├── .gitignore ├── LICENSE ├── README.md ├── ca.cnf ├── docs ├── chrome-certs-details.png ├── chrome-certs-ok.png ├── chrome-settings-certs-imported.png ├── chrome-settings-certs.png ├── chrome-trust.md └── output.png ├── flush.sh ├── gen.cert.sh └── gen.root.sh /.gitignore: -------------------------------------------------------------------------------- 1 | /.idea/ 2 | /out/ 3 | /deploy-passport.sh 4 | /cert.all.sh 5 | /*.crt 6 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "{}" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright {yyyy} {name of copyright owner} 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 自签泛域名证书 2 | 此工具用于颁发泛域名证书，方便开发环境调试。 3 | 4 | 请勿用于生产环境，生产环境还是购买正式的证书。 5 | 或者到 [Let's Encrypt](https://letsencrypt.org/) 可以申请到免费证书 6 | （支持多域名和泛域名）。 7 | 8 | ## 优点 9 | 1. 你可以创建任意网站证书，只需导入一次根证书，无需多次导入； 10 | 1. 减少重复又无谓的组织信息输入，创建证书时只需要输入域名； 11 | 1. 泛域名证书可以减少 `nginx` 配置，例如你要模拟 CDN： 12 | 假设你的项目网站是 `example.dev`，CDN 网站设置为 `cdn.example.dev`， 13 | 你只需在 `nginx` 里面配置一个网站，`server_name` 同时填写 `example.dev` 14 | 和 `cdn.example.dev`，它们可以使用同一个 `*.example.dev` 的证书。 15 | 1. 现在你只需要一个证书，就可以搞定所有项目网站！ 16 | 17 | 使用 `SAN` 来支持多域名和泛域名： 18 | ```ini 19 | subjectAltName=DNS:*.one.dev,DNS:one.dev,DNS:*.two.dev,DNS:two.dev,DNS:*.three.dev,DNS:three.dev 20 | ``` 21 | 22 | ## 系统要求 23 | 1. Linux，openssl 24 | 1. 事先用 `hosts` 或者 `dnsmasq` 解析你本地开发的域名， 25 | 例如把 `example.dev` 指向 `127.0.0.1` 26 | 27 | ## 使用 28 | ```bash 29 | ./gen.cert.sh [] [] [] ... 30 | ``` 31 | 把 `` 替换成你的域名，例如 `example.dev` 32 | 33 | 运行的输出像这样： 34 | 35 | ![Output Screen](docs/output.png) 36 | 37 | 如果有多个项目网站，可以把所有网站都加上去，用空格隔开。 38 | 39 | 生成的证书位于： 40 | ```text 41 | out//.crt 42 | out//.bundle.crt 43 | ``` 44 | 45 | 证书有效期是 2 年，你可以修改 `ca.cnf` 来修改这个年限。 46 | 47 | 根证书位于： 48 | `out/root.crt` 49 | 成功之后，把根证书导入到操作系统里面，信任这个证书。 50 | 51 | 根证书的有效期是 20 年，你可以修改 `gen.root.sh` 来修改这个年限。 52 | 53 | 证书私钥位于： 54 | `out/cert.key.pem` 55 | 56 | 其中 `.bundle.crt` 是已经拼接好 CA 的证书，可以添加到 `nginx` 配置里面。 57 | 然后你就可以愉快地用 `https` 来访问你本地的开发网站了。 58 | 59 | ## 清空 60 | 你可以运行 `flush.sh` 来清空所有历史，包括根证书和网站证书。 61 | 62 | ## 配置 63 | 你可以修改 `ca.cnf` 来修改你的证书年限。 64 | ```ini 65 | default_days = 730 66 | ``` 67 | 68 | 可以修改 `gen.root.sh` 来自定义你的根证书名称和组织。 69 | 70 | 也可以修改 `gen.cert.sh` 来自定义你的网站证书组织。 71 | 72 | ## 参考 / 致谢 73 | [Vault and self signed SSL certificates](http://dunne.io/vault-and-self-signed-ssl-certificates) 74 | 75 | [利用OpenSSL创建自签名的SSL证书备忘](http://wangye.org/blog/archives/732/) 76 | 77 | [Provide subjectAltName to openssl directly on command line](http://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-command-line) 78 | 79 | ## 关于 Let's Encrypt 客户端 80 | 官方客户端 `certbot` [太复杂了](https://github.com/Neilpang/acme.sh/issues/386)，推荐使用 [acme.sh](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)。 81 | 82 | ## 关于 .dev 域名 83 | [Chrome to force .dev domains to HTTPS via preloaded HSTS](https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/) ([2017-9-16](https://chromium-review.googlesource.com/c/chromium/src/+/669923)) 84 | 85 | ## 关于 Chrome 信任证书问题 86 | 看到有人反映 Chrome 下无法信任证书，可参考 [这个文档](docs/chrome-trust.md) 87 | -------------------------------------------------------------------------------- /ca.cnf: -------------------------------------------------------------------------------- 1 | [ ca ] 2 | default_ca = Fishdrowned_ROOT_CA 3 | 4 | [ Fishdrowned_ROOT_CA ] 5 | new_certs_dir = ./out/newcerts 6 | certificate = ./out/root.crt 7 | database = ./out/index.txt 8 | private_key = ./out/root.key.pem 9 | serial = ./out/serial 10 | unique_subject = no 11 | default_days = 730 12 | default_md = sha256 13 | policy = policy_loose 14 | x509_extensions = ca_extensions 15 | copy_extensions = copy 16 | 17 | [ policy_loose ] 18 | countryName = optional 19 | stateOrProvinceName = optional 20 | localityName = optional 21 | organizationName = optional 22 | organizationalUnitName = optional 23 | commonName = supplied 24 | emailAddress = optional 25 | 26 | [ ca_extensions ] 27 | basicConstraints = CA:false 28 | nsComment = "OpenSSL Generated Server Certificate" 29 | subjectKeyIdentifier = hash 30 | authorityKeyIdentifier = keyid:always 31 | # subjectAltName = IP:127.0.0.1 32 | keyUsage = digitalSignature,keyEncipherment 33 | extendedKeyUsage = serverAuth 34 | 35 | [ req ] 36 | # Options for the `req` tool (`man req`). 37 | default_bits = 2048 38 | distinguished_name = req_distinguished_name 39 | string_mask = utf8only 40 | 41 | # SHA-1 is deprecated, so use SHA-2 instead. 42 | default_md = sha256 43 | 44 | # Extension to add when the -x509 option is used. 45 | x509_extensions = v3_ca 46 | 47 | [ req_distinguished_name ] 48 | # See . 49 | countryName = Country Name (2 letter code) 50 | stateOrProvinceName = State or Province Name 51 | localityName = Locality Name 52 | 0.organizationName = Organization Name 53 | organizationalUnitName = Organizational Unit Name 54 | commonName = Common Name 55 | emailAddress = Email Address 56 | 57 | # Optionally, specify some defaults. 58 | countryName_default = CN 59 | stateOrProvinceName_default = Guangdong 60 | localityName_default = Guangzhou 61 | 0.organizationName_default = Fishdrowned 62 | organizationalUnitName_default = 63 | emailAddress_default = 64 | 65 | [ v3_ca ] 66 | # Extensions for a typical CA (`man x509v3_config`). 67 | subjectKeyIdentifier = hash 68 | authorityKeyIdentifier = keyid:always,issuer 69 | basicConstraints = critical, CA:true 70 | keyUsage = critical, digitalSignature, cRLSign, keyCertSign 71 | 72 | [ v3_intermediate_ca ] 73 | # Extensions for a typical intermediate CA (`man x509v3_config`). 74 | subjectKeyIdentifier = hash 75 | authorityKeyIdentifier = keyid:always,issuer 76 | basicConstraints = critical, CA:true, pathlen:0 77 | keyUsage = critical, digitalSignature, cRLSign, keyCertSign 78 | 79 | [ usr_cert ] 80 | # Extensions for client certificates (`man x509v3_config`). 81 | basicConstraints = CA:FALSE 82 | nsCertType = client, email 83 | nsComment = "OpenSSL Generated Client Certificate" 84 | subjectKeyIdentifier = hash 85 | authorityKeyIdentifier = keyid,issuer 86 | keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment 87 | extendedKeyUsage = clientAuth, emailProtection 88 | 89 | [ server_cert ] 90 | # Extensions for server certificates (`man x509v3_config`). 91 | basicConstraints = CA:FALSE 92 | nsCertType = server 93 | nsComment = "OpenSSL Generated Server Certificate" 94 | subjectKeyIdentifier = hash 95 | authorityKeyIdentifier = keyid,issuer:always 96 | keyUsage = critical, digitalSignature, keyEncipherment 97 | extendedKeyUsage = serverAuth 98 | 99 | [ ocsp ] 100 | # Extension for OCSP signing certificates (`man ocsp`). 101 | basicConstraints = CA:FALSE 102 | subjectKeyIdentifier = hash 103 | authorityKeyIdentifier = keyid,issuer 104 | keyUsage = critical, digitalSignature 105 | extendedKeyUsage = critical, OCSPSigning 106 | -------------------------------------------------------------------------------- /docs/chrome-certs-details.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fishdrowned/ssl/394ef51a9c4592c2ad6d3f60a35230e2f3ee5707/docs/chrome-certs-details.png -------------------------------------------------------------------------------- /docs/chrome-certs-ok.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fishdrowned/ssl/394ef51a9c4592c2ad6d3f60a35230e2f3ee5707/docs/chrome-certs-ok.png -------------------------------------------------------------------------------- /docs/chrome-settings-certs-imported.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fishdrowned/ssl/394ef51a9c4592c2ad6d3f60a35230e2f3ee5707/docs/chrome-settings-certs-imported.png -------------------------------------------------------------------------------- /docs/chrome-settings-certs.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fishdrowned/ssl/394ef51a9c4592c2ad6d3f60a35230e2f3ee5707/docs/chrome-settings-certs.png -------------------------------------------------------------------------------- /docs/chrome-trust.md: -------------------------------------------------------------------------------- 1 | # 如何让 Chrome 信任证书 2 | 3 | 1. 打开设置页面 `chrome://settings/certificates`，切换到 `授权中心` 4 | ![](chrome-settings-certs.png) 5 | 1. 然后导入 `out/root.crt` 6 | ![](chrome-settings-certs-imported.png) 7 | 1. 完成 8 | ![](chrome-certs-ok.png) 9 | ![](chrome-certs-details.png) 10 | -------------------------------------------------------------------------------- /docs/output.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fishdrowned/ssl/394ef51a9c4592c2ad6d3f60a35230e2f3ee5707/docs/output.png -------------------------------------------------------------------------------- /flush.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | cd "$(dirname "${BASH_SOURCE[0]}")" 3 | echo 'Removing dir out' 4 | rm -rf out 5 | echo 'Creating output structure' 6 | mkdir out 7 | cd out 8 | mkdir newcerts 9 | touch index.txt 10 | echo "unique_subject = no" > index.txt.attr 11 | echo 1000 > serial 12 | echo 'Done' 13 | -------------------------------------------------------------------------------- /gen.cert.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | if [ -z "$1" ] 4 | then 5 | echo 6 | echo 'Issue a wildcard SSL certificate with Fishdrowned ROOT CA' 7 | echo 8 | echo 'Usage: ./gen.cert.sh [] [] [] ...' 9 | echo ' The domain name of your site, like "example.dev",' 10 | echo ' you will get a certificate for *.example.dev' 11 | echo ' Multiple domains are acceptable' 12 | exit; 13 | fi 14 | 15 | SAN="" 16 | for var in "$@" 17 | do 18 | SAN+="DNS:*.${var},DNS:${var}," 19 | done 20 | SAN=${SAN:0:${#SAN}-1} 21 | 22 | # Move to root directory 23 | cd "$(dirname "${BASH_SOURCE[0]}")" 24 | 25 | # Generate root certificate if not exists 26 | if [ ! -f "out/root.crt" ]; then 27 | bash gen.root.sh 28 | fi 29 | 30 | # Create domain directory 31 | BASE_DIR="out/$1" 32 | TIME=`date +%Y%m%d-%H%M` 33 | DIR="${BASE_DIR}/${TIME}" 34 | mkdir -p ${DIR} 35 | 36 | # Create CSR 37 | openssl req -new -out "${DIR}/$1.csr.pem" \ 38 | -key out/cert.key.pem \ 39 | -reqexts SAN \ 40 | -config <(cat ca.cnf \ 41 | <(printf "[SAN]\nsubjectAltName=${SAN}")) \ 42 | -subj "/C=CN/ST=Guangdong/L=Guangzhou/O=Fishdrowned/OU=$1/CN=*.$1" 43 | 44 | # Issue certificate 45 | # openssl ca -batch -config ./ca.cnf -notext -in "${DIR}/$1.csr.pem" -out "${DIR}/$1.cert.pem" 46 | openssl ca -config ./ca.cnf -batch -notext \ 47 | -in "${DIR}/$1.csr.pem" \ 48 | -out "${DIR}/$1.crt" \ 49 | -cert ./out/root.crt \ 50 | -keyfile ./out/root.key.pem 51 | 52 | # Chain certificate with CA 53 | cat "${DIR}/$1.crt" ./out/root.crt > "${DIR}/$1.bundle.crt" 54 | ln -snf "./${TIME}/$1.bundle.crt" "${BASE_DIR}/$1.bundle.crt" 55 | ln -snf "./${TIME}/$1.crt" "${BASE_DIR}/$1.crt" 56 | ln -snf "../cert.key.pem" "${BASE_DIR}/$1.key.pem" 57 | ln -snf "../root.crt" "${BASE_DIR}/root.crt" 58 | 59 | # Output certificates 60 | echo 61 | echo "Certificates are located in:" 62 | 63 | LS=$([[ `ls --help | grep '\-\-color'` ]] && echo "ls --color" || echo "ls -G") 64 | 65 | ${LS} -la `pwd`/${BASE_DIR}/*.* 66 | -------------------------------------------------------------------------------- /gen.root.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | cd "$(dirname "${BASH_SOURCE[0]}")" 3 | 4 | if [ -f "out/root.crt" ]; then 5 | echo Root certificate already exists. 6 | exit 1 7 | fi 8 | 9 | if [ ! -d "out" ]; then 10 | bash flush.sh 11 | fi 12 | 13 | # Generate root cert along with root key 14 | openssl req -config ca.cnf \ 15 | -newkey rsa:2048 -nodes -keyout out/root.key.pem \ 16 | -new -x509 -days 7300 -out out/root.crt \ 17 | -subj "/C=CN/ST=Guangdong/L=Guangzhou/O=Fishdrowned/CN=Fishdrowned ROOT CA" 18 | 19 | # Generate cert key 20 | openssl genrsa -out "out/cert.key.pem" 2048 21 | --------------------------------------------------------------------------------