OpenSSL使用方法

生成CA (勾选Generate Self Signed Certificate)
openssl req -nodes -x509 -sha256 -newkey rsa:4096 -keyout "CA.ABC.LOCAL.key" -out "CA.ABC.LOCAL.crt" -days 365 -subj "/C=CN/ST=ZJ/L=HZ/O=ABC/OU=IT/CN=CA.ABC.LOCAL"

生成CSR证书请求 (不勾选Generate Self Signed Certificate)
openssl req -nodes -sha256 -newkey rsa:4096 -keyout "DC1.ABC.LOCAL.key" -out "DC1.ABC.LOCAL.csr" -subj "/C=CN/ST=ZJ/L=HZ/O=ABC/OU=IT/CN=DC1.ABC.LOCAL"

生成CRT
openssl ca -in DC1.ABC.LOCAL.csr -out DC1.ABC.LOCAL.crt -cert CA.ABC.LOCAL.crt -keyfile CA.ABC.LOCAL.key

CRT + KEY, 生成PFX
openssl pkcs12 -export -inkey DC1.ABC.LOCAL.key -in DC1.ABC.LOCAL.crt -out DC1.ABC.LOCAL.pfx

参考资料：

http://rhythm-zju.blog.163.com/blog/static/310042008015115718637/

http://dingtongxue1990.blog.51cto.com/4959501/1668838

https://raymii.org/s/software/OpenSSL_Command_Generator.html

https://www.myssl.cn/

https://www.chinassl.net/