数字证书是一种用于在网络上验证实体身份的工具，它在网络安全中扮演着至关重要的角色,主要作用：
我们可以使用openssl来生成一系列的自签名证书用于测试场景，自签名证书不应在生产环境中使用，因为它们不由受信任的CA签发，浏览器和操作系统不会信任它们。制作证书需要在云主机安装openssl，把https双向认证完整流程走通，需要如下六个个证书：
服务器端公钥证书（server.crt）：服务器用来证明自己的身份，通常由受信任的CA签发
服务器端私钥文件（server.key）：与服务器证书配对，用于解密客户端发来的加密信息
根证书（ca.crt）：CA用来签名服务器和客户端证书的证书，客户端用它来验证服务器证书的合法性
客户端公钥证书（client.crt）：客户端用来证明自己的身份，可以由同一个CA签发，也可以是不同CA签发的
客户端私钥文件（client.key）：与客户端证书配对，用于解密服务器发来的加密信息
客户端集成证书（client.p12）：包括公钥和私钥，通常用于浏览器访问场景，是PKCS#12格式的文件，包含客户端的证书和私钥，并且有密码保护
如下为制作过程：
1.1 登录云主机ECS-Client，创建生成证书目录
执行如下命令：
cert_path="/root/testdata/cert/v3" cert_path_out=$cert_path/out mkdir -p $cert_path mkdir -p $cert_path_out
1.2 设置CA证书信息及SAN扩展配置
执行如下命令，设置CA变量：
CA_COMMON_NAME="My Root CA"
CA_COUNTRY="CN"
CA_STATE="Some-State"
CA_LOCALITY="Some-City"
CA_ORGANIZATION="My Organization"
CA_ORGANIZATIONAL_UNIT="My Organizational Unit"
CA_EMAIL_ADDRESS="admin@example.com"
执行如下命令，设置CA SAN扩展配置文件：
cat > $cert_path/san_ca.ext <<EOF [ v3_ca ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical,CA:true keyUsage = critical, digitalSignature, cRLSign, keyCertSign EOF
1.3 设置server证书信息及SAN扩展配置
执行如下命令，设置server配置变量，记录COMMON NAME(ELB的域名)，后续验证时需使用该域名进行验证
SERVER_COMMON_NAME="server.ctelb.com"
SERVER_COUNTRY="CN"
SERVER_STATE="Some-State"
SERVER_LOCALITY="Some-City"
SERVER_ORGANIZATION="My Organization"
SERVER_ORGANIZATIONAL_UNIT="My Organizational Unit" SERVER_EMAIL_ADDRESS="admin@example.com"
执行如下命令，设置serverSAN扩展配置文件：
cat > $cert_path/san_server.ext <<EOF [v3_req] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = server.ctelb.com DNS.2 = ctelb.com IP.1 = 127.0.0.1 EOF
1.4 设置client证书信息及SAN扩展配置
执行如下命令，设置client配置变量：
CLIENT_COMMON_NAME="client.ctelb.com"
CLIENT_COUNTRY="CN"
CLIENT_STATE="Some-State"
CLIENT_LOCALITY="Some-City"
CLIENT_ORGANIZATION="My Organization"
CLIENT_ORGANIZATIONAL_UNIT="My Organizational Unit"
CLIENT_EMAIL_ADDRESS="user@example.com"
执行如下命令，设置client SAN扩展配置文件：
cat > $cert_path/san_client.ext <<EOF [v3_req] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment extendedKeyUsage = clientAuth subjectAltName = @alt_names [alt_names] DNS.1 = client.ctelb.com IP.1 = 127.0.0.1 EOF
1.5 创建CA证书
# 1. 生成根 CA 私钥
openssl genrsa -out $cert_path/ca.key 2048
# 1. 生成根 CA 证书签名请求 (CSR)
openssl req -new -key $cert_path/ca.key -out $cert_path/ca.csr -subj "/C=${CA_COUNTRY}/ST=${CA_STATE}/L=${CA_LOCALITY}/O=${CA_ORGANIZATION}/OU=${CA_ORGANIZATIONAL_UNIT}/CN=${CA_COMMON_NAME}/emailAddress=${CA_EMAIL_ADDRESS}"
# 3. 自签名根 CA 证书
openssl x509 -req -days 3650 -in $cert_path/ca.csr -signkey $cert_path/ca.key -out $cert_path/ca.crt -extfile $cert_path/san_ca.ext -extensions v3_ca
1.6 创建服务器证书
# 生成服务器私钥
openssl genrsa -out $cert_path/server.key 2048
# 生成服务器证书签名请求
openssl req -new -key $cert_path/server.key -out $cert_path/server.csr -subj "/C=${SERVER_COUNTRY}/ST=${SERVER_STATE}/L=${SERVER_LOCALITY}/O=${SERVER_ORGANIZATION}/OU=${SERVER_ORGANIZATIONAL_UNIT}/CN=${SERVER_COMMON_NAME}/emailAddress=${SERVER_EMAIL_ADDRESS}"
# 自签名服务器证书
openssl x509 -req -days 3650 -in $cert_path/server.csr -CA $cert_path/ca.crt -CAkey $cert_path/ca.key -CAcreateserial -out $cert_path/server.crt -extfile $cert_path/san_server.ext -extensions v3_req
1.7 创建客户端证书
# 生成客户端私钥
openssl genrsa -out $cert_path/client.key 2048
# 生成客户端证书签名请求
openssl req -new -key $cert_path/client.key -out $cert_path/client.csr -subj "/C=${CLIENT_COUNTRY}/ST=${CLIENT_STATE}/L=${CLIENT_LOCALITY}/O=${CLIENT_ORGANIZATION}/OU=${CLIENT_ORGANIZATIONAL_UNIT}/CN=${CLIENT_COMMON_NAME}/emailAddress=${CLIENT_EMAIL_ADDRESS}"
# 创建客户端证书
openssl x509 -req -days 3650 -in $cert_path/client.csr -CA $cert_path/ca.crt -CAkey $cert_path/ca.key -CAcreateserial -out $cert_path/client.crt -extfile $cert_path/san_client.ext -extensions v3_req
# 使用根 CA 证书签署客户端证书，导入浏览器使用，记录设置的证书密码，导入浏览器时需要输入该密码
openssl pkcs12 -export -clcerts -in $cert_path/client.crt -inkey $cert_path/client.key -out $cert_path/client.p12 -passin pass:123456 -passout pass:123456
1.8 验证证书
# 验证服务器证书链
openssl verify -CAfile $cert_path/ca.crt $cert_path/server.crt
# 验证客户端证书链
openssl verify -CAfile $cert_path/ca.crt $cert_path/client.crt
