制作PFX证书

制作PFX证书1、创建根证书密钥文件root.keyC:\Users\lijunlin>opensslgenrsa-des3-outroot.keyGeneratingRSAprivatekey,2048bitlongmodulus…………………………………………………………….+++.+++eis65537(0x10001)Enterpassphraseforroot.k

大家好,又见面了,我是你们的朋友全栈君。

1、创建根证书密钥文件 root.key

C:\Users\wood>openssl genrsa -des3 -out root.key
Generating RSA private key, 2048 bit long modulus
…………………………………………………………….+++
.+++
e is 65537 (0x10001)
Enter pass phrase for root.key:
Verifying – Enter pass phrase for root.key:

2、创建根证书的申请文件root.csr

C:\Users\wood>openssl req -new -key root.key -out root.csr
Unable to load config info from ?:\*THERE_IS_NO_DEFAULT_DIRECTORY_SET_ENVIRONMENT_VARIABLES_INSTEAD*/?:\*THERE_IS_NO_DEFAULT_DIRECTORY_SET_ENVIRONMENT_VARIABLES_INSTEAD*/openssl.cnf

C:\Users\wood>set OPENSSL_CONF=C:/gnuwin32/share/openssl.cnf

C:\Users\wood>openssl req -new -key root.key -out root.csr
Enter pass phrase for root.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:hb
Locality Name (eg, city) []:wh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ours
Organizational Unit Name (eg, section) []:ours
Common Name (eg, YOUR name) []:li
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3、创建一个自当前日期起为期十年的根证书root.crt

C:\Users\wood>openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt
Signature ok
subject=/C=cn/ST=hb/L=wh/O=ums/OU=ours/CN=li
Getting Private key
Enter pass phrase for root.key:

4、创建服务器证书密钥server.key

C:\Users\wood>openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
……………………….+++
……………………..+++
e is 65537 (0x10001)

5、创建服务器证书的申请文件server.csr

C:\Users\wood>openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:hb
Locality Name (eg, city) []:wh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ours
Organizational Unit Name (eg, section) []:ours
Common Name (eg, YOUR name) []:li
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

6、创建自当前日期起有效期为期两年的服务器证书server.crt

C:\Users\wood>openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -out server.crt
Signature ok
subject=/C=cn/ST=hb/L=wh/O=ums/OU=ours/CN=li
Getting CA Private Key
Enter pass phrase for root.key:

7、创建客户端证书密钥文件client.key

C:\Users\wood>openssl genrsa -des3 -out client.key 2048
Generating RSA private key, 2048 bit long modulus
………………………………………………………………………………………………..+++
.+++
e is 65537 (0x10001)
Enter pass phrase for client.key:
Verifying – Enter pass phrase for client.key:

8、创建客户端证书的申请文件client.csr

C:\Users\wood>openssl req -new -key client.key -out client.csr
Enter pass phrase for client.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:hb
Locality Name (eg, city) []:wh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ours
Organizational Unit Name (eg, section) []:ours
Common Name (eg, YOUR name) []:li
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

9、创建一个自当前日期起有效期为两年的客户端证书client.crt

C:\Users\wood>openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -out client.crt
Signature ok
subject=/C=cn/ST=hb/L=wh/O=ums/OU=ours/CN=li
Getting CA Private Key
Enter pass phrase for root.key:

10、将客户端证书文件client.crt和客户端证书密钥文件client.key合并成客户端证书安装包client.pfx

C:\Users\wood>openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx
Enter pass phrase for client.key:
Enter Export Password:
Verifying – Enter Export Password:

11、保存生成的文件备用,其中server.crtserver.key是配置单向SSL时需要使用的证书文件,client.crt是配置双向SSL时需要使用的证书文件,client.pfx是配置双向SSL时需要客户端安装的证书文件

.crt文件和.key可以合到一个文件里面,把2个文件合成了一个.pem文件(直接拷贝过去就行了)

版权声明:本文内容由互联网用户自发贡献,该文观点仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 举报,一经查实,本站将立刻删除。

发布者:全栈程序员-用户IM,转载请注明出处:https://javaforall.cn/133883.html原文链接:https://javaforall.cn

【正版授权,激活自己账号】: Jetbrains全家桶Ide使用,1年售后保障,每天仅需1毛

【官方授权 正版激活】: 官方授权 正版激活 支持Jetbrains家族下所有IDE 使用个人JB账号...

(0)


相关推荐

  • 下一代开发利器 jetbrains fleet 开放试用申请了[通俗易懂]

    下一代开发利器 jetbrains fleet 开放试用申请了[通俗易懂]申请回复jetbrainsfleet11月29日,JetBrains首席布道师HadiHariri在官方博客发文,正式宣布Fleet编辑器的到来。官网

  • pycharm使用anaconda的虚拟环境_pycharm解释器为空

    pycharm使用anaconda的虚拟环境_pycharm解释器为空项目场景:在pycharm中新建项目,如果需要新建python环境时的全部操作问题描述:显示所有的python解释器:condainfo-eanaconda已经安装好了,创建新的python环境:condacreate–namepython37python=3.7#创建一个名字为python37,版本是python3.7的新环境,conda会自动安装3.7的最新版本;它会把新安装的python环境放在anaconda3的envs目录下:…

  • pycharm2021.11.3激活补丁_最新在线免费激活

    (pycharm2021.11.3激活补丁)JetBrains旗下有多款编译器工具(如:IntelliJ、WebStorm、PyCharm等)在各编程领域几乎都占据了垄断地位。建立在开源IntelliJ平台之上,过去15年以来,JetBrains一直在不断发展和完善这个平台。这个平台可以针对您的开发工作流进行微调并且能够提供…

  • Keytool命令详解

    以前用过几次这个东东,但每次都重新查询一次。本文原始出处是这里 。-----------------------------------------------------------Keytool 是一个Java 数据证书的管理工具,Keytool 将密钥(key)和证书(certificates)存在一个称为keystore的文件中在keystore里,包含两种数据: 密钥

  • 快速搭建个人博客——保姆级教程「建议收藏」

    文章目录序言本地网站开发工具WebStormVscode框架Hexo(强烈推荐)WordPress本地环境gitnode.jsHexo安装初始化主题样式Butterfly应用正式上线图床Butterfly配置GitHubPages配置服务器选购攻略阿里云学生专享活动专享腾讯云学生专享活动专享域名购买DNS解析添加域名添加解析记录服务器购买部署密码设定远程连接git配置安装NginxHexo配置修改备案ICP联网备案序言偶然间,看到某乎上高赞的一个问题:怎么证明下计算机专业学生的能力?问题下面呢,也是有

  • 初级算法学习步骤

    初级算法学习步骤前言零散整理一个多月终于整理完了。。。。这是一篇初级算法学习的步骤总结,或许可以帮助你怎么去接触算法阅读本文需要一定java语法基础和api文档查看基础,但算法其实看重的是思想而不是语言,所以都可以借鉴。本人大二,参加过蓝桥杯。一直没时间吧之前的总结整理出来,现在准备整理一下用java做算法的一些东西……学习了两个月左右算法,从啥都不会到小白再到算是初级……做一个总结,请高手多多指…

发表回复

您的电子邮箱地址不会被公开。

关注全栈程序员社区公众号