标签：服务器 ssl
原创文章，转载请注明出处：服务器非业余研究http://blog.csdn.net/erlib 作者Sunface
如果仅为了测试，那使用下面方法即可：
测试证书创建：
1.创建证书的key
- $ openssl genrsa -out key.pem 1024
2.创建证书，注意这里的common name应该填你的server name
- $ openssl req -new -key key.pem -out request.pem
- Country Name (2 letter code) [AU]:UA
- State or Province Name (full name) [Some-State]:
- Locality Name (eg, city) []:Kiev
- Organization Name (eg, company) [Internet Widgits Pty Ltd]:site4fast blog
- Organizational Unit Name (eg, section) []:.
- Common Name (eg, YOUR name) []:site4fast.example.net
- Email Address []:site4fast@example.net
- Please enter the following ‘extra‘ attributes
- to be sent with your certificate request
- A challenge password []:
- An optional company name []:
3.证书签字
- $ openssl x509 -req -days 30 -in request.pem -signkey key.pem -out certificate.pem
4.至此，我们需要的测试证书已经创建好了："self-signed certificate".
正式的证书创建步骤：
1.安装CA证书
- $ aptitude install ssl-cert ca-certificates
2.在startssl.com注册
3.创建一个请求
- $ openssl req -new -newkey rsa:2048 -nodes -keyout www_privatekey.pem -out www_csr.pem
- Generating a 2048 bit RSA private key
- ..................................++++++
- ....................++++++
- writing new private key to ‘www_privatekey.pem‘
- -----
- You are about to be asked to enter information that will be incorporated
- into your certificate request.
- What you are about to enter is what is called a Distinguished Name or a DN.
- There are quite a few fields but you can leave some blank
- For some fields there will be a default value,
- If you enter ‘.‘, the field will be left blank.
- -----
- Country Name (2 letter code) [AU]:UA
- State or Province Name (full name) [Some-State]:Some state
- Locality Name (eg, city) []:Some City
- Organization Name (eg, company) [Internet Widgits Pty Ltd]:Some Organisation
- Organizational Unit Name (eg, section) []:IT
- Common Name (eg, YOUR name) []:www.example.org
- Email Address []:test@example.org
-
- Please enter the following ‘extra‘ attributes
- to be sent with your certificate request
- A challenge password []:
- An optional company name []:
4.在发送之前验证请求的内容
- $ openssl req -in www_csr.pem -text -verify -noout
5.将请求发送给startssl.com，从网站请求一个新的证书，当需要CSR的时候将‘www_csr.pem‘填进去
6.从网页上复制证书，然后放入‘www_certificate.pem‘文件，然后检查文件的内容:
- $ openssl x509 -in www_certificate.pem -text -noout
7.测试服务器证书
- $ openssl verify www_certificate.pem
如果都正确，那就会看到OK的提示
- www_certificate.pem: OK
如何获取自己的SSL证书
标签：服务器 ssl
原文地址：http://blog.csdn.net/erlib/article/details/46636055
