1
2
3

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout domain.key -out domain.crt \
  -addext "subjectAltName=DNS:www.example.com,DNS:*.example.com" \
  -subj '/C=CN/ST=Guangdong/L=Shenzhen/O=example/OU=IT/CN=example.com'

1

openssl x509 -in domain.crt -noout -text

1
2

ssl_certificate     /path/domain.crt;
ssl_certificate_key /path/domain.key;

1

openssl genrsa -out ca.key 4096

1

openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/O=Example/CN=Example Certs C1" -key ca.key -out ca.crt

1

openssl genrsa -out example.com.key 4096

1

openssl req -sha512 -new -subj "/C=CN/ST=Guangdong/L=Shenzhen/O=Example/OU=IT/CN=example.com" -key example.com.key -out example.com.csr

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

tee v3.ext <<- EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=www.example.com
DNS.2=*.example.com
EOF

1

openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in example.com.csr -out example.com.crt

1

openssl x509 -in example.com.crt -noout -text

1
2

ssl_certificate     /path/example.com.crt;
ssl_certificate_key /path/example.com.key;