Linux下利用openssl 生成SSL证书步骤1、概念首先要有一个CA根证书，然后用CA根证书来签发用户证书。

用户进行证书申请：一般先生成一个私钥，然后用私钥生成证书请求(证书请求里应含有公钥信息)，再利用证书服务器的CA根证书来签发证书。

2、后缀详解.key格式：私有的密钥.csr格式：证书签名请求（证书请求文件），含有公钥信息，certificate signing request 的缩写.crt格式：证书文件，certificate的缩写.crl格式：证书吊销列表，Certificate Revocation List的缩写.pem格式：用于导出，导入证书时候的证书的格式，有证书开头，结尾的格式3、添加 index.txt 和 serial 文件cd /etc/pki/CA/touch /etc/pki/CA/index.txttouch /etc/pki/CA/serialecho 01 > /etc/pki/CA/serial4、CA根证书的生成4.1 生成CA私钥（.key）openssl genrsa -out ca.key 2048[root@CA]# openssl genrsa -out ca.key 2048Generating RSA private key, 2048 bit long modulus.............+++.....+++e is 65537 (0x10001)4.2 生成CA证书请求（.csr）openssl req -new -key ca.key -out ca.csr[root@CA]# openssl req -new -key ca.key -out ca.csrYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:USState or Province Name (full name) []:ORLocality Name (eg, city) [Default City]:OROrganization Name (eg, company) [Default Company Ltd]:LXOROrganizational Unit Name (eg, section) []:LXORAQCommon Name (eg, your name or your server's hostname) []:Email Address []:eg@Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:demon2234An optional company name []:OR4.3 自签名得到根证书（.crt）（CA给自已颁发的证书）openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt[root@CA]# openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt Signature oksubject=/C=US/ST=OR/L=OR/O=LXOR/OU=LXORAQ/CN=/emailAddress=eg@ Getting Private key5、用户证书的生成5.1 生成私钥（.key）openssl genrsa -des3 -out server.key 1024[root@CA]# openssl genrsa -des3 -out server.key 1024Generating RSA private key, 1024 bit long modulus........++++++...................++++++e is 65537 (0x10001)Enter pass phrase for server.key:Verifying - Enter pass phrase for server.key:5.2 生成证书请求（.csr）openssl req -new -key server.key -out server.csr[root@CA]# openssl req -new -key server.key -out server.csrEnter pass phrase for server.key:You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:USState or Province Name (full name) []:ORLocality Name (eg, city) [Default City]:OROrganization Name (eg, company) [Default Company Ltd]:LXOROrganizational Unit Name (eg, section) []:LXORAQCommon Name (eg, your name or your server's hostname) []:Email Address []:eg@Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:demon2234An optional company name []:OR5.3 用CA根证书签名得到证书（.crt）o penssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key[root@CA]# openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key Using configuration from /etc/pki/tls/fCheck that the request matches the signatureSignature okCertificate Details:Serial Number: 3 (0x3)ValidityNot Before: Mar 13 07:01:44 2018 GMTNot After : Mar 13 07:01:44 2019 GMTSubject:countryName = USstateOrProvinceName = ORorganizationName = LXORorganizationalUnitName = LXORAQcommonName = emailAddress = eg@X509v3 extensions:X509v3 Basic Constraints:CA:FALSENetscape Comment:OpenSSL Generated CertificateX509v3 Subject Key Identifier:11:62:12:26:6C:1C:56:CD:9D:B2:6A:65:06:24:57:27:3E:5C:BC:EAX509v3 Authority Key Identifier:DirName:/C=US/ST=OR/L=OR/O=LXOR/OU=LXORAQ/CN=/emailAddress=eg@ serial:C9:6E:10:F7:A5:40:8F:1DCertificate is to be certified until Mar 13 07:01:44 2019 GMT (365 days)Sign the certificate? [y/n]:yfailed to update database//错误提示，解决方法将/etc/pki/CA目录下的index.txt文件删除，重TXT_DB error number 2新创建一个index.txt文件。

原因是openssl无法同时建两个crt 文件所以在创建完server.crt 后报错，如果不删除index.txt文件，在建立client.crt时也会报错。

正确操作提示：[root@CA]# openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key Using configuration from /etc/pki/tls/fCheck that the request matches the signatureSignature okCertificate Details:Serial Number: 4 (0x4)ValidityNot Before: Mar 13 07:13:01 2018 GMTNot After : Mar 13 07:13:01 2019 GMTSubject:countryName = USstateOrProvinceName = ORorganizationName = LXORorganizationalUnitName = LXORAQcommonName = emailAddress = eg@X509v3 extensions:X509v3 Basic Constraints:CA:FALSENetscape Comment:OpenSSL Generated CertificateX509v3 Subject Key Identifier:9E:D9:C9:C7:E9:FE:C6:3D:5F:9A:B1:B6:24:1F:2F:6E:C9:C9:4B:4CX509v3 Authority Key Identifier:DirName:/C=US/ST=OR/L=OR/O=LXOR/OU=LXORAQ/CN=/emailAddress=eg@ serial:C9:6E:10:F7:A5:40:8F:1DCertificate is to be certified until Mar 13 07:13:01 2019 GMT (365 days)Sign the certificate? [y/n]:y1 out of 1 certificate requests certified, commit? [y/n]yWrite out database with 1 new entriesData Base Updated6、客户端用户证书6.1 生成私钥（.key）openssl genrsa -des3 -out client.key 1024[root@CA]# openssl genrsa -des3 -out client.key 1024Generating RSA private key, 1024 bit long modulus ...................................++++++ .....................................++++++e is 65537 (0x10001)Enter pass phrase for client.key:Verifying - Enter pass phrase for client.key:6.2 生成证书请求（.csr）openssl req -new -key client.key -out client.csr[root@CA]# openssl req -new -key client.key -out client.csrEnter pass phrase for client.key:You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:USState or Province Name (full name) []:ORLocality Name (eg, city) [Default City]:OROrganization Name (eg, company) [Default Company Ltd]:LXOROrganizational Unit Name (eg, section) []:LXORAQCommon Name (eg, your name or your server's hostname) []:Email Address []:eg@Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:demon2234An optional company name []:OR6.3 用CA根证书签名得到证书（.crt）openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key[root@CA]# openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key Using configuration from /etc/pki/tls/fCheck that the request matches the signatureSignature okCertificate Details:Serial Number: 3 (0x3)ValidityNot Before: Mar 13 07:06:28 2018 GMTNot After : Mar 13 07:06:28 2019 GMTSubject:countryName = USstateOrProvinceName = ORorganizationName = LXORorganizationalUnitName = LXORAQcommonName = emailAddress = eg@X509v3 extensions:X509v3 Basic Constraints:CA:FALSENetscape Comment:OpenSSL Generated CertificateX509v3 Subject Key Identifier:9E:D9:C9:C7:E9:FE:C6:3D:5F:9A:B1:B6:24:1F:2F:6E:C9:C9:4B:4CX509v3 Authority Key Identifier:DirName:/C=US/ST=OR/L=OR/O=LXOR/OU=LXORAQ/CN=/emailAddress=eg@ serial:C9:6E:10:F7:A5:40:8F:1DCertificate is to be certified until Mar 13 07:06:28 2019 GMT (365 days)Sign the certificate? [y/n]:yfailed to update database//错误提示，解决方法将/etc/pki/CA目录下的index.txt文件删除，重TXT_DB error number 2新创建一个index.txt文件。