安裝nginx可參考：
nginx重新編譯支持ssl可參考：
接下來手動(dòng)配置ssl證書：
自己手動(dòng)頒發(fā)證書的話，那么https是不被瀏覽器認(rèn)可的，就是https上面會(huì)有一個(gè)大紅叉
下面是手動(dòng)頒發(fā)證書的操作

切換到nginx配置文件

# cd /usr/local/nginx/conf

創(chuàng)建配置證書目錄

# mkdir ssl # cd ssl

1.生成私鑰

openssl genrsa -des3 -out cert.key 1024 #生成1024的證書私鑰 Generating RSA private key, 1024 bit long modulus ............++++++ ......................++++++ e is 65537 (0x10001) Enter pass phrase for cert.key: #提示輸入密碼 Verifying - Enter pass phrase for cert.key: #確認(rèn)密碼

2.創(chuàng)建證書請(qǐng)求

# openssl req -new -key cert.key -out cert.csr Enter pass phrase for cert.key: #輸入密碼 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:cn #國家 State or Province Name (full name) [Some-State]:shanghai #省份 Locality Name (eg, city) []:shanghai #地區(qū)名字 Organization Name (eg, company) [Internet Widgits Pty Ltd]:westos #公司名 Organizational Unit Name (eg, section) []:linux #部門 Common Name (e.g. server FQDN or YOUR name) []:server #CA主機(jī)名 Email Address []:root@server #郵箱Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:123456 #證書請(qǐng)求密鑰，CA讀取證書的時(shí)候需要輸入密碼 An optional company name []:123456 #公司名稱，CA讀取證書的時(shí)候需要輸入名稱

# cp cert.key cert.key.bak # openssl rsa -in cert.key.bak -out cert.key Enter pass phrase for cert.key.bak: #輸入密碼 writing RSA key

3.自簽署證書

·```
#openssl x509 -req -days 365 -in cert.csr -signkey cert.key -out cert.pem
Signature okbr/>subject=/C=cn/ST=shanghai/L=shanghai/O=westos/OU=linux/CN=server/emailAddress=root@server
Getting Private key

 # ll total 16 -rw-r--r-- 1 root root 749 Oct 25 15:33 cert.csr -rw-r--r-- 1 root root 891 Oct 25 16:13 cert.key -rw-r--r-- 1 root root 963 Oct 25 16:12 cert.key.bak -rw-r--r-- 1 root root 920 Oct 25 16:16 cert.pem

4.將證書導(dǎo)出成瀏覽器支持的p12

# openssl pkcs12 -export -clcerts -in cert.pem -inkey cert.key -out cert.p12 Enter Export Password: Verifying - Enter Export Password: [root@localhost ssl]# ls cert.csr cert.key cert.key.bak cert.p12 cert.pem

5.p12文件中導(dǎo)出公鑰和私鑰

生成cert.key文件

openssl pkcs12 -in cert.p12 -nocerts -nodes -out cert.key

導(dǎo)出公鑰

# openssl rsa -in cert.key -out cert_pri.pem writing RSA key

導(dǎo)出私鑰

# openssl rsa -in cert.key -pubout -out cert_pub.pem

轉(zhuǎn)載于:https://blog.51cto.com/13363488/2350494

總結(jié)

以上是生活随笔為你收集整理的linux系统自签发免费ssl证书，为nginx生成自签名ssl证书的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。