Issuance and verification of self-signed certificates

1. Generate certificates using openSSL

A root SSL certificate is a certificate authority (CA) trusted by the issued certificate.

Generate a RSA-2048 key and save it to a file called rootCA.key. This file will be used as the key to generate the root SSL certificate.

Command: openssl genrsa-des3-out rootCA.key 2048

You can use the key you generated to create a new root SSL certificate. And save it as rootCA.pem.

Command: openssl req-x509-new-nodes-key rootCA.key-sha256-days 1024-out rootCA.pem

The corresponding password entered is: 12345678

two。 Generate a domain SSL certificate using the root SSL

Create a new OpenSSL configuration file, server.csr.cnf so that you can import these settings when you create the certificate.

[req] default_bits = 2048prompt = nodefault_md = sha256distinguished_name = DN [DN] C=CNL=BeijingO=SenseshieldCN = Virbox SS Dom CA

Create a v3.ext file to create an x509 v3 certificate. Specify subjectAltName options.

AuthorityKeyIdentifier=keyid,issuerbasicConstraints=CA:FALSEkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEnciphermentsubjectAltName = @ alt_ namesalt _ names] DNS.1 = localhostDNS.2 = test.sensese.com

Create a server.key and set server.csr.cnf using the storage in the configuration

Openssl req-new-sha256-nodes-out server.csr-newkey rsa:2048-keyout server.key-config