# Wiki源代码自建 https 证书

由 Qiongpan Ke 于 2024-06-04 最后修改
导出
Office格式
以PDF格式导出 以ODT格式导出 以RTF格式导出
其他格式

选择要导出的页面：

选择所有/ 无

Legend:
  已创建页面
  修改后的扩展页
  Clean Extension Page

以HTML格式导出

显示最后作者

author | version | line-number | content
--- | --- | --- | ---
|  | 1 | {{box cssClass="floatinginfobox" title="**Contents**"}}
|  | 2 | {{toc/}}
|  | 3 | {{/box}}
|  | 4 |
|  | 5 | 参考文章：《[Nginx自建SSL证书部署HTTPS网站](https://www.cnblogs.com/panwenbin-logs/p/11850737.html)》
|  | 6 |
|  | 7 | # 1. 生成一个 RSA 私钥
|  | 8 |
|  | 9 | ```sh
|  | 10 | openssl genrsa -aes256 -out ca_rsa_private.key 4096
|  | 11 | ```
|  | 12 |
|  | 13 | 执行结果如下：
|  | 14 |
|  | 15 | ```txt
|  | 16 | $ openssl genrsa -aes256 -out ca_rsa_private.key 4096
|  | 17 | Generating RSA private key, 4096 bit long modulus (2 primes)
|  | 18 | .........++++
|  | 19 | ....................................................................................................................................................................................................................................++++
|  | 20 | e is 65537 (0x010001)
|  | 21 | Enter pass phrase for ca_rsa_private.key:
|  | 22 | Verifying - Enter pass phrase for ca_rsa_private.key:
|  | 23 | $ ls -ltr
|  | 24 | total 4
|  | 25 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 26 | ```
|  | 27 |
|  | 28 | # 2. 创建免密的 RSA 私钥
|  | 29 |
|  | 30 | 相比需要输入密码的 RSA 密钥，使用免密的 RSA 密钥，配置在 web 容器中，不需要在每次启动或重新加载配置时手动输入密码（部份 web 容器则直接在配置文件中配置 RSA 密钥的密码）。
|  | 31 |
|  | 32 | ```sh
|  | 33 | openssl rsa -in ca_rsa_private.key -out ca_rsa_private_nopass.key
|  | 34 | ```
|  | 35 |
|  | 36 | 执行结果如下：
|  | 37 |
|  | 38 | ```txt
|  | 39 | $ openssl rsa -in ca_rsa_private.key -out ca_rsa_private_nopass.key
|  | 40 | Enter pass phrase for ca_rsa_private.key:
|  | 41 | writing RSA key
|  | 42 | $ ls -ltr
|  | 43 | total 8
|  | 44 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 45 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 46 | ```
|  | 47 |
|  | 48 | # 3. 导出 RSA 私钥对应的公钥
|  | 49 |
|  | 50 | ```sh
|  | 51 | openssl rsa -in ca_rsa_private_nopass.key -pubout -out ca_rsa_public.key
|  | 52 | ```
|  | 53 |
|  | 54 | 执行结果如下：
|  | 55 |
|  | 56 | ```txt
|  | 57 | $ openssl rsa -in ca_rsa_private_nopass.key -pubout -out ca_rsa_public.key
|  | 58 | writing RSA key
|  | 59 | $ ls -ltr
|  | 60 | total 12
|  | 61 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 62 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 63 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 64 | ```
|  | 65 |
|  | 66 | # 4. 生成一个 CA 根证书签名请求
|  | 67 |
|  | 68 | ```sh
|  | 69 | openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=Example.com's Root CA/emailAddress=iana@iana.org" -key ca_rsa_private_nopass.key -out ca.csr
|  | 70 | ```
|  | 71 |
|  | 72 | 执行结果如下：
|  | 73 |
|  | 74 | ```txt
|  | 75 | $ openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=Example.com's Root CA/emailAddress=iana@iana.org" -key ca_rsa_private_nopass.key -out ca.csr
|  | 76 | $ ls -ltr
|  | 77 | total 16
|  | 78 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 79 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 80 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 81 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 82 | ```
|  | 83 |
|  | 84 | # 5. 使用 RSA 私钥对 CA 根证书签名请求进行自签
|  | 85 |
|  | 86 | ```sh
|  | 87 | # openssl x509 -req -days $((365 * 100)) -sha256 -extensions v3_ca -in ca.csr -signkey ca_rsa_private_nopass.key -out ca.crt
|  | 88 |
|  | 89 | #mkdir -p ./demoCA
|  | 90 | #touch ./demoCA/index.txt
|  | 91 | #openssl ca -days $((365 * 100)) -md sha256 -extensions v3_ca -selfsign -in ca.csr -keyfile ca_rsa_private_nopass.key -out ca.crt -outdir . -create_serial
|  | 92 |
|  | 93 | openssl req -x509 -days $((365 * 100)) -sha256 -nodes -in ca.csr -key ca_rsa_private_nopass.key -out ca.crt
|  | 94 | ```
|  | 95 |
|  | 96 | 执行结果如下：
|  | 97 |
|  | 98 | ```txt
|  | 99 | $ openssl req -x509 -days $((365 * 100)) -sha256 -nodes -in ca.csr -key ca_rsa_private_nopass.key -out ca.crt
|  | 100 | $ ls -ltr
|  | 101 | total 20
|  | 102 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 103 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 104 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 105 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 106 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 107 | ```
|  | 108 |
|  | 109 | # 6. 生成 https 服务器的 RSA 密钥
|  | 110 |
|  | 111 | ```sh
|  | 112 | openssl genrsa -aes256 -out https_rsa_private.key 4096
|  | 113 | ```
|  | 114 |
|  | 115 | 执行结果如下：
|  | 116 |
|  | 117 | ```txt
|  | 118 | $ openssl genrsa -aes256 -out https_rsa_private.key 4096
|  | 119 | Generating RSA private key, 4096 bit long modulus (2 primes)
|  | 120 | ......................................++++
|  | 121 | .............................++++
|  | 122 | e is 65537 (0x010001)
|  | 123 | Enter pass phrase for https_rsa_private.key:
|  | 124 | Verifying - Enter pass phrase for https_rsa_private.key:
|  | 125 | $ ls -ltr
|  | 126 | total 24
|  | 127 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 128 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 129 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 130 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 131 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 132 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 133 | ```
|  | 134 |
|  | 135 | # 7. 创建免密的 RSA 私钥
|  | 136 |
|  | 137 | 相比需要输入密码的 RSA 密钥，使用免密的 RSA 密钥，配置在 web 容器中，不需要在每次启动或重新加载配置时手动输入密码（部份 web 容器则直接在配置文件中配置 RSA 密钥的密码）。
|  | 138 |
|  | 139 | ```sh
|  | 140 | openssl rsa -in https_rsa_private.key -out https_rsa_private_nopass.key
|  | 141 | ```
|  | 142 |
|  | 143 | 执行结果如下：
|  | 144 |
|  | 145 | ```txt
|  | 146 | $ openssl rsa -in https_rsa_private.key -out https_rsa_private_nopass.key
|  | 147 | Enter pass phrase for https_rsa_private.key:
|  | 148 | writing RSA key
|  | 149 | $ ls -ltr
|  | 150 | total 28
|  | 151 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 152 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 153 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 154 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 155 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 156 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 157 | -rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
|  | 158 | ```
|  | 159 |
|  | 160 | # 8. 导出 RSA 私钥对应的公钥
|  | 161 |
|  | 162 | ```sh
|  | 163 | openssl rsa -in https_rsa_private_nopass.key -pubout -out https_rsa_public.key
|  | 164 | ```
|  | 165 |
|  | 166 | 执行结果如下：
|  | 167 |
|  | 168 | ```txt
|  | 169 | $ openssl rsa -in https_rsa_private_nopass.key -pubout -out https_rsa_public.key
|  | 170 | writing RSA key
|  | 171 | $ ls -ltr
|  | 172 | total 32
|  | 173 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 174 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 175 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 176 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 177 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 178 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 179 | -rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
|  | 180 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
|  | 181 | ```
|  | 182 |
|  | 183 | # 9. 生成一个 https 证书签名请求
|  | 184 |
|  | 185 | ```sh
|  | 186 | openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=*.example.com/emailAddress=iana@iana.org" -key https_rsa_private_nopass.key -out https.csr
|  | 187 | ```
|  | 188 |
|  | 189 | 执行结果如下：
|  | 190 |
|  | 191 | ```txt
|  | 192 | $ openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=*.example.com/emailAddress=iana@iana.org" -key https_rsa_private_nopass.key -out https.csr
|  | 193 | $ ls -ltr
|  | 194 | total 36
|  | 195 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 196 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 197 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 198 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 199 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 200 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 201 | -rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
|  | 202 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
|  | 203 | -rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
|  | 204 | ```
|  | 205 |
|  | 206 | # 10. 使用 CA 根证书对 https 证书签名请求进行签发
|  | 207 |
|  | 208 | 创建的过期时间不要太长，建议不超过2年，否则部份浏览器不会信任该证书，如: iPhone 上的 Safari、Chrome 等。
|  | 209 |
|  | 210 | 另外，在 Chrome 58 之后，不再只校验 CommonName 项是否与访问域名或IP匹配，还需要配置 subjectAltName 项。
|  | 211 |
|  | 212 | ```sh
|  | 213 | # 首次使用 CA 根证书签发 https 证书的同时创建 ca.srl 序列号参考文件
|  | 214 | # 第二次以后使用 CA 根证书签发 https 证书时直接引用之前创建的 ca.srl 序列号参考文件，并递增其序列号。
|  | 215 | openssl x509 -req -days $((356 * 2)) -sha256 -extfile <(cat /etc/ssl/openssl.cnf <(
|  | 216 | cat <<EOF
|  | 217 | [v3_san]
|  | 218 | subjectAltName = @alt_names
|  | 219 |
|  | 220 | [alt_names]
|  | 221 | DNS.1 = example.com
|  | 222 | DNS.2 = *.example.com
|  | 223 | EOF
|  | 224 | )) -extensions v3_san -CA ca.crt -CAkey ca_rsa_private_nopass.key -$(if [ -f ca.srl ]; then echo CAserial ca.srl; else echo CAcreateserial; fi) -in https.csr -out https.crt
|  | 225 | ```
|  | 226 |
|  | 227 | 执行结果如下：
|  | 228 |
|  | 229 | ```txt
|  | 230 | $ openssl x509 -req -days $((356 * 2)) -sha256 -extfile <(cat /etc/ssl/openssl.cnf <(
|  | 231 | t <<E> cat <<EOF
|  | 232 | > [v3_san]
|  | 233 | > subjectAltName = @alt_names
|  | 234 | >
|  | 235 | > [alt_names]
|  | 236 | > DNS.1 = example.com
|  | 237 | > DNS.2 = *.example.com
|  | 238 | > EOF
|  | 239 | > )) -extensions v3_san -CA ca.crt -CAkey ca_rsa_private_nopass.key -$(if [ -f ca.srl ]; then echo CAserial ca.srl; else echo CAcreateserial; fi) -in https.csr -out https.crt
|  | 240 | Signature ok
|  | 241 | subject=C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = *.example.com, emailAddress = iana@iana.org
|  | 242 | Getting CA Private Key
|  | 243 | $ ls -ltr
|  | 244 | total 40
|  | 245 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 246 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 247 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 248 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 249 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 250 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 251 | -rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
|  | 252 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
|  | 253 | -rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
|  | 254 | -rwxrwxrwx 1 stduser stduser 41 Jul 7 05:17 ca.srl
|  | 255 | -rwxrwxrwx 1 stduser stduser 2106 Jul 7 05:17 https.crt
|  | 256 | ```
|  | 257 |
|  | 258 | # 11. 将私钥和证书打包成 p12 文件
|  | 259 |
|  | 260 | ```sh
|  | 261 | openssl pkcs12 -export -inkey https_rsa_private_nopass.key -in https.crt -out https.keystore.p12 -name https
|  | 262 | ```
|  | 263 |
|  | 264 | 执行结果如下：
|  | 265 |
|  | 266 | ```txt
|  | 267 | $ openssl pkcs12 -export -inkey https_rsa_private_nopass.key -in https.crt -out https.keystore.p12 -name https
|  | 268 | Enter Export Password:
|  | 269 | Verifying - Enter Export Password:
|  | 270 | $ ls -ltr
|  | 271 | total 48
|  | 272 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 273 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 274 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 275 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 276 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 277 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 278 | -rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
|  | 279 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
|  | 280 | -rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
|  | 281 | -rwxrwxrwx 1 stduser stduser 41 Jul 7 05:17 ca.srl
|  | 282 | -rwxrwxrwx 1 stduser stduser 2106 Jul 7 05:17 https.crt
|  | 283 | -rwxrwxrwx 1 stduser stduser 4328 Jul 7 05:18 https.keystore.p12
|  | 284 | ```
|  | 285 |
|  | 286 | # 12. 将 p12 文件转换为 jks 文件
|  | 287 |
|  | 288 | ```sh
|  | 289 | keytool -importkeystore -srckeystore https.keystore.p12 -srcstoretype pkcs12 -destkeystore https.keystore.jks -deststoretype jks -v
|  | 290 | ```
|  | 291 |
|  | 292 | 执行结果如下：
|  | 293 |
|  | 294 | ```txt
|  | 295 | $ keytool -importkeystore -srckeystore https.keystore.p12 -srcstoretype pkcs12 -destkeystore https.keystore.jks -deststoretype jks -v
|  | 296 | Importing keystore https.keystore.p12 to https.keystore.jks...
|  | 297 | Enter destination keystore password:
|  | 298 | Re-enter new password:
|  | 299 | Enter source keystore password:
|  | 300 | Entry for alias https successfully imported.
|  | 301 | Import command completed: 1 entries successfully imported, 0 entries failed or cancelled
|  | 302 | [Storing https.keystore.jks]
|  | 303 |
|  | 304 | Warning:
|  | 305 | The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore https.keystore.jks -destkeystore https.keystore.jks -deststoretype pkcs12".
|  | 306 | $ ls -ltr
|  | 307 | total 52
|  | 308 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
|  | 309 | -rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
|  | 310 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
|  | 311 | -rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
|  | 312 | -rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
|  | 313 | -rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
|  | 314 | -rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
|  | 315 | -rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
|  | 316 | -rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
|  | 317 | -rwxrwxrwx 1 stduser stduser 41 Jul 7 05:17 ca.srl
|  | 318 | -rwxrwxrwx 1 stduser stduser 2106 Jul 7 05:17 https.crt
|  | 319 | -rwxrwxrwx 1 stduser stduser 4328 Jul 7 05:18 https.keystore.p12
|  | 320 | -rwxrwxrwx 1 stduser stduser 4026 Jul 7 05:18 https.keystore.jks
|  | 321 | ```
|  | 322 |
|  | 323 | # 13. 查看 https 证书内容
|  | 324 |
|  | 325 | ```sh
|  | 326 | openssl x509 -in ca.crt -noout -text
|  | 327 | openssl x509 -in https.crt -noout -text
|  | 328 | keytool -list -v -keystore https.keystore.p12
|  | 329 | keytool -list -v -keystore https.keystore.jks
|  | 330 | ```
|  | 331 |
|  | 332 | 执行结果如下：
|  | 333 |
|  | 334 | ```txt
|  | 335 | $ openssl x509 -in ca.crt -noout -text
|  | 336 | Certificate:
|  | 337 | Data:
|  | 338 | Version: 3 (0x2)
|  | 339 | Serial Number:
|  | 340 | 13:33:c1:cb:4a:05:23:9b:c4:9a:95:68:fc:88:9e:40:12:68:e4:af
|  | 341 | Signature Algorithm: sha256WithRSAEncryption
|  | 342 | Issuer: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
|  | 343 | Validity
|  | 344 | Not Before: Jul 6 21:14:41 2023 GMT
|  | 345 | Not After : Jun 12 21:14:41 2123 GMT
|  | 346 | Subject: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
|  | 347 | Subject Public Key Info:
|  | 348 | Public Key Algorithm: rsaEncryption
|  | 349 | RSA Public-Key: (4096 bit)
|  | 350 | Modulus:
|  | 351 | 00:aa:d9:c7:6d:ec:ba:79:67:c9:69:41:b4:12:30:
|  | 352 | eb:05:83:b2:cc:38:a9:76:c6:40:b3:61:28:40:00:
|  | 353 | e7:81:18:fb:81:ec:7e:bb:4c:03:95:b4:16:1b:47:
|  | 354 | eb:39:66:50:60:fa:d1:ab:25:b4:92:23:36:85:86:
|  | 355 | 6c:df:9b:ed:d1:fb:5a:4b:3f:79:b7:66:2e:4e:47:
|  | 356 | d0:c8:16:1a:2b:d7:db:2a:db:80:55:7a:88:5f:f9:
|  | 357 | 45:91:87:29:3b:2a:e6:9b:90:d0:c6:58:b9:35:14:
|  | 358 | 10:2f:5b:42:c6:7b:2e:54:6d:53:7d:97:b8:7e:fb:
|  | 359 | 48:08:49:2f:e3:67:31:b8:fb:92:0f:63:88:4b:b3:
|  | 360 | a4:3a:c5:0f:09:68:a9:bf:96:8c:64:b7:82:5e:88:
|  | 361 | 2d:4b:08:af:70:92:ec:e4:6b:0a:bb:36:29:6e:13:
|  | 362 | 55:0d:61:a7:bc:e1:0b:68:91:5e:52:71:b4:a6:b0:
|  | 363 | d2:9d:a6:21:8e:b1:49:70:40:ac:32:ec:97:14:35:
|  | 364 | a2:1b:43:e6:9c:cb:fa:0e:99:09:da:91:2a:96:9b:
|  | 365 | fc:ad:69:f9:46:70:1e:23:74:07:ec:17:b9:09:dc:
|  | 366 | 55:f3:c0:1b:0e:bf:7c:c9:6b:10:b9:79:89:23:98:
|  | 367 | 26:63:35:14:09:dd:35:6e:84:a8:db:50:7d:f7:ad:
|  | 368 | 13:f4:a2:8f:7a:79:d7:e1:62:86:3e:bd:fb:68:d1:
|  | 369 | c5:b2:bc:00:80:1b:7a:e9:c5:f8:75:d5:6a:e4:e2:
|  | 370 | 29:38:f1:7f:42:f6:4e:dd:44:df:04:ec:28:e6:40:
|  | 371 | 70:ee:85:6d:33:9a:8d:2f:fa:15:d2:21:88:89:86:
|  | 372 | 45:08:bb:fd:1e:37:6a:d5:07:b0:38:12:df:50:02:
|  | 373 | 50:53:ea:cc:76:e0:56:22:b8:e8:80:27:23:85:ea:
|  | 374 | 5d:57:e4:44:22:ed:86:5e:08:8a:6e:d2:55:ea:06:
|  | 375 | f2:b5:84:26:de:b9:55:26:1d:15:58:84:5f:41:00:
|  | 376 | 60:43:3b:56:e2:2c:e0:31:cf:54:f2:dd:44:0c:c8:
|  | 377 | 62:49:4a:f3:e1:8e:c7:56:8b:cd:da:9e:b8:d7:ef:
|  | 378 | 1e:63:50:47:c5:59:93:71:76:d0:bc:c3:93:fe:fb:
|  | 379 | 39:3d:0c:bb:03:6c:2f:4c:0b:7a:ef:32:c8:18:c2:
|  | 380 | c9:ad:10:a4:8b:5f:a4:23:ab:80:2f:66:fb:a1:41:
|  | 381 | 12:bc:15:2d:15:3d:1b:b7:9c:f9:22:cc:a6:11:06:
|  | 382 | 8b:43:f9:23:05:c7:c8:a6:79:12:c3:10:7f:9e:72:
|  | 383 | ef:aa:99:67:7e:fc:e7:06:0d:38:0c:2c:f2:37:45:
|  | 384 | 1a:5b:e1:cb:7a:87:27:46:c7:44:b1:01:c7:51:8f:
|  | 385 | 4f:08:67
|  | 386 | Exponent: 65537 (0x10001)
|  | 387 | X509v3 extensions:
|  | 388 | X509v3 Subject Key Identifier:
|  | 389 | 46:8E:37:91:A4:56:D5:63:C8:25:43:A0:E8:E1:16:66:3C:F0:22:E6
|  | 390 | X509v3 Authority Key Identifier:
|  | 391 | keyid:46:8E:37:91:A4:56:D5:63:C8:25:43:A0:E8:E1:16:66:3C:F0:22:E6
|  | 392 |
|  | 393 | X509v3 Basic Constraints: critical
|  | 394 | CA:TRUE
|  | 395 | Signature Algorithm: sha256WithRSAEncryption
|  | 396 | 97:e7:45:3f:b7:59:34:e7:c6:22:fc:ba:4c:82:60:0e:8c:73:
|  | 397 | b2:c9:31:bf:ea:ad:cc:70:79:eb:3b:31:bb:aa:73:f8:12:e8:
|  | 398 | d8:37:8a:d3:b2:77:42:03:47:3f:23:8c:82:74:69:f8:ad:45:
|  | 399 | 08:60:cf:c3:90:67:9f:55:1f:b5:7a:aa:73:12:d6:73:97:65:
|  | 400 | 72:45:74:63:e3:23:5f:47:c9:b8:48:e2:d2:58:c7:f8:af:0e:
|  | 401 | 79:eb:ab:82:7a:17:f7:3b:62:60:82:7a:f9:32:23:f8:3f:1d:
|  | 402 | 24:80:92:47:80:a7:2f:ef:d2:eb:0b:7f:16:da:d1:7d:0e:6a:
|  | 403 | be:28:7c:d2:85:48:83:f6:d8:87:35:3d:72:7c:36:ea:3e:31:
|  | 404 | 04:81:ae:3a:97:56:c9:95:d6:b6:8f:16:3e:fb:94:35:ee:dc:
|  | 405 | 7a:c6:85:ef:67:0b:31:bc:c3:e0:d8:2f:d2:93:93:0d:b1:61:
|  | 406 | c4:92:0a:c1:f4:13:df:8b:b4:70:e0:74:7c:c5:56:cc:82:1d:
|  | 407 | db:02:0c:2b:ca:61:af:3a:51:b1:be:a9:0c:b8:44:22:6d:69:
|  | 408 | 97:82:01:c9:0f:d8:90:8f:aa:1d:f4:cc:a8:72:0f:03:8d:d7:
|  | 409 | e3:32:22:1b:60:99:84:25:b3:10:7a:a8:99:5c:c7:c4:f5:4a:
|  | 410 | 94:47:37:21:bb:39:f2:ff:f1:f8:c2:59:92:44:58:e4:d5:2e:
|  | 411 | df:d4:13:2f:58:9e:87:d5:4f:92:a8:bd:de:11:c1:97:97:0b:
|  | 412 | 08:04:b2:9d:83:77:19:6f:ee:6a:c2:e3:59:92:d4:3a:c1:f0:
|  | 413 | 46:06:14:45:e8:eb:de:47:26:4a:e3:54:aa:12:ca:34:63:d2:
|  | 414 | ab:ab:3f:b4:c8:84:b9:47:d4:b1:e7:c5:83:37:0f:97:18:42:
|  | 415 | 29:a6:db:df:97:da:02:8e:01:f1:43:1a:c5:a5:41:b4:4e:a0:
|  | 416 | 15:ae:08:d7:07:e6:cb:6c:43:a6:9c:0f:9c:0f:f8:ff:07:e3:
|  | 417 | 15:5e:cf:92:04:f9:9c:cc:9d:c3:ff:62:f2:31:ae:fb:2a:10:
|  | 418 | 41:70:d7:74:1c:d0:5e:08:5e:12:e8:82:2a:8e:78:51:61:e6:
|  | 419 | e7:76:de:37:2a:89:fc:6f:a2:91:13:47:ee:bc:52:7f:2e:e5:
|  | 420 | b0:c1:99:4d:52:47:7d:19:74:de:b9:6b:8e:4e:7a:c1:80:e7:
|  | 421 | 90:0a:d5:fc:e7:2d:fd:d7:76:83:66:0a:d3:a2:08:c5:33:87:
|  | 422 | 8f:91:ef:cf:70:06:4c:c0:90:b5:9f:84:00:ee:02:c0:06:da:
|  | 423 | ff:16:59:d8:0d:cd:fb:8d:6f:41:74:29:02:81:4e:65:86:1e:
|  | 424 | 64:23:c5:07:84:ee:f1:dd
|  | 425 | $ openssl x509 -in https.crt -noout -text
|  | 426 | Certificate:
|  | 427 | Data:
|  | 428 | Version: 3 (0x2)
|  | 429 | Serial Number:
|  | 430 | 0c:7b:a6:5b:70:e6:ab:18:82:fb:20:5c:50:63:43:e7:dc:fd:b5:ee
|  | 431 | Signature Algorithm: sha256WithRSAEncryption
|  | 432 | Issuer: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
|  | 433 | Validity
|  | 434 | Not Before: Jul 6 21:17:44 2023 GMT
|  | 435 | Not After : Jun 17 21:17:44 2025 GMT
|  | 436 | Subject: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = *.example.com, emailAddress = iana@iana.org
|  | 437 | Subject Public Key Info:
|  | 438 | Public Key Algorithm: rsaEncryption
|  | 439 | RSA Public-Key: (4096 bit)
|  | 440 | Modulus:
|  | 441 | 00:d3:86:0e:43:53:f0:af:db:7b:a6:51:b9:13:0d:
|  | 442 | 49:ec:b9:a7:da:10:8b:81:38:76:c0:a4:b2:8e:1d:
|  | 443 | 3e:71:45:8b:97:45:d5:20:40:d6:39:47:2b:14:cc:
|  | 444 | f4:d0:c1:82:ea:27:b9:cb:b9:4e:3d:8e:52:74:74:
|  | 445 | e1:2b:72:87:1f:a7:7f:ad:37:84:ed:63:8f:31:9d:
|  | 446 | 19:6a:a9:f4:88:b2:64:d8:39:6e:31:b6:d1:12:fe:
|  | 447 | 84:95:15:ac:f1:66:11:50:42:9b:fc:c4:fe:10:7c:
|  | 448 | b9:c8:a2:80:23:7b:8a:81:8a:65:c2:cd:cf:e1:fe:
|  | 449 | e6:84:4f:92:0a:45:65:81:f4:c1:c4:37:29:aa:76:
|  | 450 | 30:9f:af:38:04:57:95:ca:38:e4:ba:3e:10:c3:e7:
|  | 451 | 26:63:f7:25:fb:f1:8d:17:4d:80:63:46:b0:bb:da:
|  | 452 | e4:ec:3a:70:4d:fe:da:62:27:24:36:bf:9d:19:d7:
|  | 453 | cf:85:61:ac:e2:2e:c5:14:36:22:89:06:a5:96:d2:
|  | 454 | 3b:7c:a4:d2:76:fb:bb:40:09:d5:43:95:1a:1f:58:
|  | 455 | 63:a1:3a:d7:13:de:80:71:ff:ae:a3:45:fe:76:74:
|  | 456 | 5a:67:95:c3:ce:20:a5:46:eb:cc:0f:ab:14:54:3e:
|  | 457 | 16:4f:b1:ea:a3:72:b3:80:9a:da:bf:47:f3:30:a7:
|  | 458 | 2d:66:40:6f:9a:cd:3a:0b:59:2d:c0:40:8f:1c:f3:
|  | 459 | b5:45:63:02:c5:6f:b0:d9:0f:ee:97:a0:ca:60:3b:
|  | 460 | de:75:0b:03:91:f3:79:77:57:30:07:d7:de:d6:52:
|  | 461 | 8e:d5:20:17:00:79:0c:16:37:24:2c:0a:17:5e:b4:
|  | 462 | a7:0a:67:7a:82:3e:07:76:0a:30:91:cf:cf:2e:be:
|  | 463 | 59:cf:a5:85:8e:2a:d2:46:ef:62:97:f2:08:b9:c8:
|  | 464 | 2a:ce:62:2f:39:67:24:65:6e:fa:9f:3c:4b:76:34:
|  | 465 | 53:15:87:c4:f0:51:ce:3f:de:47:e2:60:48:17:62:
|  | 466 | 0f:0e:77:bf:ec:77:c7:e2:26:ae:1e:bc:b1:79:44:
|  | 467 | 4c:50:81:98:43:9e:18:09:af:5c:41:a3:03:28:f8:
|  | 468 | 7c:41:82:72:d0:c8:08:2e:29:81:06:10:fd:7c:67:
|  | 469 | 8d:fa:c1:ce:f8:95:90:32:45:11:32:91:45:66:75:
|  | 470 | 4e:97:09:6e:fd:82:bc:a9:03:90:ab:12:44:4d:46:
|  | 471 | 37:61:89:0e:b7:56:4a:f2:91:01:e2:3a:1b:41:48:
|  | 472 | 07:29:95:e1:4f:d8:0b:57:69:bc:7f:1a:f9:5e:51:
|  | 473 | 28:83:1e:c3:86:96:69:b1:1b:b3:e9:27:09:fd:46:
|  | 474 | ef:5b:32:21:55:0b:c1:49:76:a9:65:02:bd:4a:26:
|  | 475 | 89:5f:f9
|  | 476 | Exponent: 65537 (0x10001)
|  | 477 | X509v3 extensions:
|  | 478 | X509v3 Subject Alternative Name:
|  | 479 | DNS:example.com, DNS:*.example.com
|  | 480 | Signature Algorithm: sha256WithRSAEncryption
|  | 481 | 7c:27:ba:df:25:e0:cf:96:ea:ae:e1:03:d7:f5:19:c2:96:11:
|  | 482 | 51:c9:ee:df:c9:65:2f:27:22:fd:0c:84:87:ba:a4:f3:32:ac:
|  | 483 | 29:87:2e:a8:8c:a9:ac:46:a5:2c:fb:60:54:51:b6:b8:8e:9a:
|  | 484 | b5:00:b5:7d:ef:86:30:2d:f6:f6:df:50:b4:16:f6:bf:ed:dc:
|  | 485 | 51:c4:20:80:1f:27:2e:83:72:0b:a6:df:0b:52:7a:62:6e:64:
|  | 486 | d1:a0:aa:80:93:ab:4f:ab:06:ed:9a:a4:3f:29:dc:a3:6f:d1:
|  | 487 | 81:0d:77:81:9d:8f:a3:0b:0f:d0:1b:41:23:e9:fe:64:15:6d:
|  | 488 | 20:70:5a:50:b8:16:cd:06:e9:ee:c3:9a:9d:ea:77:86:09:e3:
|  | 489 | 4a:29:2b:42:c6:a8:32:82:1d:80:5e:7f:3d:68:c1:a8:c7:e2:
|  | 490 | d5:ab:2d:c9:4c:0a:63:fd:28:31:b8:cb:88:02:37:b7:45:20:
|  | 491 | f3:ac:24:15:65:fb:17:6e:82:ce:8b:bc:d9:ef:40:eb:70:fa:
|  | 492 | 5a:b4:35:e1:8a:6c:7e:33:0b:c1:23:2c:da:be:68:72:b1:a1:
|  | 493 | 44:43:6c:86:56:d0:9f:a6:cc:7f:d0:0e:b5:69:87:9e:d4:b4:
|  | 494 | 6a:ac:8a:0a:01:a3:93:17:e4:da:88:7d:0f:e4:b3:5f:2a:fa:
|  | 495 | b6:f4:42:94:85:11:49:63:89:90:e8:eb:6a:e1:fa:fd:0d:02:
|  | 496 | 32:76:03:56:28:b3:b6:12:a5:e3:16:65:bb:56:fe:62:ea:c9:
|  | 497 | 3c:57:df:a3:c7:a6:bf:34:fb:d1:dd:a2:01:97:8b:ab:bd:eb:
|  | 498 | fe:e6:50:cd:6e:14:f6:c8:1c:a0:d4:ba:ae:77:a6:2d:14:af:
|  | 499 | 53:94:4f:45:9a:23:9c:5e:45:3c:1c:b1:1a:18:9d:45:b5:dc:
|  | 500 | 31:e2:f8:4b:94:e7:05:cf:9d:d4:50:52:74:bc:96:6c:43:03:
|  | 501 | be:d1:77:87:cd:d4:76:fe:0b:bd:a1:33:ed:39:0d:6b:96:2e:
|  | 502 | a2:5a:58:36:b4:bf:5a:8b:3f:27:cf:0d:74:69:1a:eb:3b:c9:
|  | 503 | 63:ea:0a:7a:00:e1:4d:f7:e6:33:9e:f9:88:e1:3b:66:35:54:
|  | 504 | c3:39:12:c8:ba:65:97:cc:83:a8:03:c8:1c:24:a3:29:5e:9d:
|  | 505 | dd:dc:8d:bf:b1:f8:a2:1a:02:2c:51:b1:64:cb:c9:57:9e:de:
|  | 506 | ae:34:bc:2e:ae:86:14:5d:0d:75:f5:04:38:d4:dd:b8:75:7b:
|  | 507 | 8f:2f:1d:46:11:2a:62:77:d3:d8:d0:0b:d4:2b:6c:10:10:97:
|  | 508 | 93:a0:da:53:5c:9a:b0:77:b8:a9:ca:7e:ce:6d:a2:72:5e:ee:
|  | 509 | 39:fc:e2:f7:dd:a1:dc:12
|  | 510 | $ keytool -list -v -keystore https.keystore.p12
|  | 511 | Enter keystore password:
|  | 512 | Keystore type: PKCS12
|  | 513 | Keystore provider: SUN
|  | 514 |
|  | 515 | Your keystore contains 1 entry
|  | 516 |
|  | 517 | Alias name: https
|  | 518 | Creation date: Jul 7, 2023
|  | 519 | Entry type: PrivateKeyEntry
|  | 520 | Certificate chain length: 1
|  | 521 | Certificate[1]:
|  | 522 | Owner: EMAILADDRESS=iana@iana.org, CN=*.example.com, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
|  | 523 | Issuer: EMAILADDRESS=iana@iana.org, CN=Example.com's Root CA, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
|  | 524 | Serial number: c7ba65b70e6ab1882fb205c506343e7dcfdb5ee
|  | 525 | Valid from: Fri Jul 07 05:17:44 CST 2023 until: Wed Jun 18 05:17:44 CST 2025
|  | 526 | Certificate fingerprints:
|  | 527 | SHA1: FA:10:E7:11:4F:47:5E:1A:93:E1:DC:EE:AE:53:DF:4D:91:C4:3B:34
|  | 528 | SHA256: 19:41:78:84:25:D3:25:EE:D1:0F:BA:11:34:6A:70:EA:70:A9:CC:1B:CD:A0:96:0C:F0:71:8D:BA:13:3E:59:C6
|  | 529 | Signature algorithm name: SHA256withRSA
|  | 530 | Subject Public Key Algorithm: 4096-bit RSA key
|  | 531 | Version: 3
|  | 532 |
|  | 533 | Extensions:
|  | 534 |
|  | 535 | #1: ObjectId: 2.5.29.17 Criticality=false
|  | 536 | SubjectAlternativeName [
|  | 537 | DNSName: example.com
|  | 538 | DNSName: *.example.com
|  | 539 | ]
|  | 540 |
|  | 541 |
|  | 542 |
|  | 543 | *******************************************
|  | 544 | *******************************************
|  | 545 |
|  | 546 | $ keytool -list -v -keystore https.keystore.jks
|  | 547 | Enter keystore password:
|  | 548 | Keystore type: JKS
|  | 549 | Keystore provider: SUN
|  | 550 |
|  | 551 | Your keystore contains 1 entry
|  | 552 |
|  | 553 | Alias name: https
|  | 554 | Creation date: Jul 7, 2023
|  | 555 | Entry type: PrivateKeyEntry
|  | 556 | Certificate chain length: 1
|  | 557 | Certificate[1]:
|  | 558 | Owner: EMAILADDRESS=iana@iana.org, CN=*.example.com, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
|  | 559 | Issuer: EMAILADDRESS=iana@iana.org, CN=Example.com's Root CA, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
|  | 560 | Serial number: c7ba65b70e6ab1882fb205c506343e7dcfdb5ee
|  | 561 | Valid from: Fri Jul 07 05:17:44 CST 2023 until: Wed Jun 18 05:17:44 CST 2025
|  | 562 | Certificate fingerprints:
|  | 563 | SHA1: FA:10:E7:11:4F:47:5E:1A:93:E1:DC:EE:AE:53:DF:4D:91:C4:3B:34
|  | 564 | SHA256: 19:41:78:84:25:D3:25:EE:D1:0F:BA:11:34:6A:70:EA:70:A9:CC:1B:CD:A0:96:0C:F0:71:8D:BA:13:3E:59:C6
|  | 565 | Signature algorithm name: SHA256withRSA
|  | 566 | Subject Public Key Algorithm: 4096-bit RSA key
|  | 567 | Version: 3
|  | 568 |
|  | 569 | Extensions:
|  | 570 |
|  | 571 | #1: ObjectId: 2.5.29.17 Criticality=false
|  | 572 | SubjectAlternativeName [
|  | 573 | DNSName: example.com
|  | 574 | DNSName: *.example.com
|  | 575 | ]
|  | 576 |
|  | 577 |
|  | 578 |
|  | 579 | *******************************************
|  | 580 | *******************************************
|  | 581 |
|  | 582 |
|  | 583 |
|  | 584 | Warning:
|  | 585 | The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore https.keystore.jks -destkeystore https.keystore.jks -deststoretype pkcs12".
|  | 586 | ```

# 同级页面

# 博客类别

- https://keqiongpan.cn:80/bin/view/Blog/">全部

- News (0)
- Other (0)
- Personal (0)

# 当前已创建的

- 线性布局组件与占位组件
- React
- CSS Flexbox Cheat Sheet
- CSS界面布局控制属性概述
- CSS

粤公网安备 44011802000481号 粤ICP备2020117634号
版权所有，如发现盗用模仿必追诉法律责任！
CopyRight © 2020-2023 keqiongpan.cn. All Right Reserved.