用 OpenSSL 搭一套自签名 PKI

1、找个目录执行以下命令

openssl genrsa -out root.key 2048
openssl req -new -key root.key -out root.csr
openssl x509 -req -days 3000 -sha256 -extensions v3_ca -signkey root.key -in root.csr -out root.cer

2、创建private目录，继续执行

openssl genrsa -out private/server-key.pem 2048
openssl req -new -key private/server-key.pem -out private/server.csr
openssl x509 -req -days 3000 -sha256 -extensions v3_req -CA root.cer -CAkey root.key -CAserial ca.srl -CAcreateserial -in private/server.csr -out private/server.cer
openssl x509 -outform der -in private/server.cer -out private/publicserver.ccertificate.der
openssl pkcs12 -export -in private/server.cer -inkey private/server-key.pem -out server.pfx
openssl rsa -in private/server-key.pem -pubout -outform PEM -out private/server-key-pub.pem

3、如果是证书提供给java使用，那么还需要把证书转化为pkcs8

openssl pkcs8 -topk8 -inform PEM -in private/server-key.pem -outform pem -nocrypt -out private/server-key-pkcs8.pem
openssl rsa -in private/server-key-pkcs8.pem -pubout -outform PEM -out private/server-key-pkcs8-pub.pem

4、最后生成的目录应该如下：

private目录