zhouzhongping/wiki
1
0
Fork 0
Code
bd8d51793c
wiki/Technology/ComputerSecurity/网络安全/OpenSSL/简明指南.html

355 lines
495 KiB
HTML
Raw Normal View History

Deploy HTML files - 2024-09-06
2024-09-06 17:53:58 +08:00
<!DOCTYPE html>
<html lang="zh"><head><title>简明指南</title><meta charset="utf-8"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com"/><link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=IBM Plex Mono&amp;family=Noto Serif Simplified Chinese:wght@400;700&amp;family=Source Sans Pro:ital,wght@0,400;0,600;1,400;1,600&amp;display=swap"/><meta name="viewport" content="width=device-width, initial-scale=1.0"/><meta property="og:title" content="简明指南"/><meta property="og:description" content="OpenSSL 简明指南."/><meta property="og:image" content="https://wiki.7wate.com/static/og-image.png"/><meta property="og:width" content="1200"/><meta property="og:height" content="675"/><link rel="icon" href="../../../../static/icon.png"/><meta name="description" content="OpenSSL 简明指南."/><meta name="generator" content="Quartz"/><link href="../../../../index.css" rel="stylesheet" type="text/css" spa-preserve/><link href="https://cdnjs.cloudflare.com/ajax/libs/KaTeX/0.16.9/katex.min.css" rel="stylesheet" type="text/css" spa-preserve/><script src="../../../../prescript.js" type="application/javascript" spa-preserve></script><script type="application/javascript" spa-preserve>const fetchData = fetch("../../../../static/contentIndex.json").then(data => data.json())</script></head><body data-slug="Technology/ComputerSecurity/网络安全/OpenSSL/简明指南"><div id="quartz-root" class="page"><div id="quartz-body"><div class="left sidebar"><h2 class="page-title"><a href="../../../..">🪴 X·Eden</a></h2><div class="spacer mobile-only"></div><div class="search"><button class="search-button" id="search-button"><p>搜索</p><svg role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 19.9 19.7"><title>Search</title><g class="search-path" fill="none"><path stroke-linecap="square" d="M18.5 18.3l-5.4-5.4"></path><circle cx="8" cy="8" r="7"></circle></g></svg></button><div id="search-container"><div id="search-space"><input autocomplete="off" id="search-bar" name="search" type="text" aria-label="搜索些什么" placeholder="搜索些什么"/><div id="search-layout" data-preview="true"></div></div></div></div><button class="darkmode" id="darkmode"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="dayIcon" x="0px" y="0px" viewBox="0 0 35 35" style="enable-background:new 0 0 35 35" xml:space="preserve" aria-label="暗色模式"><title>暗色模式</title><path d="M6,17.5C6,16.672,5.328,16,4.5,16h-3C0.672,16,0,16.672,0,17.5 S0.672,19,1.5,19h3C5.328,19,6,18.328,6,17.5z M7.5,26c-0.414,0-0.789,0.168-1.061,0.439l-2,2C4.168,28.711,4,29.086,4,29.5 C4,30.328,4.671,31,5.5,31c0.414,0,0.789-0.168,1.06-0.44l2-2C8.832,28.289,9,27.914,9,27.5C9,26.672,8.329,26,7.5,26z M17.5,6 C18.329,6,19,5.328,19,4.5v-3C19,0.672,18.329,0,17.5,0S16,0.672,16,1.5v3C16,5.328,16.671,6,17.5,6z M27.5,9 c0.414,0,0.789-0.168,1.06-0.439l2-2C30.832,6.289,31,5.914,31,5.5C31,4.672,30.329,4,29.5,4c-0.414,0-0.789,0.168-1.061,0.44 l-2,2C26.168,6.711,26,7.086,26,7.5C26,8.328,26.671,9,27.5,9z M6.439,8.561C6.711,8.832,7.086,9,7.5,9C8.328,9,9,8.328,9,7.5 c0-0.414-0.168-0.789-0.439-1.061l-2-2C6.289,4.168,5.914,4,5.5,4C4.672,4,4,4.672,4,5.5c0,0.414,0.168,0.789,0.439,1.06 L6.439,8.561z M33.5,16h-3c-0.828,0-1.5,0.672-1.5,1.5s0.672,1.5,1.5,1.5h3c0.828,0,1.5-0.672,1.5-1.5S34.328,16,33.5,16z M28.561,26.439C28.289,26.168,27.914,26,27.5,26c-0.828,0-1.5,0.672-1.5,1.5c0,0.414,0.168,0.789,0.439,1.06l2,2 C28.711,30.832,29.086,31,29.5,31c0.828,0,1.5-0.672,1.5-1.5c0-0.414-0.168-0.789-0.439-1.061L28.561,26.439z M17.5,29 c-0.829,0-1.5,0.672-1.5,1.5v3c0,0.828,0.671,1.5,1.5,1.5s1.5-0.672,1.5-1.5v-3C19,29.672,18.329,29,17.5,29z M17.5,7 C11.71,7,7,11.71,7,17.5S11.71,28,17.5,28S28,23.29,28,17.5S23.29,7,17.5,7z M17.5,25c-4.136,0-7.5-3.364-7.5-7.5 c0-4.136,3.364-7.5,7.5-7.5c4.136,0,7.5,3.364,7.5,7.5C25,21.636,21.636,25,17.5,25z"></path></svg><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="nightIcon
<p>OpenSSL 是一个开放源代码的软件库包。这个包广泛被应用在互联网的网页服务器上。 其主要库是以 C 语言所写成，实现了基本的加密功能，实现了 SSL 与 TLS 协议。</p>
<blockquote>
<p>以下命令均在 cygwin 或 linux 下运行
以下命令是在这个版本 <code>OpenSSL 1.1.1g 21 Apr 2020</code> 下的 OpenSSL 运行的</p>
</blockquote>
<ul>
<li>
<p>查看 openssl 的版本信息</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> version</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -a</span></span></code></pre></figure>
</li>
<li>
<p>查看帮助，这里会输出 openssl 支持的算法</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> help</span></span></code></pre></figure>
</li>
<li>
<p>查看某个命令的帮助</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 某个命令</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --help</span></span></code></pre></figure>
</li>
<li>
<p>查看密码套件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ciphers</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -v</span></span></code></pre></figure>
</li>
<li>
<p>数字摘要</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">echo</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;123&quot;</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> dgst</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> dgst</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 文件路径</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">echo</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;123&quot;</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> dgst</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> awk</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> '{print $2}'</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> dgst</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 文件路径</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> awk</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> '{print $2}'</span></span></code></pre></figure>
</li>
<li>
<p>输出当前时间戳</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">date</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> +%s</span></span></code></pre></figure>
</li>
<li>
<p>输出纳秒 这是一个 9 位的数字 一些简单的伪随机数算法会使用纳秒作为种子</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">date</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> +%N</span></span></code></pre></figure>
</li>
<li>
<p>生成 32 位随机字符串</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rand</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 32</span></span></code></pre></figure>
</li>
<li>
<p>输出随机数字</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 输出随机数字，但无法确定数字的长度</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rand</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 32</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> tr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -dc</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> '0-9'</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rand</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 64</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> tr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -dc</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> '0-9'</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 生成16位随机数 有可能不足16位</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rand</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 128</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> tr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -dc</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> '0-9'</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> |</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> cut</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -c1-16</span></span></code></pre></figure>
</li>
<li>
<p>查看 对称加密命令和可以使用的算法</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> enc</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -help</span></span></code></pre></figure>
</li>
<li>
<p>enc 使用对称加密算法</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> enc</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -aes-256-cfb</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -e</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> a.txt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -a</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> b.txt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -pass</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> pass:123</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> enc</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -aes-256-cfb</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -d</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> b.txt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -a</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> c.txt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -pass</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> pass:123</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -aes-256-cfb 使用的算法</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -e 加密</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -d 解密</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -in 输入的文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 输出文件的路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -a 把输出转换成 base64 加密时有这个参数，解密时也要有这个参数</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -pass 数入密码和输入密码的方式</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># pass</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># file</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># stdio</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># env</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># fd</span></span></code></pre></figure>
</li>
<li>
<p>生成 rsa 私钥</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> genrsa</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 4096</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 默认是 pem 格式的</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 指定生成文件的路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 最后的 4096 是生成密钥的长度</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 生成的密钥对是 pkcs1 格式的， openssl 有相应的命令转成 pkcs8 或 pkcs12 格式</span></span></code></pre></figure>
</li>
<li>
<p>从私钥中提取公钥</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -pubout</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_public_key.pem</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -pubout 提取公钥</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 指定生成文件的路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -in 私钥路径</span></span></code></pre></figure>
</li>
<li>
<p>公钥加密文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsautl</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -encrypt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> a.txt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -inkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_public_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -pubin</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> b.txt</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 加密后的文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -in 需要加密的文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -inkey 公钥路径</span></span></code></pre></figure>
</li>
<li>
<p>私钥解密文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsautl</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -decrypt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> b.txt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -inkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> c.txt</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 解密后的文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -in 需要解密的文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -inkey 私钥路径</span></span></code></pre></figure>
</li>
<li>
<p>使用私钥生成签名</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> dgst</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sign</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyform</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> PEM</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sign.sha256</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> a.txt</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -sha256 哈希算法</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -sign 私钥路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -keyform 私钥的格式</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 签名生成的路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 最后的 a.txt 是需要生成签名的文件路径</span></span></code></pre></figure>
</li>
<li>
<p>使用公钥验证签名</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> dgst</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -verify</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_public_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyform</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> PEM</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -signature</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sign.sha256</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> a.txt</span></span></code></pre></figure>
</li>
<li>
<p>对文件的内容进行 base64 编码</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> enc</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -e</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sign.sha256</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sign.sha256.base64</span></span></code></pre></figure>
</li>
<li>
<p>对文件的内容进行 base64 解码</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> enc</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -d</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sign.sha256.base64</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sign.sha2562</span></span></code></pre></figure>
</li>
<li>
<p>比较两个文件的内容，如果两个文件内容一致则不会有输出</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">diff</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 文件1的路径</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 文件2的路径</span></span></code></pre></figure>
</li>
<li>
<p>生成一个 csr 文件</p>
<ul>
<li>启动一个问题/回答的交互式会话，其它随便填就好，extra attributes 可以留空</li>
<li>其实 openssl 有一键生成密钥对， csr 和 证书的命令</li>
</ul>
</li>
</ul>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -new</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -key</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyform</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> PEM</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> myserver.csr</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -new 生成一个新的 csr 文件</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -key 私钥文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -keyform 私钥的格式</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 生成的 csr 文件路径</span></span></code></pre></figure>
<ul>
<li>
<p>查看 csr 文件内容</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -text</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> myserver.csr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -noout</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -verify</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -in csr 文件路径</span></span></code></pre></figure>
</li>
<li>
<p>使用 csr 和 私钥生成自签证书</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -signkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> myserver.csr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -days</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 365</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain3.crt</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># x509 生成 x509 格式的证书</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -sha256 证书采用的哈希算法</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -signkey 私钥路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -in csr 文件路径</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -days 证书有效天数</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -out 生成的证书路径</span></span></code></pre></figure>
</li>
<li>
<p>一条命令生成密钥和证书</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -newkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa:4096</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -nodes</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyout</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -days</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 365</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span></span></code></pre></figure>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -newkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa:4096</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -nodes</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyout</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -days</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 365</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -subj</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;/C=CN/ST=State/L=City/O=Ltd/OU=Section/CN=localhost&quot;</span></span></code></pre></figure>
</li>
<li>
<p>查看证书内容</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -noout</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -text</span></span></code></pre></figure>
</li>
<li>
<p>查看证书序列号</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -noout</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -serial</span></span></code></pre></figure>
</li>
<li>
<p>查看证书有效时间</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -noout</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -dates</span></span></code></pre></figure>
</li>
</ul>
<h3 id="生成多个域名的证书">生成多个域名的证书<a role="anchor" aria-hidden="true" tabindex="-1" data-no-popover="true" href="#生成多个域名的证书" class="internal"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h3>
<p>一般使用 OpenSSL 生成证书时都是 v1 版的，不带扩展属性。 多域名证书需要用到 v3 版的 extensions 的 Subject Alternative Name (SAN 主题替代名称)</p>
<ol>
<li>
<p>寻找默认配置文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">find</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> /</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -name</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span></span></code></pre></figure>
</li>
<li>
<p>复制一份默认配置文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">cp</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> /usr/ssl/openssl.cnf</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span></span></code></pre></figure>
</li>
<li>
<p>编辑 openssl.cnf</p>
<ol>
<li>
<p>[ req ] 字段下加入 req_extensions = v3_req</p>
</li>
<li>
<p>[ v3_req ] 字段下加入 subjectAltName = @alt_names</p>
</li>
<li>
<p>在配置文件的最后最后新建一个字段 [ alt_names ]</p>
</li>
<li>
<p>在 [ alt_names ] 里按以下格式写入多个域名</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> [ alt_names ]</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> DNS.1</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 3.example.com</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> DNS.2</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 4.example.com</span></span></code></pre></figure>
</li>
</ol>
</li>
<li>
<p>新建私钥</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> genrsa</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 4096</span></span></code></pre></figure>
</li>
<li>
<p>生成 csr 文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -new</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -key</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyform</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> PEM</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -config</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> myserver.csr</span></span></code></pre></figure>
</li>
<li>
<p>生成数字证书</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -sha256</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -signkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> myserver2.csr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -extensions</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> v3_req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -extfile</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -days</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 365</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span></span></code></pre></figure>
</li>
</ol>
<h3 id="自建-ca">自建 CA<a role="anchor" aria-hidden="true" tabindex="-1" data-no-popover="true" href="#自建-ca" class="internal"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h3>
<ol>
<li>
<p>创建 CA 目录</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">mkdir</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -p</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ~/ssl/demoCA/{certs,newcerts,crl,private}</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">cd</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ~/ssl/demoCA</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">Touch</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> index.txt</span></span>
<span data-line><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">echo</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;01&quot;</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> ></span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> serial</span></span></code></pre></figure>
</li>
<li>
<p>寻找默认配置文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">find</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> /</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -name</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span></span></code></pre></figure>
</li>
<li>
<p>复制一份默认配置文件</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">cp</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> /usr/ssl/openssl.cnf</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ~/ssl/openssl.cnf</span></span></code></pre></figure>
</li>
<li>
<p>修改 openssl.cnf 文件</p>
<ul>
<li>
<p>把 [ CA_default ] 的 dir 修改成 ~/ssl/demoCA/ 的绝对路径，类似于这样</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> [ CA_default ]</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> dir</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> /root/ssl/demoCA</span><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"> # Where everything is kept</span></span></code></pre></figure>
</li>
</ul>
</li>
<li>
<p>生成 CA 根证书及密钥</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -new</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -x509</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -newkey</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa:4096</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -nodes</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyout</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> cakey.key</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> cacert.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -config</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -days</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 365</span></span></code></pre></figure>
</li>
<li>
<p>生成客户端私钥</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> genrsa</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> client.key</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 4096</span></span></code></pre></figure>
</li>
<li>
<p>用该客户端私钥生成证书签名请求</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> req</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -new</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -key</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> client.key</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> client.csr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -config</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span></span></code></pre></figure>
</li>
<li>
<p>使用 CA 根证书签发客户端证书</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ca</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -in</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> client.csr</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -out</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> client.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -cert</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> cacert.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -keyfile</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> cakey.key</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -config</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> openssl.cnf</span></span></code></pre></figure>
</li>
</ol>
<ul>
<li>
<p>注意：默认要求 国家，省，公司名称三项必须和 CA 一致</p>
</li>
<li>
<p>如果不想一致，可以修改 openssl.cnf 的 [ CA_default ] 的 policy 为 policy_anything</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> policy</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> policy_anything</span></span></code></pre></figure>
</li>
</ul>
<h3 id="证书链合并">证书链合并<a role="anchor" aria-hidden="true" tabindex="-1" data-no-popover="true" href="#证书链合并" class="internal"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h3>
<p>一些情况下，从 CA 那里申请到的 SSL 证书需要配置证书链，因为颁发的 CA 只是一个中间 CA 。 这个时候，需要把 CA 的证书和 SSL 证书都转换成 pem 格式。 然后新建一个文件，按照 最终实体证书 <span>→</span> 中间证书 <span>→</span> 根证书 这样的顺序，把证书的 pem 格式的内容复制进去，证书之间用一个空行隔开。 例如这样</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">-----BEGIN</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> CERTIFICATE-----</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">这是</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 最终实体证书</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">------END</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> CERTIFICATE------</span></span>
<span data-line> </span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">-----BEGIN</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> CERTIFICATE-----</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">这是</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 中间证书</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">------END</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> CERTIFICATE------</span></span>
<span data-line> </span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">-----BEGIN</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> CERTIFICATE-----</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">这是</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> 根证书</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">------END</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> CERTIFICATE------</span></span></code></pre></figure>
<p>根证书大多数情况下都会内置在客户端，所以大多数情况下都只需要 最终实体证书 和 中间证书。 有时 中间证书 可能有多个，按照签发顺序排列就好，反正就是下面的证书颁发上面的证书。</p>
<p>有时还需要把私钥和证书合并成一个文件，一般是把私钥放在前面，证书放在后面，例如 这样</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">cat</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> server.key</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> server.crt</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;"> ></span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> server.pem</span></span></code></pre></figure>
<h3 id="其它命令">其它命令<a role="anchor" aria-hidden="true" tabindex="-1" data-no-popover="true" href="#其它命令" class="internal"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h3>
<p>openssl s_time 用于测试 TSL 服务</p>
<p>openssl s_server 用于测试 TSL 客户端，例如浏览器对各个加密套件的支持情况</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> s_server</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -accept</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> 2009</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -key</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> rsa_private_key.pem</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -cert</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> domain.crt</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -www</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -debug</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -msg</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># -accept 监听的端口 -key 私钥路径 -crt 证书路径 -www http请求返回状态信息</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 可以用浏览器输测试，直接输入网址 https://127.0.0.1:2009</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 可以用 curl 测试 curl -k -i -v https://127.0.0.1:2009</span></span>
<span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># 可以用 openssl s_client 测试 openssl s_client -connect 127.0.0.1:2009 -showcerts</span></span></code></pre></figure>
<p>openssl s_client 用于测试 TSL 服务端</p>
<ul>
<li>
<p>可以像 telnet 那用测试端口</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"> # 测试 example.com 的 80 端口是否有开启</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> s_client</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -connect</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> example.com:80</span></span></code></pre></figure>
</li>
<li>
<p>可以像 telnet 模拟 http 那样，模拟 https</p>
<figure data-rehype-pretty-code-figure><pre tabindex="0" data-language="shell" data-theme="github-light github-dark"><code data-language="shell" data-theme="github-light github-dark" style="display:grid;"><span data-line><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"> # 输入这个命令后，会进入一个命令行交互界面，这时快速地输入 GET / HTTP/1.O 然后连续输入两个回车，就能返回网页内容</span></span>
<span data-line><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> openssl</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> s_client</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -connect</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> www.baidu.com:443</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> -showcerts</span></span></code></pre></figure>
</li>
</ul>
<p>openssl smime 用于处理 S/MIME 邮件，它能加密、解密、签名和验证 S/MIME 消息</p>
<p>openssl ca ca 命令是一个小型 CA 系统。它能签发证书请求和生成 CRL。它维护一个已签发证书状态的文本数据库。</p></article><hr/><div class="page-footer"></div></div><div class="right sidebar"><div class="graph"><h3>关系图谱</h3><div class="graph-outer"><div id="graph-container" data-cfg="{&quot;drag&quot;:true,&quot;zoom&quot;:true,&quot;depth&quot;:1,&quot;scale&quot;:1.1,&quot;repelForce&quot;:0.5,&quot;centerForce&quot;:0.3,&quot;linkDistance&quot;:30,&quot;fontSize&quot;:0.6,&quot;opacityScale&quot;:1,&quot;showTags&quot;:true,&quot;removeTags&quot;:[],&quot;focusOnHover&quot;:false}"></div><button id="global-graph-icon" aria-label="Global Graph"><svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 55 55" fill="currentColor" xml:space="preserve"><path d="M49,0c-3.309,0-6,2.691-6,6c0,1.035,0.263,2.009,0.726,2.86l-9.829,9.829C32.542,17.634,30.846,17,29,17
s-3.542,0.634-4.898,1.688l-7.669-7.669C16.785,10.424,17,9.74,17,9c0-2.206-1.794-4-4-4S9,6.794,9,9s1.794,4,4,4
c0.74,0,1.424-0.215,2.019-0.567l7.669,7.669C21.634,21.458,21,23.154,21,25s0.634,3.542,1.688,4.897L10.024,42.562
C8.958,41.595,7.549,41,6,41c-3.309,0-6,2.691-6,6s2.691,6,6,6s6-2.691,6-6c0-1.035-0.263-2.009-0.726-2.86l12.829-12.829
c1.106,0.86,2.44,1.436,3.898,1.619v10.16c-2.833,0.478-5,2.942-5,5.91c0,3.309,2.691,6,6,6s6-2.691,6-6c0-2.967-2.167-5.431-5-5.91
v-10.16c1.458-0.183,2.792-0.759,3.898-1.619l7.669,7.669C41.215,39.576,41,40.26,41,41c0,2.206,1.794,4,4,4s4-1.794,4-4
s-1.794-4-4-4c-0.74,0-1.424,0.215-2.019,0.567l-7.669-7.669C36.366,28.542,37,26.846,37,25s-0.634-3.542-1.688-4.897l9.665-9.665
C46.042,11.405,47.451,12,49,12c3.309,0,6-2.691,6-6S52.309,0,49,0z M11,9c0-1.103,0.897-2,2-2s2,0.897,2,2s-0.897,2-2,2
S11,10.103,11,9z M6,51c-2.206,0-4-1.794-4-4s1.794-4,4-4s4,1.794,4,4S8.206,51,6,51z M33,49c0,2.206-1.794,4-4,4s-4-1.794-4-4
s1.794-4,4-4S33,46.794,33,49z M29,31c-3.309,0-6-2.691-6-6s2.691-6,6-6s6,2.691,6,6S32.309,31,29,31z M47,41c0,1.103-0.897,2-2,2
s-2-0.897-2-2s0.897-2,2-2S47,39.897,47,41z M49,10c-2.206,0-4-1.794-4-4s1.794-4,4-4s4,1.794,4,4S51.206,10,49,10z"></path></svg></button></div><div id="global-graph-outer"><div id="global-graph-container" data-cfg="{&quot;drag&quot;:true,&quot;zoom&quot;:true,&quot;depth&quot;:-1,&quot;scale&quot;:0.9,&quot;repelForce&quot;:0.5,&quot;centerForce&quot;:0.3,&quot;linkDistance&quot;:30,&quot;fontSize&quot;:0.6,&quot;opacityScale&quot;:1,&quot;showTags&quot;:true,&quot;removeTags&quot;:[],&quot;focusOnHover&quot;:true}"></div></div></div><div class="toc desktop-only"><button type="button" id="toc" class aria-controls="toc-content" aria-expanded="true"><h3>目录</h3><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="fold"><polyline points="6 9 12 15 18 9"></polyline></svg></button><div id="toc-content" class><ul class="overflow"><li class="depth-0"><a href="#openssl-的一般使用" data-for="openssl-的一般使用">OpenSSL 的一般使用</a></li><li class="depth-1"><a href="#生成多个域名的证书" data-for="生成多个域名的证书">生成多个域名的证书</a></li><li class="depth-1"><a href="#自建-ca" data-for="自建-ca">自建 CA</a></li><li class="depth-1"><a href="#证书链合并" data-for="证书链合并">证书链合并</a></li><li class="depth-1"><a href="#其它命令" data-for="其它命令">其它命令</a></li></ul></div></div><div class="explorer mobile-only"><button type="button" id="explorer" data-behavior="collapse" data-collapsed="collapsed" data-savestate="true" data-tree="[{&quot;path&quot;:&quot;Personal&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog/2018&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog/2020&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog/2021&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog/2022&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog/2023&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Blog/2024&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/个人成长&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/医学健康&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/历史&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/哲学宗教&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/心理&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/政治军事&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/教育学习&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/文学&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/生活百科&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/社会文化&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/科学技术&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/经济理财&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/艺术&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Book/计算机&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal/2022&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal/2022/W34&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal/2022/W35&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal/2022/W36&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal/2022/W37&quot;,&quot;collapsed&quot;:true},{&quot;path&quot;:&quot;Personal/Journal/2022/W38&quot;,&quot;collapsed&quot;:true},
</script><script type="module">
let mermaidImport = undefined
document.addEventListener('nav', async () => {
if (document.querySelector("code.mermaid")) {
mermaidImport ||= await import('https://cdnjs.cloudflare.com/ajax/libs/mermaid/10.7.0/mermaid.esm.min.mjs')
const mermaid = mermaidImport.default
const darkMode = document.documentElement.getAttribute('saved-theme') === 'dark'
mermaid.initialize({
startOnLoad: false,
securityLevel: 'loose',
theme: darkMode ? 'dark' : 'default'
})
await mermaid.run({
querySelector: '.mermaid'
})
}
});
</script><script src="https://cdnjs.cloudflare.com/ajax/libs/KaTeX/0.16.9/contrib/copy-tex.min.js" type="application/javascript"></script><script src="../../../../postscript.js" type="module"></script></html>
Copy Permalink