open ssl 生成自签名证书-Toy模板网

这篇具有很好参考价值的文章主要介绍了open ssl 生成自签名证书。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

本节向您展示如何使用’ openssl '工具从命令行生成所有必要的文件。

使用实例生成2048位的RSA私钥，用于对流量进行解密。（这里的私钥没有使用加密，安全起见可以加密私钥）

$ sudo openssl genrsa -out /etc/grafana/grafana.key 2048

加密参数如下：

[root@localhost ~]# openssl genrsa --help
usage: genrsa [args] [numbits]
 -des            encrypt the generated key with DES in cbc mode
 -des3           encrypt the generated key with DES in ede cbc mode (168 bit key)
 -idea           encrypt the generated key with IDEA in cbc mode
 -seed
                 encrypt PEM output with cbc seed
 -aes128, -aes192, -aes256
                 encrypt PEM output with cbc aes
 -camellia128, -camellia192, -camellia256
                 encrypt PEM output with cbc camellia
 -out file       output the key to 'file
 -passout arg    output file pass phrase source
 -f4             use F4 (0x10001) for the E value
 -3              use 3 for the E value
 -engine e       use engine e, possibly a hardware device.
 -rand file:file:...
                 load the file (or the files in the directory) into
                 the random number generator

执行以下命令，使用上一步中的私钥生成证书。（csr这个里面包含公钥，所以这里需要私钥来生成对应的公钥）

$ sudo openssl req -new -key /etc/grafana/grafana.key -out /etc/grafana/grafana.csr

当提示时，回答问题，其中可能包括您的完全合格域名，电子邮件地址，国家代码等。下面的示例与您将看到的提示类似。文章来源地址https://www.toymoban.com/news/detail-829075.html

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Virginia
Locality Name (eg, city) []:Richmond
Organization Name (eg, company) [Internet Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:subdomain.mysite.com
Email Address []:me@mysite.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

使用私钥自签名证书，证书有效期为365天。（颁发证书）

sudo openssl x509 -req -days 365 -in /etc/grafana/grafana.csr -signkey /etc/grafana/grafana.key -out /etc/grafana/grafana.crt

执行如下命令为文件设置相应的权限:

sudo chown grafana:grafana /etc/grafana/grafana.crt
sudo chown grafana:grafana /etc/grafana/grafana.key
sudo chmod 400 /etc/grafana/grafana.key /etc/grafana/grafana.crt

到了这里，关于open ssl 生成自签名证书的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！