OpenSSL 密钥和证书管理

//生成使用通行码保护的私钥
$ openssl genrsa -aes256 -out fd.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................................................+++
..+++
e is 65537 (0x10001)
Enter pass phrase for fd.key: ****
Verifying - Enter pass phrase for fd.key:****

//显示生成私钥的内容
$ cat fd.key 
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,DEE8683382BEC12E8D6ADD71DA91C222

uFgnmm9R40heSNzoRKrNrKbwDwfBvDO+KAabn5OVsLAGK3KjcEf2+xtiBo7FiRgg
...省略
CdxlQvDamSBpGM8OqtVX6CXQkPE34mg5fezWTvqwaSZWJtBbtIVeVRUamL50pH/P
-----END RSA PRIVATE KEY-----

//去除私钥中的通行码保护
$ openssl rsa -in fd.key -out fd.key

//生成不使用通行码保护的私钥
$ openssl genrsa -out fd.key 2048
Generating RSA private key, 2048 bit long modulus
............................................+++
...................+++
e is 65537 (0x10001)
//显示公钥的内容
$ cat fd.key 
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEA5xT4MQorNkAvyZRZ5pXdejI+tUESWXKvDudG6MXhOHSy2S+d
...省略
WTAvKwaY88M3KawO1AeDiBEN8+HQ8Y9bK6lXb+jWBhUfSoWwhTD3WZU=
-----END RSA PRIVATE KEY-----
$ 

$ openssl rsa -in fd.key -pubout -out fd-public.key
Enter pass phrase for fd.key:****  //如果是没有通行码保护的私钥则不需要输入通行码
writing RSA key

$ cat fd-public.key 
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsgw1bgwqlzToi4oC+T3Q
gksuTiPJpNbUBWrpXa2tyCqcDp01u3mgxd/WXcEKoxWrUeAwfRXA0PZQY1QP0sPS
cdjWtPvGxBGEplstN+kOHBh9miMPXhVKr6PjCcI4nWDDXXh9IHnXta8O0zKy5jlk
+IUmTaf2WGen1o9wiscYTeSwlz4FLENNU3s+7N6fEG1jPggE5B6fzWabfUAFhrCY
RIQFEMn1c6fM/NgZSJaGUKXOWPcfRR/+aYJtls2eXpeGz53PBB4JLOH9kTI0+Asa
3+IFDXncFUg724bsFmYxJ57DGau9S+KqEkT2FmdxQR5JoGC2by+xsgMS0i14x3aR
oQIDAQAB
-----END PUBLIC KEY-----
$ 

//根据私钥生成csr文件
$ openssl req -new -key fd.key -out fd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank. 
//接下来会要求你输入几个字段的内容，如果你想让该字段留空，那么你应该输入一个英文句号后回车，
如果只敲了回车，那么某些字段会有默认值，这可能跟你想要的不同，所以需要注意这一点。
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:Some Technology Co., Ltd. 
Organizational Unit Name (eg, section) []:Organizational-Unit-Name
Common Name (eg, your name or your server's hostname) []:www.test.com
Email Address []:test@test.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

//直接查看生成的csr文件内容
$ cat fd.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIC8zCCAdsCAQAwga0xCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdCZWlqaW5nMRAw
...省略
q1oHo7p6HknUwqTY4dcI0BhVQT6cXBf+PXaSCCwxljXWRNY7ex/H
-----END CERTIFICATE REQUEST-----

//查看csr文件中输入等信息，可以检查是否有输入错误
$ openssl req -text -in fd.csr -noout
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=CN, ST=Beijing, L=Beijing, O=Some Technology Co., Ltd. , OU=Organizational-Unit-Name, CN=www.test.com/emailAddress=test@test.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:e7:14:f8:31:0a:2b:36:40:2f:c9:94:59:e6:95:
 ...省略
                    a8:48:87:b3:ce:c6:92:ee:a6:30:30:cc:11:33:60:
                    37:81
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         cc:64:64:52:10:7c:09:e9:83:e6:9d:97:82:17:8f:74:74:7d:
...省略
         55:41:3e:9c:5c:17:fe:3d:76:92:08:2c:31:96:35:d6:44:d6:
$

//fd.cnf
[req]
prompt = no
distinguished_name = distinguished_name
[distinguished_name]
CN = www.test.com
emailAddress = test@test.com
O = Some Technology Co., Ltd.
OU = Organizational-Unit-Name
ST = Beijing
L = Beijing
C = CN

//使用配置文件生成CSR文件
$ openssl req -new -config fd.cnf -key fd.key -out fd.csr
//如果有pass phrase 则需要输入

//根据csr文件自己签发证书
$ openssl x509 -req -days 365 -in fd.csr -signkey fd.key -out fd.crt
Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=Some Technology Co., Ltd. /OU=Organizational-Unit-Name/CN=www.test.com/emailAddress=test@test.com
Getting Private key

$ cat fd.crt 
-----BEGIN CERTIFICATE-----
MIID2DCCAsACCQCYrBR/rdwvITANBgkqhkiG9w0BAQUFADCBrTELMAkGA1UEBhMC
...省略
kbIPcNJTtSgFFHG++DORSmgelKqJIXN/Sr+aaBDo2byClpWk6iYsGOejf5QZOTFb
8BIf5p6tCNh8YleVfkUzjtXzcVIBojs66g7EGg==
-----END CERTIFICATE-----

//fd.ext
subjectAltName = DNS:*.test.com, DNS:test.com

//自签发多域名证书
$ openssl x509 -req -days 365 -in fd.csr -signkey fd.key -out fd.crt -extfile fd.ext
Signature ok
subject=/emailAddress=test@test.com/CN=www.test.com/O=Some Company Ltd/L=Beijing/C=CN
Getting Private key

//查看证书信息
$ openssl x509 -text -in fd.crt -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 14605685625506933521 (0xcab1d1b1315eab11)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: emailAddress=test@test.com, CN=www.test.com, O=Some Company Ltd, L=Beijing, C=CN
        Validity
            Not Before: Apr  4 01:22:11 2016 GMT
            Not After : Apr  4 01:22:11 2017 GMT
        Subject: emailAddress=test@test.com, CN=www.test.com, O=Some Company Ltd, L=Beijing, C=CN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:e7:14:f8:31:0a:2b:36:40:2f:c9:94:59:e6:95:
...省略
                    a8:48:87:b3:ce:c6:92:ee:a6:30:30:cc:11:33:60:
                    37:81
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:*.test.com, DNS:test.com
    Signature Algorithm: sha1WithRSAEncryption
         b4:12:f8:6f:3d:6d:30:05:67:12:de:a6:33:65:99:66:8a:75:
 　...省略
         ce:77:6e:02:50:15:bc:99:af:fc:ca:2b:d3:bd:14:13:f6:5f
$

//快速自签发证书
$ openssl req -new -x509 -days 365 -key fd.key -out fd.crt
//可以使用配置文件
$ openssl req -new -x509 -days 365 -config fd.cnf -key fd.key -out fd.crt

[req]
prompt = no
distinguished_name = distinguished_name
x509_extensions = extensions

[distinguished_name]
CN = www.test.com
emailAddress = test@test.com
O = Some Technology Co., Ltd.
OU = Organizational-Unit-Name
ST = Beijing
L = Beijing
C = CN

[extensions]
subjectAltName = DNS:*.test.com, DNS:test.com