我正在使用OpenSSL命令行工具生成自签名证书。除了两个问题外，它似乎正常工作。我无法用主题替代名称（关键）创建一个.cer并且我无法弄清楚如何创建一个版本3的证书（不确定这是否至关重要，但更愿意学习如何设置版本）。
有没有人成功完成这项工作？默认配置（.cfg）文件看似清晰（见下文）：
“这个东西是subjectAltName和issuerAltname。 导入电子邮件地址。 subjectAltName = email：copy“
然而，这不起作用。我的预感是主题备用名称没有显示b / c它没有出现在V1规格中，这就是为什么我也在追求设置他的版本。
这是我正在使用的配置文件：
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
emailAddress = myEmail@email.com
req_extensions = v3_req
x509_extensions = v3_ca
[req_distinguished_name]
C = [Press Enter to Continue]
C_default = US
C_min = 2
C_max = 2
O = [Press Enter to Continue]
O_default = default
0.OU=[Press Enter to Continue]
0.OU_default = default
1.OU=[Press Enter to Continue]
1.OU_default = PKI
2.OU=[Press Enter to Continue]
2.OU_default = ABCD
commonName = Public FQDN of server
commonName_max = 64
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
subjectAltName = email:myEmail@email.com
issuerAltName = issuer:copy
答案 0 :(得分：16)
以下是您的简单步骤
在生成CSR时，您应该使用-config和-extensions 在生成证书时，您应该使用-extfile和-extensions
以下是示例
openssl req -new -nodes -keyout test.key -out test.csr -days 3650 -subj "/C=US/ST=SCA/L=SCA/O=Oracle/OU=Java/CN=test cert" -config /etc/pki/tls/openssl.cnf -extensions v3_req
openssl x509 -req -days 3650 -in test.csr -CA cacert.pem -CAkey rootCA.key -CAcreateserial -out test.pem -extfile /etc/pki/tls/openssl.cnf -extensions v3_req
希望这会有所帮助
答案 1 :(得分：8)
我使用以下版本（电子邮件地址放置错误）：
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
req_extensions = v3_req
x509_extensions = v3_ca
[req_distinguished_name]
C = [Press Enter to Continue]
C_default = US
C_min = 2
C_max = 2
O = [Press Enter to Continue]
O_default = default
0.OU=[Press Enter to Continue]
0.OU_default = default
1.OU=[Press Enter to Continue]
1.OU_default = PKI
2.OU=[Press Enter to Continue]
2.OU_default = ABCD
commonName = Public FQDN of server
commonName_max = 64
emailAddress = [Press Enter to Continue]
emailAddress_default = myEmail@email.com
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
subjectAltName = email:myEmail@email.com
issuerAltName = issuer:copy
注意：
要生成我使用的证书：
openssl req -config req.cnf -new -nodes -out req.pem -x509
issuerAltname的用处（如果你有兴趣知道在哪里）。issuer:always使用authorityKeyIdentifier。email:copy现在可以使用subjectAltName。v3_req部分是多余的（以及req_extensions行。答案 2 :(得分：3)
您使用什么命令来发出CSR证书请求？您使用什么命令来制作证书文件？针对不同情况的不同答案。
也许你没有放
的SubjectAltName =电子邮件：复制
中的
部分
[v3_req]
也许您正在使用openssl x509生成证书，如果是这样，您必须使用
-extfile /etc/pki/tls/openssl.cnf
因为没有它，它不会使用您的配置文件
您可能还需要
-extensions v3_req
命令行开关
答案 3 :(得分：3)
好的，此页面上的其他答案都没有对我有用，我尝试了每一个答案。对我有用的是一个小把戏：
在请求证书时：
-config '<(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER"))'
-reqexts SAN
以及在签署证书时：
-extfile '<(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER"))'
-extensions SAN
因此，不要混淆，这是一个工作脚本，从一开始就涵盖了所有内容，包括创建证书颁发机构：
# if the server name is undefined, lets default to 'Some-Server'
SERVER="${SERVER:-Some-Server}"
CORPORATION=My-Corp
GROUP=My-Corporate-Group
CITY=City
STATE=State
COUNTRY=US
CERT_AUTH_PASS=`openssl rand -base64 32`
echo $CERT_AUTH_PASS > cert_auth_password
CERT_AUTH_PASS=`cat cert_auth_password`
# create the certificate authority
openssl \
req \
-subj "/CN=$SERVER.ca/OU=$GROUP/O=$CORPORATION/L=$CITY/ST=$STATE/C=$COUNTRY" \
-new \
-x509 \
-passout pass:$CERT_AUTH_PASS \
-keyout ca-cert.key \
-out ca-cert.crt \
-days 36500
# create client private key (used to decrypt the cert we get from the CA)
openssl genrsa -out $SERVER.key
# create the CSR(Certitificate Signing Request)
openssl \
req \
-new \
-nodes \
-subj "/CN=$SERVER/OU=$GROUP/O=$CORPORATION/L=$CITY/ST=$STATE/C=$COUNTRY" \
-sha256 \
-extensions v3_req \
-reqexts SAN \
-key $SERVER.key \
-out $SERVER.csr \
-config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER")) \
-days 36500
# sign the certificate with the certificate authority
openssl \
x509 \
-req \
-days 36500 \
-in $SERVER.csr \
-CA ca-cert.crt \
-CAkey ca-cert.key \
-CAcreateserial \
-out $SERVER.crt \
-extfile <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$SERVER")) \
-extensions SAN \
-passin pass:$CERT_AUTH_PASS
然后我们可以验证主题替代名称是否在最终证书中：
openssl x509 -in Some-Server.crt -text -noout
相关部分是：
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:Some-Server
因此有效！只要您在浏览器中安装证书颁发机构，此证书就会被所有主流浏览器（包括chrome）接受。也就是说，您需要安装ca-cert.crt。
这是ngnx的示例配置，可让您使用证书：
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name localhost:443;
ssl_certificate /etc/ssl/certs/Some-Server.crt;
ssl_certificate_key /etc/ssl/private/Some-Server.key;
ssl_dhparam /etc/ssl/certs/https-dhparam.pem;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
答案 4 :(得分：0)
我刚刚开发了一个基于Web的工具，它将根据表单输入自动生成此命令并显示输出。 http://kernelmanic.com/certificate-request-generator-with-multiple-common-names-and-subject-alternative-names/
答案 5 :(得分：0)
配置文件中的条目v3_req需要subjectAltName。命令
openssl x509 ... -extfile openssl.cnf -extensions v3_req
将SAN插入证书。
答案 6 :(得分：0)
我知道这个帖子有点旧，但万一它适用于Windows上的任何人，检查文件是UTF-8编码，在我的情况下，我收到一个错误，表明.cnf文件有错误，所以我在Notepad ++上打开它，将文件编码设置为UTF-8，保存，然后再次运行openssl命令，它就成了伎俩。
答案 7 :(得分：0)
我提到了几页，最重要的帮助来自1. https://geekflare.com/san-ssl-certificate/，2。https://certificatetools.com/（请参阅user40662的答案）和3. Raghu K Nair关于命令用法的答案。
然后我成功尝试：
san.cnf
[ req ]
default_bits = 2048
default_md = sha256
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
countryName = CN # C=
stateOrProvinceName = Shanghai # ST=
localityName = Shanghai # L=
#postalCode = 200000 # L/postalcode=
#streetAddress = "My Address" # L/street=
organizationName = My Corporation # O=
organizationalUnitName = My Department # OU=
commonName = myname.mysoftware.mycorporation.com # CN=
emailAddress = myname@example.com # CN/emailAddress=
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = myname.mysoftware.mycorporation.com
#DNS.2 = other2.com
#DNS.3 = other3.com
命令：
openssl req -x509 -nodes -days 365 -subj "/C=CN/ST=Shanghai/L=Shanghai/O=My Corporation/OU=My Department/CN=myname.mysoftware.mycorporation.com/emailAddress=myname@example.com" -keyout privateKey.pem -out certificate.crt -config san.cnf -extensions v3_req
答案 8 :(得分：0)
#! /bin/dash
# Steps 1-3 show how to use openssl to create a certificate request
# that includes Subject Alternative Names.
# In the uncommon case where you are creating your own CA, steps 4-6
# show how to use openssl to create a CA and then use that CA to
# create a certificate from the request.
# Step 1: Create an OpenSSL configuration file
# to specify the Subject Alternative Names
echo ; echo 'step 1'
cat > foo.cnf <<EOF
[ req ]
distinguished_name = arbitrary_name_1
req_extensions = arbitrary_name_2
[ arbitrary_name_1 ]
[ arbitrary_name_2 ]
subjectAltName = @arbitrary_name_3
[ arbitrary_name_3 ]
DNS.1 = foo.com
DNS.2 = bar.com
DNS.3 = baz.com
EOF
# Step 2: Create a certificate request for foo.com.
#
# openssl
# req
# -config read openssl configuration from this file
# -subj set the commonName of the certificate
# -newkey generate a new key (and, by implication, a new request!)
# -nodes do not encrypt the new private key ("no DES")
# -keyout write the new private key to this file
# -out write the request to this file
echo ; echo 'step 2'
openssl \
req \
-config foo.cnf \
-subj '/CN=foo.com' \
-newkey rsa:2048 \
-nodes \
-keyout foo.key \
-out foo.req
# Step 3: Display the requested extensions.
echo ; echo 'step 3'
openssl req -in foo.req -noout -text | \
grep -A 2 'Requested Extensions:'
# Step 4: Create a certificate authority by creating
# a private key and self-signed certificate.
#
# openssl
# req generate a certificate request, but don't because ...
# -x509 generate a self-signed certificate instead
# -subj set the commonName of the certificate
# -days certificate is valid for N days, starting now
# -newkey generate a new private key
# -nodes do not encrypt the new private key ("no DES")
# -keyout write the new private key to this file
# -out write the self-signed certificate to this file
echo ; echo 'step 4'
openssl \
req \
-x509 \
-subj "/CN=Custom CA" \
-days 4000 \
-newkey rsa:2048 \
-nodes \
-keyout ca.key \
-out ca.cert
# Step 5: Use the certificate authority
# to create a certificate for foo.com.
#
# openssl
# x509 operate on an x509 certificate
# -req create an x509 certificate from a request
# -in read the request from this file
# -CA read the CA certificate from this file
# -CAkey read the CA key form this file
# -extfile read openssl's configuration from this file
# -extensions read extensions from this section of the configuration
# -days certificate is valid for N days, starting now
# -set_serial set the new certificate's serial number
# -out write the new certificate to this file
echo ; echo 'step 5'
openssl \
x509 \
-req \
-in foo.req \
-CA ca.cert \
-CAkey ca.key \
-extfile foo.cnf \
-extensions arbitrary_name_2 \
-days 30 \
-set_serial 1001 \
-out foo.cert
# Step 6: Display the X509v3 extensions:
echo ; echo 'step 6'
openssl x509 -in foo.cert -noout -text | \
grep -A 2 'X509v3 extensions:'