前提条件

已安装OpenSSL。

操作步骤

执行以下步骤创建自签名证书：

 说明：

car_cert.crt、client.pem、server.pem、client.crt和server.crt文件的名称应与下列步骤中保持一致。

1. 打开DMServer文件夹。

   cd <DMServer HOME>

   为新生成的证书创建证书文件夹，例如，DMGenCerts文件夹。
   

2. mkdir DMGenCerts

   打开DMGenCerts文件夹。

3. cd DMGenCerts

   执行以下命令生成CA密钥：
   

4. openssl genrsa -des3 -out ca.key 4096

   执行以下命令，使用ca.key创建ca_cert.crt文件：

5. openssl req -new -x509 -days 365 -key ca.key -out ca_cert.crt

   按提示输入以下字段：

6. Country Name (2 letter code) [XX]:
   State or Province Name (full name) []:
   Locality Name (eg, city) [Default City]:
   Organization Name (eg, company) [Default Company Ltd]:
   Organizational Unit Name (eg, section) []:
   Common Name (eg, your name or your server's hostname) []:
   Email Address []:

   例如：

   Verifying - Enter pass phrase for ca.key:
   [dminstalluser@blrlabvm_171_29 DMGenCerts]$ openssl req -new -x509 -days 365 -key ca.key -out ca_cert.crt
   Enter pass phrase for ca.key:
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]: IN
   State or Province Name (full name) []: Karnataka
   Locality Name (eg, city) [Default City]: Bengaluru
   Organization Name (eg, company) [Default Company Ltd]: Huawei
   Organizational Unit Name (eg, section) []: GaussTools
   Common Name (eg, your name or your server's hostname) []:gausstools
   Email Address []:gausstools@huawei.com
   [dminstalluser@blrlabvm_171_29 DMGenCerts]$

7. 执行以下命令生成服务器密钥：

   openssl genrsa -des3 -out server.key 4096

   执行以下命令生成服务器签名请求：

8. openssl req -new -key server.key -out server.csr

   按提示输入以下字段：

9. Country Name (2 letter code) [XX]:
   State or Province Name (full name) []:
   Locality Name (eg, city) [Default City]:
   Organization Name (eg, company) [Default Company Ltd]:
   Organizational Unit Name (eg, section) []:
   Common Name (eg, your name or your server's hostname) []:
   Email Address []:
   Please enter the following 'extra' attributes
   to be sent with your certificate requestA
   challenge password []:
   An optional company name []:

   例如：

   [dminstalluser@blrlabvm_171_29 DMGenCerts]$ openssl req -new -key server.key -out server.csr
   Enter pass phrase for server.key:
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]: IN
   State or Province Name (full name) []: Karnataka
   Locality Name (eg, city) [Default City]: Bengaluru
   Organization Name (eg, company) [Default Company Ltd]: Huawei
   Organizational Unit Name (eg, section) []: GaussTools
   Common Name (eg, your name or your server's hostname) []:gausstools
   Email Address []:gausstools@huawei.com
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:
   [dminstalluser@blrlabvm_171_29 DMGenCerts]$

10. 执行以下命令生成自签名服务器证书：

    openssl x509 -req -days 365 -in server.csr -CA ca_cert.crt -CAkey ca.key -set_serial 01 -out server.crt

    执行以下命令从服务器密钥中移除密码短语：

11. openssl rsa -in server.key -out server.key

    执行以下命令生成客户端秘钥：

12. openssl genrsa -des3 -out client.key 4096

    执行以下命令生成客户端签名请求：

13. openssl req -passin pass:Gauss@123 -new -key client.key -out client.csr

    按提示输入以下字段：

14. Country Name (2 letter code) [XX]:
    State or Province Name (full name) []:
    Locality Name (eg, city) [Default City]:
    Organization Name (eg, company) [Default Company Ltd]:
    Organizational Unit Name (eg, section) []:
    Common Name (eg, your name or your server's hostname) []:
    Email Address []:
    Please enter the following 'extra' attributes
    to be sent with your certificate requestA
    challenge password []:
    An optional company name []:

    例如：

    [dminstalluser@blrlabvm_171_29 DMGenCerts]$ openssl req -new -key client.key -out client.csr
    Enter pass phrase for client.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [XX]: IN
    State or Province Name (full name) []: Karnataka
    Locality Name (eg, city) [Default City]: Bengaluru
    Organization Name (eg, company) [Default Company Ltd]: Huawei
    Organizational Unit Name (eg, section) []: GaussTools
    Common Name (eg, your name or your server's hostname) []:gausstools
    Email Address []:gausstools@huawei.com
    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:
    [dminstalluser@blrlabvm_171_29 DMGenCerts]$

15. 执行以下命令生成自签名客户端证书：

    openssl x509 -req -days 365 -in client.csr -CA ca_cert.crt -CAkey ca.key -set_serial 01 -out client.crt

    执行以下命令从客户端密钥中移除密码短语：

16. openssl rsa -in client.key -out client.key

    执行以下命令将私用秘钥转换为X.509：

17. openssl pkcs8 -topk8 -in client.key -out client.pem

    按提示输入以下字段：

18. Enter Encryption Password:
    Verifying - Enter Encryption Password:

19. 执行以下命令将私用秘钥转换为X.509：

    openssl pkcs8 -topk8 -in server.key -out server.pem

    按提示输入以下字段：

20. Enter Encryption Password:
    Verifying - Enter Encryption Password:

    例如：

    [dminstalluser@blrlabvm_171_29 DMGenCerts]$ openssl pkcs8 -topk8 -in server.key -out server.pem
    Enter Encryption Password:
    Verifying - Enter Encryption Password:

    在DMGenCerts文件夹下成功生成文件。

    [dminstalluser@blrlabvm_171_29 DMGenCerts]$ ll
    total 40
    -rw-rw-r--. 1  dminstalluser  dminstalluser  2147 Aug  6  17:38  ca_cert.crt
    -rw-rw-r--. 1  dminstalluser  dminstalluser  3311 Aug  6  17:34  ca.key
    -rw-rw-r--. 1  dminstalluser  dminstalluser  1899 Aug  6  18:15  client.crt
    -rw-rw-r--. 1  dminstalluser  dminstalluser  1647 Aug  6  18:14  client.csr
    -rw-rw-r--. 1  dminstalluser  dminstalluser  3243 Aug  6  18:15  client.key
    -rw-rw-r--. 1  dminstalluser  dminstalluser  3345 Aug  6  18:16  client.pem
    -rw-rw-r--. 1  dminstalluser  dminstalluser  2017 Aug  6  18:12  server.crt
    -rw-rw-r--. 1  dminstalluser  dminstalluser  1765 Aug  6  17:42  server.csr
    -rw-rw-r--. 1  dminstalluser  dminstalluser  3243 Aug  6  18:13  server.key
    -rw-rw-r--. 1  dminstalluser  dminstalluser  3345 Aug  6  18:16  server.pem
    [dminstalluser@blrlabvm_171_29 DMGenCerts]$

     说明：

    以上步骤中，证书密码为Gauss@123。该密码可以同步更新。