From 4ced0c8006d9a3fa12ee593a9de26bb0bc272aef Mon Sep 17 00:00:00 2001 From: Shuanglei Tao Date: Mon, 15 May 2017 22:51:32 +0800 Subject: [PATCH] [ci skip] README: generate SSL certificate with SAN field (#57) --- README.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 238b299..2ff6f89 100644 --- a/README.md +++ b/README.md @@ -124,14 +124,16 @@ Generate SSL CA and self signed server/client certificates: ```bash # CA certificate (FQDN must be different from server/client) -openssl genrsa -out ca.key 4096 -openssl req -new -x509 -days 365 -key ca.key -out ca.crt -# server certificate -openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr -openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt +openssl genrsa -out ca.key 2048 +openssl req -new -x509 -days 365 -key ca.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=Acme Root CA" -out ca.crt + +# server certificate (for multiple domains, change subjectAltName to: DNS:example.com,DNS:www.example.com) +openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=localhost" -out server.csr +openssl x509 -req -extfile <(printf "subjectAltName=DNS:localhost") -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt + # client certificate (the p12/pem format may be useful for some clients) -openssl req -newkey rsa:2048 -nodes -keyout client.key -out client.csr -openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 02 -out client.crt +openssl req -newkey rsa:2048 -nodes -keyout client.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=client" -out client.csr +openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12 openssl pkcs12 -in client.p12 -out client.pem -clcerts ``` -- 2.43.4