openssl 安装

六、运行“nmake -f ms\ntdll.mak install”安装编译后的OpenSSL到指定目录。

七、查看安装结果C:\usr\local\ssl或C:\openssl-0.9.8.e下包含了三个文件夹Bin、include、lib。bin下包括openssl.exe（openssl指令程序）、ssleay32.dll（ssl协议动态库）、libeay32.dll（密码算法库）。lib下包括libeay32.lib，ssleay32.lib。Include目录包括了OpenSSL开发设计的头文件。

　　至此，OpenSSL在windows下编译完成了。

最后一步编译时可能出现错误：“NMAKE : fatal error U1077: 'ml' : return code '0x1' Stop.”，产生这种错误的可能原因是vc6的bin目录下没有ml.exe这个文件。该文件包含在MASM程序中。我的解决办法是到网上下载了一个MASM程序(http://www.masm32.com/masmdl.htm)，安装上之后把ml.exe拷贝到VC6的bin目录下即可解决。

二．生成证书和秘钥

打开openssl.exe文件输入命令

1. 生成RSA密钥的方法

key一般分为public key和private key,在openssl中,private key中包含了public key的信息,所以public key不需要单独创建. 如何创建一个RSA key?

openssl.exe genrsa -des3 -out privkey.pem 2048  (需要添加密码保护)

这个命令会生成一个2048位的密钥，同时有一个des3方法加密的密码，如果你不想要每次都输入密码，可以改成：

openssl.exe genrsa -out privkey.pem 2048

建议用2048位密钥，少于此可能会不安全或很快将不安全。

2. 生成一个证书请求

openssl req -new -key privkey.pem -outcert.csr

这个命令将会生成一个证书请求，当然，用到了前面生成的密钥privkey.pem文件

这里将生成一个新的文件cert.csr，即一个证书请求文件。

3. 生成证书

拿到上面的证书请求文件，去数字证书颁发机构（即CA）申请一个数字证书。CA会给你一个新的文件cacert.pem，那才是你的数字证书。

如果是自己做测试，那么证书的申请机构和颁发机构都是自己。就可以用下面这个命令来生成证书：

openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095

这个命令将用上面生成的密钥privkey.pem生成一个数字证书cacert.pem

参考文档：http://blog.chinaunix.net/uid-20479991-id-216269.html

          http://blog.csdn.net/zh516846937/article/details/40188065

          http://blog.sina.com.cn/s/blog_4913c1f3010008r7.html

http://my.oschina.net/sad7girl/blog/73711

openssl 生成自签证书

博客分类：

• linux

 

在要生成证书的目录下建立几个文件和文件夹，有./demoCA/ ./demoCA/newcerts/  ./demoCA/index.txt ./demoCA/serial，在serial文件中写入第一个序列号“01”

1.生成X509格式的CA自签名证书 
$openssl req -new -x509 -keyout ca.key -out ca.crt

2.生成服务端的私钥(key文件)及csr文件 
$openssl genrsa -des3 -out server.key 1024 
$openssl req -new -key server.key -out server.csr

3.生成客户端的私钥(key文件)及csr文件 
$openssl genrsa -des3 -out client.key 1024 
$openssl req -new -key client.key -out client.csr

4.用生成的CA的证书为刚才生成的server.csr,client.csr文件签名 
$openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key 
$openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key

5.生成p12格式证书 
$openssl pkcs12 -export -inkey client.key -in client.crt -out client.pfx 
$openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx

6.生成pem格式证书 
有时需要用到pem格式的证书，可以用以下方式合并证书文件（crt）和私钥文件（key）来生成 
$cat client.crt client.key> client.pem 
$cat server.crt server.key > server.pem

7.PFX文件转换为X509证书文件和RSA密钥文件 
$openssl pkcs12 -in server.pfx -nodes -out server.pem 
$openssl rsa -in server.pem -out server2.key 
$openssl x509 -in server.pem -out server2.crt

这样生成服务端证书：ca.crt, server.key, server.crt, server.pem, server.pfx，客户端证书：ca.crt, client.key, client.crt, client.pem, client.pfx

 

 

 

 

 

 

 

 

 

 

 

 

------------------------------------------------------------------------------------------------------------------------------------------

C:\CA256>openssl genrsa -aes256 -out rootca.key 8192
Loading 'screen' into random state - done
Generating RSA private key, 8192 bit long modulus
......................++
...........................................++
e is 65537 (0x10001)
Enter pass phrase for rootca.key:
Verifying - Enter pass phrase for rootca.key:

C:\CA256>openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt
Enter pass phrase for rootca.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:sichuan
Locality Name (eg, city) []:chengdu
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Root Bitnum CA
Organizational Unit Name (eg, section) []:bitnum
Common Name (e.g. server FQDN or YOUR name) []:Root Bitnum CA
Email Address []:Root Bitnum CA

C:\CA256>cd C:\C256

C:\C256>openssl genrsa -out server-key.pem 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
...++++++
.++++++
e is 65537 (0x10001)

C:\C256>openssl req -new -sha256 -out server-req.csr -key server-key.pem
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:sichuan
Locality Name (eg, city) []:chengdu
Organization Name (eg, company) [Internet Widgits Pty Ltd]:bitnun server
Organizational Unit Name (eg, section) []:bitnun
Common Name (e.g. server FQDN or YOUR name) []:192.168.1.116
Email Address []:192.168.1.116

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:bitnum

C:\C256>openssl x509 -req -sha256 -in server-req.csr -out server-cert.pem -signkey server-key.pem -CA rootca.crt -CAkey rootca.key -CAcreateserial -days 3650
Loading 'screen' into random state - done
Signature ok
subject=/C=CN/ST=sichuan/L=chengdu/O=bitnun server/OU=bitnun/CN=192.168.1.116/emailAddress=192.168.1.116
Getting Private key
Getting CA Private Key
Enter pass phrase for rootca.key:

C:\C256>openssl pkcs12 -export -clcerts -in server-cert.pem -inkey server-key.pem -out server.p12
Loading 'screen' into random state - done
Enter Export Password:
Verifying - Enter Export Password:

C:\C256>