shell脚本生成证书

#!/bin/bash

rm ca.*
rm server.*
rm client.*

# 一、生成CA根证书
# 1、生成CA私钥(ca.key)
openssl genrsa -out ./ca.key 4096 

# 2、生成CA证书签名请求(ca.csr)
openssl req -new -key ./ca.key -out ./ca.csr -subj "/C=CN/ST=ShenZhen/L=ShenZhen/O=test/OU=main/CN=*.test.main.com/emailAddress=main@test.com"

# 3、生成自签名CA证书(ca.cert)
openssl x509 -req -days 3650 -in ./ca.csr -signkey ./ca.key -out ./ca.crt

# 二、生成Server证书
# 1、生成服务端私钥(server.key)
openssl genrsa -out ./server.key 4096

# 2、生成服务端证书签名请求(server.csr)
openssl req -new -key ./server.key -out ./server.csr -subj "/C=CN/ST=ShenZhen/L=ShenZhen/O=test/OU=server/CN=*.test.server.com/emailAddress=server@test.com"

# 3、使用ca证书签署服务端csr以生成服务端证书(server.cert)
openssl x509 -req -in ./server.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out ./server.crt -days 3650

# 三、生成Client证书（用于双向认证）
# 1、生成客户端私钥(client.key)
openssl genrsa -out ./client.key 4096

# 2、生成客户端证书签名请求(client.csr)
openssl req -new -key ./client.key -out ./client.csr -subj "/C=CN/ST=ShenZhen/L=ShenZhen/O=test/OU=client/CN=*.test.client.com/emailAddress=client@test.com"

# 3、使用ca证书签署客户端csr以生成客户端证书(client.cert)
openssl x509 -req -in ./client.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out ./client.crt -days 3650

原文链接：https://blog.csdn.net/fkewksai/article/details/118939435