1. ECC算法

1.1. 建立CA

1
2
3
4
5
6
7
8
9
10
11
12
13
# 选定曲线类型，设置CA信息
openssl ecparam -genkey -name secp256r1 -out ca.key
openssl req -new -subj "/C=CN/ST=BJ/L=BJ/O=K/OU=K/CN=KCA" -key ca.key -out ca.csr
# 验证
openssl req -text -noout -verify -in ca.csr
# 设置CA证书的属性
echo "subjectKeyIdentifier=hash" > ca_cert_extensions
echo "authorityKeyIdentifier=keyid:always,issuer" >> ca_cert_extensions
echo "basicConstraints=critical,CA:true" >> ca_cert_extensions
echo "subjectAltName=IP:127.0.0.1" >> ca_cert_extensions
# 生成CA证书并验证
openssl x509 -req -days 3650 -sha256 -extfile ca_cert_extensions -signkey ca.key -in ca.csr -out ca.crt
openssl x509 -text -noout -in ca.crt

1.2. 签发证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# 选定曲线类型，设置用户信息
openssl ecparam -genkey -name secp256r1 -out k.key
openssl req -new -subj "/C=CN/ST=BJ/L=BJ/O=K/OU=K/CN=K" -key k.key -out k.csr
# 验证
openssl req -text -noout -verify -in k.csr
# 设置用户证书的属性，这里最后一行的IP地址，要和实际相匹配，不然可能会无法TLS握手
echo "subjectKeyIdentifier = hash" > k_cert_extensions
echo "authorityKeyIdentifier = keyid:always,issuer" >> k_cert_extensions
echo "basicConstraints = CA:FALSE" >> k_cert_extensions
echo "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> k_cert_extensions
echo "subjectAltName = IP:192.168.1.100" >> k_cert_extensions
# 签发用户证书并验证
openssl x509 -req -days 3650 -sha256 -extfile k_cert_extensions -CA ca.crt -CAkey ca.key -in k.csr -out k.crt -CAcreateserial
openssl x509 -text -noout -in k.crt

2. RSA算法

2.1. 建立CA

1
2
3
# 选定密钥长度，设置CA信息，生成CA证书
openssl genrsa -out ca.key 4096
openssl req -x509 -new -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=BJ/L=BJ/O=K/OU=K/CN=KCA"

2.2. 签发证书

1
2
3
4
5
6
7
# 选定密钥长度，设置用户信息
openssl genrsa -out k.key 4096
openssl req -new -key k.key -out k.csr -subj "/C=CN/ST=BJ/L=BJ/O=K/OU=K/CN=K"
# 设置用户证书的属性，这里的IP地址，要和实际相匹配，不然可能会无法TLS握手
echo "subjectAltName=IP:192.168.1.100" > k_cert_extensions
# 签发用户证书
openssl x509 -req -in k.csr -signkey k.key -out k.crt -days 3650 -extfile k_cert_extensions

3. mkcert

https://github.com/FiloSottile/mkcert