OpenSSL signs its own generic domain name (wildcard) certificate

Source: Internet
Author: User
Tags nginx ssl

OpenSSL self-built CA signed by default is a single domain name certificate, because there are multiple HTTPS domain names on a single server, sometimes you want a certificate to solve all problems, if the same top-level domain name, then the universal domain name (wildcard) certificate is right for you


No need to modify the OPENSSL.CNF, other extensions are best commented out, do not comment or affect

As long as you enter the domain name (CN), change the www.baidu.com to *.baidu.com
!! Note here that a.b.baidu.com to be written *.b.baidu.com

!! In addition, after testing, the pan domain name can be used in conjunction with the multi-CN method , in the multi-CN fill in the domain name with *.xxx.com instead.
As for the standby hostname , you can test it yourself.

The other steps:

Some files and directories are required to exist in OPENSSL.CNF:

[[email protected]] #mkdir-P ca/{certs,crl,newcerts,private}

[[Email protected]]# Touch Ca/index.txt

[[email protected]] #echo xx > ca/serial


1. Generate Ca.key and self-signed

OpenSSL req-new-x509-days 3650-keyout ca.key-out ca.crt-config openssl.cnf

2. Generate Server.key (name not important)
OpenSSL genrsa-out Server.key 2048

3. Generate a Certificate signing request
OpenSSL req-new-key server.key-out server.csr-config openssl.cnf
Common Name is filled in this step, *.baidu.com


4. Using a self-signed CA, sign SERVER.SCR
OpenSSL ca-days 180-in server.csr-out server.crt-cert ca.crt-keyfile ca.key-config openssl.cnf
#输入第一步设置的密码, always press Y.


SERVER.CRT Server.key is the file used in the Web server.

NGINX Two-way authentication

If you want to do Nginx client certificate verification, repeat 2, 3, 4, and execute the following command to generate a personal certificate
5. Generate a personal certificate
OpenSSL pkcs12-export-inkey xxx.key-in xxx.crt-out xxx.p12

Import the personal certificate into the PC and add the settings on the Nginx SSL basis:
Ssl_verify_client on;
Ssl_client_certificate CA.CRT;

This article is from the "Drink" blog, please be sure to keep this source http://colinzhouyj.blog.51cto.com/2265679/1670634

OpenSSL signs its own generic domain name (wildcard) certificate

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.