root@172-17-218-79 \~\]# **mkdir cert** \[root@172-17-218-79 \~\]# **cd cert/** \[root@172-17-218-79 cert\]# **openssl genrsa -out server.key 1024** Generating RSA private key, 1024 bit long modulus (2 primes) ......+++++ .........................................+++++ e is 65537 (0x010001) \[root@172-17-218-79 cert\]# **openssl req -new -key server.key -out server.csr** You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) \[AU\]: State or Province Name (full name) \[Some-State\]: Locality Name (eg, city) \[\]: Organization Name (eg, company) \[Internet Widgits Pty Ltd\]: Organizational Unit Name (eg, section) \[\]: Common Name (e.g. server FQDN or YOUR name) \[\]:server Email Address \[\]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password \[\]: An optional company name \[\]: \[root@172-17-218-79 cert\]# **openssl x509 -req -in server.csr -out server.crt -signkey server.key -days 9999** Signature ok subject=C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN = server Getting Private key \[root@172-17-218-79 cert\]# ll total 12 -rw-r--r-- 1 root root 818 Dec 6 15:29 **server.crt** -rw-r--r-- 1 root root 627 Dec 6 15:29 server.csr -rw------- 1 root root 887 Dec 6 15:28 **server.key** 思路： 1. 生成私钥 2. 生成请求文件 3. 签名+x509封装