比如淘宝登陆服务器使用的证书。我之前是自己写了脚本由自签CA直接签发服务器证书，为了真清楚的理解一下证书链的作用就直接使用openssl先签发2层的子CA，再由子CA去签发服务器证书。手动签发证书的脚本如下：生成自签CA#catmakerootca.sh#!/bin/bashDIR=/root/ssl.te

2、st2mkdir-p$DIR/demoCA/{private,newcerts}touch$DIR/demoCA/index.txtecho01>$DIR/demoCA/serialopensslgenrsa-des3-out$DIR/demoCA/private/cakey.pem2048opensslreq-new-x509-days3650-key$DIR/demoCA/private/cakey.pem-out$DIR/demoCA/careq.pem签发二级CA的脚本cpopenssl.c

3、nf/root/ssl.test2#catno2domain.sh#!/bin/bash[$#-ne1]&&echo"$0NAME"&&exitNAME=$1DIR=/root/ssl.test2/autogetmkdir-p$DIRopensslgenrsa-des3-out$DIR/$NAME.key2048opensslx509-in$DIR/../demoCA/careq.pem-noout-textopensslrsa-in$DIR/$NAME.key-out$DIR/$NAME.keyo

4、pensslreq-new-days3650-key$DIR/$NAME.key-out$DIR/$NAME.csropensslca-extensionsv3_ca-in$DIR/$NAME.csr-config$DIR/../openssl.cnf-days3000-out$DIR/$NAME.crt-cert$DIR/../demoCA/careq.pem-keyfile$DIR/../demoCA/private/cakey.pem签发三级CA的脚本#catno3domain.sh#!/bi

5、n/bash#[$#-ne1]&&echo"$0NAME"&&exitNAME=calv3DIR=/root/ssl.test2/autogetopensslgenrsa-des3-out$DIR/$NAME.key2048opensslx509-in$DIR/../demoCA/careq.pem-noout-textopensslrsa-in$DIR/$NAME.key-out$DIR/$NAME.keyopensslreq-new-days3650-key$DIR/$NAME.key-out$

6、DIR/$NAME.csropensslca-in$DIR/$NAME.csr-extensionsv3_ca-config$DIR/../openssl.cnf-days3000-out$DIR/$NAME.crt-cert$DIR/calv2.crt-keyfile$DIR/calv2.key由三级CA签发服务器证书的脚本#catno4domain.sh#!/bin/bash[$#-ne1]&&echo"$0NAME"&&exitNAME=$1DIR=/root/ssl.test2/autoge

7、topensslgenrsa-des3-out$DIR/$NAME.key2048opensslx509-in$DIR/../demoCA/careq.pem-noout-textopensslrsa-in$DIR/$NAME.key-out$DIR/$NAME.keyopensslreq-new-days3650-key$DIR/$NAME.key-out$DIR/$NAME.csropensslca-in$DIR/$NAME.csr-config$DIR/../openssl.cnf-days3

8、000-out$DIR/$NAME.crt-cert$DIR/calv3.crt-keyfile$DIR/calv3.keyopensslpkcs12-export-inkey$DIR/$NAME.key-in$DIR/$NAME.crt-out$DIR/$NAME.p12opensslx509-in$DIR/$NAME.crt-noout-text>$DIR/$NAME.txtshno4domain.shmy.domain.net当我们把使用三级CA签发的服务器证书