怎样获取自己的SSL证书

原创文章，转载请注明出处：server非业余研究http://blog.csdn.net/erlib 作者Sunface

假设仅为了測试，那使用以下方法就可以：

測试证书创建：

1.创建证书的key

$ openssl genrsa -out key.pem 1024

2.创建证书，注意这里的common name应该填你的server name

$ openssl req -new -key key.pem -out request.pem
Country Name (2 letter code) [AU]:UA
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:Kiev
Organization Name (eg, company) [Internet Widgits Pty Ltd]:site4fast blog
Organizational Unit Name (eg, section) []:.
Common Name (eg, YOUR name) []:site4fast.example.net
Email Address []:[email protected].net
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3.证书签字

$ openssl x509 -req -days 30 -in request.pem -signkey key.pem -out certificate.pem

4.至此，我们须要的測试证书已经创建好了："self-signed certificate".

正式的证书创建步骤：

1.安装CA证书

$ aptitude install ssl-cert ca-certificates

2.在startssl.com注冊

3.创建一个请求

$ openssl req -new -newkey rsa:2048 -nodes -keyout www_privatekey.pem -out www_csr.pem

Generating a 2048 bit RSA private key
..................................++++++
....................++++++
writing new private key to ‘www_privatekey.pem‘
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [AU]:UA
State or Province Name (full name) [Some-State]:Some state
Locality Name (eg, city) []:Some City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Some Organisation
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:www.example.org
Email Address []:[email protected].org
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

4.在发送之前验证请求的内容

$ openssl req -in www_csr.pem -text -verify -noout

5.将请求发送给startssl.com，从站点请求一个新的证书。当须要CSR的时候将‘www_csr.pem‘填进去

6.从网页上复制证书。然后放入‘www_certificate.pem‘文件，然后检查文件的内容:

$ openssl x509 -in www_certificate.pem -text -noout

7.測试server证书

$ openssl verify www_certificate.pem

假设都正确。那就会看到OK的提示

www_certificate.pem: OK