本地自签https证书，实现https加域名访问服务

Love The Way You Lie 2022-12-29 00:22 163阅读 0赞

# 前言
    实现本地自签https证书，其实有很多方式
    如下所示：itisscg openssl keytools mkcert
    
    
    # 情境
    如果没有做过的，大家可以先参考如下链接
    https://www.cnblogs.com/zhoudawei/p/9257276.html
    https://blog.csdn.net/byg184244735/article/details/85071877
    https://blog.csdn.net/qq_42403866/article/details/107147113
    https://www.jianshu.com/p/7a72851676f1

linux 平台下生成根证书步骤
    
    1. 
    [root@localhost tls2]# openssl req -sha256 -new -x509 -days 3650 -keyout CA.key -out CA.crt -config openssl.cnf
    WARNING: can't open config file: /etc/pki/tls/openssl.cnf
    Generating a 2048 bit RSA private key
    .....................................................................+++
    ........+++
    writing new private key to 'CA.key'
    Enter PEM pass phrase:
    Verifying - Enter PEM pass phrase:
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [XX]:CN
    State or Province Name (full name) []:bj
    Locality Name (eg, city) [Default City]:bj
    Organization Name (eg, company) [Default Company Ltd]:hongyi
    Organizational Unit Name (eg, section) []:hongyi
    Common Name (eg, your name or your server's hostname) []:aliyun
    Email Address []:
    
    
    2. 
    [root@localhost tls2]# openssl genrsa -out macrowing.com.key 2048
    WARNING: can't open config file: /etc/pki/tls/openssl.cnf
    Generating RSA private key, 2048 bit long modulus
    ..................+++
    .....................................+++
    e is 65537 (0x10001)
    
    
    3. 
    [root@localhost tls2]# openssl req -new -sha256 -key macrowing.com.key -out macrowing.com.csr -config openssl.cnf
    WARNING: can't open config file: /etc/pki/tls/openssl.cnf
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [XX]:CN
    State or Province Name (full name) []:bj
    Locality Name (eg, city) [Default City]:bj
    Organization Name (eg, company) [Default Company Ltd]:hongyi
    Organizational Unit Name (eg, section) []:hongyi
    Common Name (eg, your name or your server's hostname) []:macrowing.com
    Email Address []:
    
    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:wso2carbon
    An optional company name []:hongyi
    
    4. 
    [root@localhost tls2]# openssl req -in macrowing.com.csr -text
    WARNING: can't open config file: /etc/pki/tls/openssl.cnf
    Unable to load config info from /etc/pki/tls/openssl.cnf
    Certificate Request:
        Data:
            Version: 0 (0x0)
            Subject: C=CN, ST=bj, L=bj, O=hongyi, OU=hongyi, CN=macrowing.com
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (2048 bit)
                    Modulus:
                        00:c8:c4:0a:5e:2f:c3:1e:b2:13:88:e1:2f:b1:7b:
                        49:66:f6:da:0d:85:ff:94:a7:a3:6f:8c:e6:30:31:
                        da:37:6f:a1:3f:07:a9:80:5d:22:23:5f:4a:40:68:
                        64:e5:f3:7a:7f:2e:a1:7b:e8:84:16:b9:61:8e:ba:
                        19:a7:67:74:73:01:31:51:0d:a2:b0:03:5b:c6:1c:
                        b9:e9:12:86:6a:db:21:c4:5a:2a:07:b2:dd:b4:eb:
                        ff:6e:ee:b4:a6:bf:24:fb:87:1e:2e:a1:8a:60:99:
                        8a:94:53:96:14:11:91:24:77:e9:64:58:4c:49:b0:
                        b8:48:29:bb:a0:ff:d2:05:31:3b:c2:e4:f8:d4:d8:
                        3e:d0:cb:6a:25:ec:85:22:ef:d4:de:ed:3b:0d:3e:
                        25:7c:6a:31:eb:4e:81:df:fc:5d:17:23:14:b3:3d:
                        72:81:c5:cf:b4:c9:b8:8f:00:d6:4b:ea:d4:99:a6:
                        ee:1a:ff:00:df:11:36:52:a0:cb:39:46:a5:b9:7a:
                        fb:bb:85:95:c0:b4:03:ea:c4:b3:6a:c1:b6:39:46:
                        fd:5c:35:fc:07:d2:98:a0:1b:aa:bf:60:ed:72:a3:
                        87:ae:65:e4:ad:ed:ac:af:b9:4e:a9:e3:17:c4:e2:
                        15:4c:13:97:36:0f:74:cd:89:35:91:f4:aa:d4:a5:
                        bb:3f
                    Exponent: 65537 (0x10001)
            Attributes:
                unstructuredName         :hongyi
                challengePassword        :wso2carbon
            Requested Extensions:
                X509v3 Basic Constraints: 
                    CA:FALSE
                X509v3 Key Usage: 
                    Digital Signature, Non Repudiation, Key Encipherment
                X509v3 Subject Alternative Name: 
                    DNS:macrowing.com, DNS:*.macrowing.com, IP Address:192.168.2.199, IP Address:192.169.2.1
        Signature Algorithm: sha256WithRSAEncryption
             2d:4e:3c:a7:43:68:e5:c4:58:d7:4c:f7:1e:e6:ce:31:1e:d2:
             11:ce:19:15:56:50:27:8e:3a:df:b6:53:89:bd:7a:f8:9c:c9:
             0f:88:10:2b:71:87:74:67:ad:3d:41:bb:e6:b8:26:db:8a:22:
             a5:76:a0:ea:3c:1e:4f:4c:01:3c:0c:54:6c:c2:11:52:5a:66:
             c9:f1:d6:68:5a:3e:72:a0:f2:83:5d:37:9c:9d:ed:e0:b1:48:
             87:6e:6e:6b:47:bd:15:a1:7d:ae:26:30:6c:54:0d:be:35:e6:
             3e:ff:1d:2e:93:bf:d9:3b:ae:55:10:05:53:8d:45:8f:1d:88:
             5a:e5:e1:43:bb:72:d7:72:c8:9f:9e:ef:58:6a:b1:da:06:f7:
             d7:f0:9b:24:c9:61:ea:e9:dd:ce:cc:70:2e:35:5d:82:99:e4:
             54:4b:5b:93:6a:53:68:65:5a:9c:fe:3a:6f:a1:51:2c:ef:dd:
             09:79:8b:e4:0d:e4:fc:c8:36:1b:f6:d7:73:2e:04:ca:e2:9e:
             95:19:c0:85:84:69:2a:8a:40:3e:ba:0a:57:68:c9:f7:49:5f:
             19:14:a2:d9:29:72:80:74:0c:29:3e:77:d1:f7:42:68:15:d5:
             07:5d:4f:4d:13:d6:f2:25:89:80:69:68:4c:ee:80:df:b3:9d:
             c1:b8:4e:cb
    -----BEGIN CERTIFICATE REQUEST-----
    MIIDOTCCAiECAQAwYTELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAmJqMQswCQYDVQQH
    DAJiajEPMA0GA1UECgwGaG9uZ3lpMQ8wDQYDVQQLDAZob25neWkxFjAUBgNVBAMM
    DW1hY3Jvd2luZy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDI
    xApeL8MeshOI4S+xe0lm9toNhf+Up6NvjOYwMdo3b6E/B6mAXSIjX0pAaGTl83p/
    LqF76IQWuWGOuhmnZ3RzATFRDaKwA1vGHLnpEoZq2yHEWioHst206/9u7rSmvyT7
    hx4uoYpgmYqUU5YUEZEkd+lkWExJsLhIKbug/9IFMTvC5PjU2D7Qy2ol7IUi79Te
    7TsNPiV8ajHrToHf/F0XIxSzPXKBxc+0ybiPANZL6tSZpu4a/wDfETZSoMs5RqW5
    evu7hZXAtAPqxLNqwbY5Rv1cNfwH0pigG6q/YO1yo4euZeSt7ayvuU6p4xfE4hVM
    E5c2D3TNiTWR9KrUpbs/AgMBAAGggZIwFQYJKoZIhvcNAQkCMQgMBmhvbmd5aTAZ
    BgkqhkiG9w0BCQcxDAwKd3NvMmNhcmJvbjBeBgkqhkiG9w0BCQ4xUTBPMAkGA1Ud
    EwQCMAAwCwYDVR0PBAQDAgXgMDUGA1UdEQQuMCyCDW1hY3Jvd2luZy5jb22CDyou
    bWFjcm93aW5nLmNvbYcEwKgCx4cEwKkCATANBgkqhkiG9w0BAQsFAAOCAQEALU48
    p0No5cRY10z3HubOMR7SEc4ZFVZQJ44637ZTib16+JzJD4gQK3GHdGetPUG75rgm
    24oipXag6jweT0wBPAxUbMIRUlpmyfHWaFo+cqDyg103nJ3t4LFIh25ua0e9FaF9
    riYwbFQNvjXmPv8dLpO/2TuuVRAFU41Fjx2IWuXhQ7ty13LIn57vWGqx2gb31/Cb
    JMlh6undzsxwLjVdgpnkVEtbk2pTaGVanP46b6FRLO/dCXmL5A3k/Mg2G/bXcy4E
    yuKelRnAhYRpKopAProKV2jJ90lfGRSi2SlygHQMKT530fdCaBXVB11PTRPW8iWJ
    gGloTO6A37OdwbhOyw==
    -----END CERTIFICATE REQUEST-----
    
    
    5.
    需先执行一下两条命令：
    	sudo touch /etc/pki/CA/index.txt
    	echo 01 | sudo tee /etc/pki/CA/serial
    [root@localhost tls2]# openssl ca -in macrowing.com.csr -md sha256 -out macrowing.com.crt -cert CA.crt -keyfile CA.key -extensions v3_req -config openssl.cnf
    WARNING: can't open config file: /etc/pki/tls/openssl.cnf
    Using configuration from openssl.cnf
    Enter pass phrase for CA.key:
    Check that the request matches the signature
    Signature ok
    Certificate Details:
            Serial Number: 5 (0x5)
            Validity
                Not Before: Dec 18 03:28:00 2020 GMT
                Not After : Dec 18 03:28:00 2021 GMT
            Subject:
                countryName               = CN
                stateOrProvinceName       = bj
                organizationName          = hongyi
                organizationalUnitName    = hongyi
                commonName                = macrowing.com
            X509v3 extensions:
                X509v3 Basic Constraints: 
                    CA:FALSE
                X509v3 Key Usage: 
                    Digital Signature, Non Repudiation, Key Encipherment
                X509v3 Subject Alternative Name: 
                    DNS:macrowing.com, DNS:*.macrowing.com, IP Address:192.168.2.199, IP Address:192.169.2.1
    Certificate is to be certified until Dec 18 03:28:00 2021 GMT (365 days)
    Sign the certificate? [y/n]:y
    
    
    1 out of 1 certificate requests certified, commit? [y/n]y
    Write out database with 1 new entries
    Data Base Updated
    
    
    6. 
    [root@localhost tls2]# openssl x509 -in macrowing.com.crt -text
    WARNING: can't open config file: /etc/pki/tls/openssl.cnf
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number: 5 (0x5)
        Signature Algorithm: sha256WithRSAEncryption
            Issuer: C=CN, ST=bj, L=bj, O=hongyi, OU=hongyi, CN=aliyun
            Validity
                Not Before: Dec 18 03:28:00 2020 GMT
                Not After : Dec 18 03:28:00 2021 GMT
            Subject: C=CN, ST=bj, O=hongyi, OU=hongyi, CN=macrowing.com
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (2048 bit)
                    Modulus:
                        00:c8:c4:0a:5e:2f:c3:1e:b2:13:88:e1:2f:b1:7b:
                        49:66:f6:da:0d:85:ff:94:a7:a3:6f:8c:e6:30:31:
                        da:37:6f:a1:3f:07:a9:80:5d:22:23:5f:4a:40:68:
                        64:e5:f3:7a:7f:2e:a1:7b:e8:84:16:b9:61:8e:ba:
                        19:a7:67:74:73:01:31:51:0d:a2:b0:03:5b:c6:1c:
                        b9:e9:12:86:6a:db:21:c4:5a:2a:07:b2:dd:b4:eb:
                        ff:6e:ee:b4:a6:bf:24:fb:87:1e:2e:a1:8a:60:99:
                        8a:94:53:96:14:11:91:24:77:e9:64:58:4c:49:b0:
                        b8:48:29:bb:a0:ff:d2:05:31:3b:c2:e4:f8:d4:d8:
                        3e:d0:cb:6a:25:ec:85:22:ef:d4:de:ed:3b:0d:3e:
                        25:7c:6a:31:eb:4e:81:df:fc:5d:17:23:14:b3:3d:
                        72:81:c5:cf:b4:c9:b8:8f:00:d6:4b:ea:d4:99:a6:
                        ee:1a:ff:00:df:11:36:52:a0:cb:39:46:a5:b9:7a:
                        fb:bb:85:95:c0:b4:03:ea:c4:b3:6a:c1:b6:39:46:
                        fd:5c:35:fc:07:d2:98:a0:1b:aa:bf:60:ed:72:a3:
                        87:ae:65:e4:ad:ed:ac:af:b9:4e:a9:e3:17:c4:e2:
                        15:4c:13:97:36:0f:74:cd:89:35:91:f4:aa:d4:a5:
                        bb:3f
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Basic Constraints: 
                    CA:FALSE
                X509v3 Key Usage: 
                    Digital Signature, Non Repudiation, Key Encipherment
                X509v3 Subject Alternative Name: 
                    DNS:macrowing.com, DNS:*.macrowing.com, IP Address:192.168.2.199, IP Address:192.169.2.1
        Signature Algorithm: sha256WithRSAEncryption
             99:fa:24:d8:14:94:c2:d7:42:f3:b4:87:2f:54:b7:c5:2c:04:
             23:71:be:fe:c3:fa:3d:ef:39:28:4c:5d:72:38:7c:bc:ca:cb:
             d1:56:d2:00:ff:2f:68:b0:2b:eb:71:68:10:a6:68:59:26:54:
             d6:b3:85:39:82:cf:d7:a7:89:60:91:ec:12:68:d1:46:c0:17:
             b4:7f:56:bd:ed:0c:2b:9e:7a:a6:2c:62:08:9d:9c:d0:94:f0:
             37:7d:8a:30:05:d5:d4:54:c7:f2:11:cf:f0:81:14:27:61:e2:
             16:ec:04:3e:03:4b:f3:9f:90:a4:0f:12:e4:06:bc:e3:98:57:
             2b:28:1d:58:3a:9e:57:fd:cf:aa:4c:60:3d:62:ca:ef:a3:1d:
             ab:1f:ba:2f:d3:66:4d:3a:80:a6:2a:96:d8:9e:3b:0a:69:77:
             a6:f1:66:12:29:e9:b4:0c:72:4e:b9:cd:5e:3c:4b:f0:16:f8:
             05:5a:f8:1d:6c:03:16:27:ea:fc:5b:0f:18:27:f4:c7:a0:72:
             da:83:61:fa:53:e8:35:80:04:4a:7c:31:57:0a:df:14:1b:5b:
             2c:40:87:55:1f:7d:ae:3a:3b:5b:ea:56:dd:c2:53:70:73:b9:
             cf:bd:43:5d:bb:e6:4d:2e:f3:62:69:6d:97:5f:cf:77:8e:f2:
             e9:cf:ba:ab
    -----BEGIN CERTIFICATE-----
    MIIDejCCAmKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJDTjEL
    MAkGA1UECAwCYmoxCzAJBgNVBAcMAmJqMQ8wDQYDVQQKDAZob25neWkxDzANBgNV
    BAsMBmhvbmd5aTEPMA0GA1UEAwwGYWxpeXVuMB4XDTIwMTIxODAzMjgwMFoXDTIx
    MTIxODAzMjgwMFowVDELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAmJqMQ8wDQYDVQQK
    DAZob25neWkxDzANBgNVBAsMBmhvbmd5aTEWMBQGA1UEAwwNbWFjcm93aW5nLmNv
    bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjECl4vwx6yE4jhL7F7
    SWb22g2F/5Sno2+M5jAx2jdvoT8HqYBdIiNfSkBoZOXzen8uoXvohBa5YY66Gadn
    dHMBMVENorADW8YcuekShmrbIcRaKgey3bTr/27utKa/JPuHHi6himCZipRTlhQR
    kSR36WRYTEmwuEgpu6D/0gUxO8Lk+NTYPtDLaiXshSLv1N7tOw0+JXxqMetOgd/8
    XRcjFLM9coHFz7TJuI8A1kvq1Jmm7hr/AN8RNlKgyzlGpbl6+7uFlcC0A+rEs2rB
    tjlG/Vw1/AfSmKAbqr9g7XKjh65l5K3trK+5TqnjF8TiFUwTlzYPdM2JNZH0qtSl
    uz8CAwEAAaNRME8wCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwNQYDVR0RBC4wLIIN
    bWFjcm93aW5nLmNvbYIPKi5tYWNyb3dpbmcuY29thwTAqALHhwTAqQIBMA0GCSqG
    SIb3DQEBCwUAA4IBAQCZ+iTYFJTC10LztIcvVLfFLAQjcb7+w/o97zkoTF1yOHy8
    ysvRVtIA/y9osCvrcWgQpmhZJlTWs4U5gs/Xp4lgkewSaNFGwBe0f1a97Qwrnnqm
    LGIInZzQlPA3fYowBdXUVMfyEc/wgRQnYeIW7AQ+A0vzn5CkDxLkBrzjmFcrKB1Y
    Op5X/c+qTGA9Ysrvox2rH7ov02ZNOoCmKpbYnjsKaXem8WYSKem0DHJOuc1ePEvw
    FvgFWvgdbAMWJ+r8Ww8YJ/THoHLag2H6U+g1gARKfDFXCt8UG1ssQIdVH32uOjtb
    6lbdwlNwc7nPvUNdu+ZNLvNiaW2XX893jvLpz7qr
    -----END CERTIFICATE-----
    
    
    7. 
    openssl x509 -in macrowing.com.crt -out macrowing.com.pem -outform PEM
    
    
    8. 
    openssl pkcs12 -export -in macrowing.com.crt -inkey macrowing.com.key -passin pass:wso2carbon -name wso2carbon -chain -CAfile CA.crt -password pass:wso2carbon -caname ziqianca -out wso2carbon.p12
    
    
    
    9.
    1.查看ｐ１２证书
    keytool -rfc -list -keystore wso2carbon.p12 -storetype pkcs12    密码是：changeit
    
    
    10.
    keytool -importkeystore -srckeystore wso2carbon.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore wso2carbon.jks
    正在将密钥库 wso2carbon.p12 导入到 wso2carbon.jks...
    输入目标密钥库口令:  
    再次输入新口令: 
    输入源密钥库口令:  
    已成功导入别名 wso2carbon 的条目。
    已完成导入命令: 1 个条目成功导入, 0 个条目失败或取消
    
    Warning:
    JKS 密钥库使用专用格式。建议使用 "keytool -importkeystore -srckeystore wso2carbon.jks -destkeystore wso2carbon.jks -deststoretype pkcs12" 迁移到行业标准格式 PKCS12。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0FpblVzZXI_size_16_color_FFFFFF_t_70][]

然后配置nginx或者Apache或者tomcat就可以了

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0FpblVzZXI_size_16_color_FFFFFF_t_70]: /images/20221120/34e528443cee4aad950332a84f17c856.png