Use OpenSSL to create a Certificate Bash script containing SAN
The previous article introduced Create a certificate containing SAN with OpenSSL But the command is executed in one line, which is very inconvenient. This article is rewritten to the shell script version, which is very convenient to generate a server and client certificate that can be generated by a command.
Create a file CERT.SH, save the shell script below, and then execute it directly to order a server and client certificate.
#!/bin/bash
DIR=./certs
if [ -d "$DIR" ]
then
echo "$DIR Found."
else
mkdir certs
fi
rm certs/*
touch certs/openssl.cnf
cat>>certs/openssl.cnf<<EOF
[CA_default]
copy_extensions = copy
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
# country
C = CN
# province
ST = Jl
# city
L = Cc
# organization
O = hacker's home
# department
OU = hacker's home
# domain
CN = localhost
[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
# 解析域名
DNS.1 = localhost
EOF
cd certs
echo "make ca key"
openssl genrsa -out ca.key 2048
echo "make ca certificate"
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt
mkdir server
mkdir client
echo "make server key"
openssl genrsa -out server/server.key 2048
echo "make server certificate"
openssl req -new -nodes -key server/server.key -out server/server.csr -config openssl.cnf -extensions 'v3_req'
openssl x509 -req -in server/server.csr -out server/server.pem -CA ca.crt -CAkey ca.key -CAcreateserial -extfile openssl.cnf -extensions 'v3_req'
echo "make client key"
openssl genrsa -out client/client.key 2048
echo "make client certificate"
openssl req -new -nodes -key client/client.key -out client/client.csr -config openssl.cnf -extensions 'v3_req'
openssl x509 -req -in client/client.csr -out client/client.pem -CA ca.crt -CAkey ca.key -CAcreateserial -extfile openssl.cnf -extensions 'v3_req'