48 lines
1.4 KiB
Markdown
48 lines
1.4 KiB
Markdown
|
### 一、自签证书
|
|||
|
|
|
|||
|
|
- 生成CA Key证书
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
openssl genrsa 2048 > ca-key.pem
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- 生成CA Cert证书
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
openssl req -new -x509 -nodes -days 3650 -key ca-key.pem -out ca-cert.pem -subj=/C=CN/ST=Beijing/L=Beijing/O=ExampleO/OU=ExampleOU/CN=ExampleRootCA/emailAddress=admin@example.com
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- 生成server证书签发请求和server private key证书；在此命令中修改CN（Common Name）用来创建域名证书请求
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
openssl req -newkey rsa:2048 -nodes -days 3650 -keyout server-key.pem -out server-req.pem -subj=/C=CN/ST=Beijing/L=Beijing/O=ExampleO/OU=ExampleOU/CN=*.example.com/emailAddress=admin@example.com
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- 签发server证书请求，生成server cert证书；注意修改subjectAltName的值
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
openssl x509 -req -extfile <(printf "subjectAltName=DNS:*.example.com") -days 3650 -CAcreateserial -in server-req.pem -out server-cert.pem -CA ca-cert.pem -CAkey ca-key.pem
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 二、生成证书报错
|
|||
|
|
|
|||
|
|
``` bash
|
|||
|
|
Can't load ./.rnd into RNG 10504:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto\rand\randfile.c:98:Filename=./.rnd
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- 解决方案
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
cd /root(你当前所使用的用户)
|
|||
|
|
openssl rand -writerand .rnd
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
### 三、Chrome On MacOS 信任证书
|
|||
|
|
|
|||
|
|
> https://segmentfault.com/a/1190000012394467
|
|||
|
|
|
|||
|
|
- chrome控制台，安全tab，查看证书
|
|||
|
|
- 查看证书详细信息，导出下载证书
|
|||
|
|
- 双击打开下载的证书，选择始终信任
|