SAN证书生成

首先下载openssl，若没有下载，在历史文章我有写到如何安装。

生成CA根证书

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.pem

Common Name填写localhost

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:

修改openssl.cnf文件

该文件位于安装的bin目录下，修改内容如下：

• 取消copy_extensions = copy注释
• 取消req_extensions = v3_req注释
• 在v3_req下添加subjectAltName = @alt_names

• 添加新标签 [ alt_names ]和标签段

  [ alt_names ]
  DNS.1 = localhost  

生成服务端证书

# -config指定openssl.cnf路径
openssl genpkey -algorithm RSA -out server.key
openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=cn/OU=custer/O=custer/CN=localhost" -config E:\OpenSSL-Win64\OpenSSL-Win64\bin\openssl.cfg -extensions v3_req
openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile  E:\OpenSSL-Win64\OpenSSL-Win64\bin\openssl.cfg -extensions v3_req

生成客户端证书

openssl genpkey -algorithm RSA -out client.key
openssl req -new -nodes -key client.key -out client.csr -days 3650 -subj "/C=cn/OU=custer/O=custer/CN=localhost" -config E:\OpenSSL-Win64\OpenSSL-Win64\bin\openssl.cfg -extensions v3_req
openssl x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile E:\OpenSSL-Win64\OpenSSL-Win64\bin\openssl.cfg -extensions v3_req

生成后文件

ca.key
ca.pem
client.csr
client.key
client.pem
server.csr
server.key
server.pem