制作PFX证书

大家好，又见面了，我是你们的朋友全栈君。

1、创建根证书密钥文件 root.key

C:\Users\wood>openssl genrsa -des3 -out root.key
Generating RSA private key, 2048 bit long modulus
…………………………………………………………….+++
.+++
e is 65537 (0x10001)
Enter pass phrase for root.key:
Verifying – Enter pass phrase for root.key:

2、创建根证书的申请文件root.csr：

C:\Users\wood>openssl req -new -key root.key -out root.csr
Unable to load config info from ?:\*THERE_IS_NO_DEFAULT_DIRECTORY_SET_ENVIRONMENT_VARIABLES_INSTEAD*/?:\*THERE_IS_NO_DEFAULT_DIRECTORY_SET_ENVIRONMENT_VARIABLES_INSTEAD*/openssl.cnf

C:\Users\wood>set OPENSSL_CONF=C:/gnuwin32/share/openssl.cnf

C:\Users\wood>openssl req -new -key root.key -out root.csr
Enter pass phrase for root.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:hb
Locality Name (eg, city) []:wh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ours
Organizational Unit Name (eg, section) []:ours
Common Name (eg, YOUR name) []:li
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3、创建一个自当前日期起为期十年的根证书root.crt：

C:\Users\wood>openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt
Signature ok
subject=/C=cn/ST=hb/L=wh/O=ums/OU=ours/CN=li
Getting Private key
Enter pass phrase for root.key:

4、创建服务器证书密钥server.key：

C:\Users\wood>openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
……………………….+++
……………………..+++
e is 65537 (0x10001)

5、创建服务器证书的申请文件server.csr：

C:\Users\wood>openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:hb
Locality Name (eg, city) []:wh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ours
Organizational Unit Name (eg, section) []:ours
Common Name (eg, YOUR name) []:li
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

6、创建自当前日期起有效期为期两年的服务器证书server.crt：

C:\Users\wood>openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -out server.crt
Signature ok
subject=/C=cn/ST=hb/L=wh/O=ums/OU=ours/CN=li
Getting CA Private Key
Enter pass phrase for root.key:

7、创建客户端证书密钥文件client.key：

C:\Users\wood>openssl genrsa -des3 -out client.key 2048
Generating RSA private key, 2048 bit long modulus
………………………………………………………………………………………………..+++
.+++
e is 65537 (0x10001)
Enter pass phrase for client.key:
Verifying – Enter pass phrase for client.key:

8、创建客户端证书的申请文件client.csr：

C:\Users\wood>openssl req -new -key client.key -out client.csr
Enter pass phrase for client.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:hb
Locality Name (eg, city) []:wh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ours
Organizational Unit Name (eg, section) []:ours
Common Name (eg, YOUR name) []:li
Email Address []:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

9、创建一个自当前日期起有效期为两年的客户端证书client.crt：

C:\Users\wood>openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -out client.crt
Signature ok
subject=/C=cn/ST=hb/L=wh/O=ums/OU=ours/CN=li
Getting CA Private Key
Enter pass phrase for root.key:

10、将客户端证书文件client.crt和客户端证书密钥文件client.key合并成客户端证书安装包client.pfx：

C:\Users\wood>openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx
Enter pass phrase for client.key:
Enter Export Password:
Verifying – Enter Export Password:

11、保存生成的文件备用，其中server.crt和server.key是配置单向SSL时需要使用的证书文件，client.crt是配置双向SSL时需要使用的证书文件，client.pfx是配置双向SSL时需要客户端安装的证书文件

.crt文件和.key可以合到一个文件里面，把2个文件合成了一个.pem文件（直接拷贝过去就行了）