研发环境：SSL证书快速部署

目录

概述

生成证书

单域名证书（dev.luckybin.top）

Linux

Windows（PowerShell）

通配符证书（*.luckybin.top）

Linux

Windows（PowerShell）

Nginx配置示例

单域名配置

通配符证书配置

证书有效性测试

注意事项

---

概述

本文档提供研发环境自签名证书生成指南，涵盖单域名证书 和通配符证书两种类型，支持Windows和Linux系统。

• OpenSSL版本：1.1.1及以上

• 域名 ：dev.luckybin.top

• 环境：Windows / Linux

生成证书

单域名证书（dev.luckybin.top）

Linux

# 创建证书目录
mkdir -p /usr/local/nginx/conf/cert

# 生成单域名证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /usr/local/nginx/conf/cert/dev.luckybin.top.key \
    -out /usr/local/nginx/conf/cert/dev.luckybin.top.crt \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=dev.luckybin.top" \
    -addext "subjectAltName=DNS:dev.luckybin.top,IP:192.168.60.201"

Windows（PowerShell）

# 创建证书目录 C:\nginx\conf\cert

# 生成单域名证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 `
    -keyout "C:\nginx\conf\cert\dev.luckybin.top.key" `
    -out "C:\nginx\conf\cert\dev.luckybin.top.crt" `
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=dev.luckybin.top" `
    -addext "subjectAltName=DNS:dev.luckybin.top,IP:192.168.60.201"

通配符证书（*.luckybin.top）

Linux

# 生成通配符证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /usr/local/nginx/conf/cert/wildcard.luckybin.top.key \
    -out /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=*.luckybin.top" \
    -addext "subjectAltName=DNS:*.luckybin.top,DNS:luckybin.top,DNS:dev.luckybin.top"

Windows（PowerShell）

# 生成通配符证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 `
    -keyout "C:\nginx\conf\cert\wildcard.luckybin.top.key" `
    -out "C:\nginx\conf\cert\wildcard.luckybin.top.crt" `
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=*.luckybin.top" `
    -addext "subjectAltName=DNS:*.luckybin.top,DNS:luckybin.top,DNS:dev.luckybin.top"

Nginx配置示例

单域名配置

server {
    listen 443 ssl;
    server_name dev.luckybin.top;
    
    # 单域名证书
    ssl_certificate /usr/local/nginx/conf/cert/dev.luckybin.top.crt;
    ssl_certificate_key /usr/local/nginx/conf/cert/dev.luckybin.top.key;
    
    # 可选：HTTP重定向到HTTPS
    location / {
        # 应用配置...
    }
}

通配符证书配置

server {
    listen 443 ssl;
    server_name ~^(?<subdomain>.+)\.luckybin\.top$;
    
    # 通配符证书
    ssl_certificate /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt;
    ssl_certificate_key /usr/local/nginx/conf/cert/wildcard.luckybin.top.key;
    
    location / {
        # ...
    }
}

证书有效性测试

# 测试HTTPS连接
curl -v https://dev.luckybin.top --cacert /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt

# 检查证书链
openssl s_client -connect dev.luckybin.top:443 -servername dev.luckybin.top </dev/null 2>/dev/null | openssl x509 -text

注意事项

1. 证书用途 ：仅限研发测试环境使用，切勿用于生产环境

2. 有效期：证书默认365天，到期前需重新生成

3. 浏览器警告：首次访问会有安全警告，需手动信任证书

4. 通配符限制 ：*.luckybin.top 不匹配 luckybin.top（需额外添加）