27 lines
906 B
Bash
Executable File
27 lines
906 B
Bash
Executable File
# 1. 生成一个自签名 mTLS CA 证书
|
||
openssl req -new -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 \
|
||
-keyout ca.key -out ca.crt \
|
||
-subj "/C=US/O=OrganizationName/CN=CommonName"
|
||
|
||
# 2. 创建客户端私钥（RSA 4096）
|
||
openssl genrsa -out client.key 4096
|
||
|
||
# 3. 创建客户端的证书请求 (CSR)
|
||
openssl req -new -sha256 \
|
||
-key client.key -out client.csr \
|
||
-subj "/C=US/O=OrganizationName/CN=CommonName"
|
||
|
||
# 4. 用 CA 给客户端证书签名
|
||
openssl x509 -req -sha256 -days 730 \
|
||
-in client.csr -CA ca.crt -CAkey ca.key \
|
||
-CAcreateserial -out client.crt
|
||
|
||
# 导出 PKCS#12/.p12 证书 （不带证书链）
|
||
openssl pkcs12 -export \
|
||
-inkey client.key -in client.crt \
|
||
-out client.p12 -name "client-app-01"
|
||
# 导出 PKCS#12/.p12 证书 （带证书链）
|
||
openssl pkcs12 -export \
|
||
-inkey client.key -in client.crt -certfile ca.crt \
|
||
-out client-with-ca.p12 -name "client-app-01"
|