OpenSSL signs its own generic domain name (wildcard) certificate

OpenSSL self-built CA signed by default is a single domain name certificate, because there are multiple HTTPS domain names on a single server, sometimes you want a certificate to solve all problems, if the same top-level domain name, then the universal domain name (wildcard) certificate is right for you

No need to modify the OPENSSL.CNF, other extensions are best commented out, do not comment or affect

As long as you enter the domain name (CN), change the www.baidu.com to *.baidu.com
!! Note here that a.b.baidu.com to be written *.b.baidu.com

!! In addition, after testing, the pan domain name can be used in conjunction with the multi-CN method , in the multi-CN fill in the domain name with *.xxx.com instead.
As for the standby hostname , you can test it yourself.

The other steps:

Some files and directories are required to exist in OPENSSL.CNF:

[[email protected]] #mkdir-P ca/{certs,crl,newcerts,private}

[[Email protected]]# Touch Ca/index.txt

[[email protected]] #echo xx > ca/serial

1. Generate Ca.key and self-signed

OpenSSL req-new-x509-days 3650-keyout ca.key-out ca.crt-config openssl.cnf

2. Generate Server.key (name not important)
OpenSSL genrsa-out Server.key 2048

3. Generate a Certificate signing request
OpenSSL req-new-key server.key-out server.csr-config openssl.cnf
Common Name is filled in this step, *.baidu.com

4. Using a self-signed CA, sign SERVER.SCR
OpenSSL ca-days 180-in server.csr-out server.crt-cert ca.crt-keyfile ca.key-config openssl.cnf
#输入第一步设置的密码, always press Y.

SERVER.CRT Server.key is the file used in the Web server.

NGINX Two-way authentication

If you want to do Nginx client certificate verification, repeat 2, 3, 4, and execute the following command to generate a personal certificate
5. Generate a personal certificate
OpenSSL pkcs12-export-inkey xxx.key-in xxx.crt-out xxx.p12

Import the personal certificate into the PC and add the settings on the Nginx SSL basis:
Ssl_verify_client on;
Ssl_client_certificate CA.CRT;

This article is from the "Drink" blog, please be sure to keep this source http://colinzhouyj.blog.51cto.com/2265679/1670634

OpenSSL signs its own generic domain name (wildcard) certificate