1)生成根证书
1.1) 生成RSA私钥
- openssl genrsa -out cakey.pem 2048
1.2) 生成证书请求
- openssl req -new -key cakey.pem -out cacsr.pem
1.3) 签发自签名证书
- openssl x509 -in cacsr.pem -req -signkey cakey.pem -days 999 -out cacert.pem
2) 生成用户证书
1.1) 生成RSA私钥
- openssl genrsa -out clikey.pem 2048
1.2) 生成证书请求
- openssl req -new -key clikey.pem -out clicsr.pem
1.3) 签发证书
- openssl x509 -in clicsr.pem -req -CA cacert.pem -CAkey cakey.pem -days 999 -set_serial 01 -out clicert.pem