怎样OpenSSL去generate certificates

角色

官网：
https://www.openssl.org/

References：

https://www.digitalocean.com/com ... ivate-keys-and-csrs

https://stackoverflow.com/questi ... ficate-with-openssl

https://phoenixnap.com/kb/openss ... s-private-keys-csrs

https://geekflare.com/openssl-commands-certificates/

https://help.ubuntu.com/lts/serv ... nd-security.html.en

https://medium.freecodecamp.org/ ... tsheet-b441be1e8c4a

Simple and easy method
https://devcenter.heroku.com/articles/ssl-certificate-self
https://www.akadia.com/services/ssh_test_certificate.html

Simple and stright forward to create self-signed certificates
https://www.cisco.com/c/en/us/td ... m-certificates.html

Other information:
https://mum.mikrotik.com/present ... 3277_1476686469.pdf

角色

在使用openssl去gen cert和key，主要主力的地方：

1. Country Name (2 letter code) [AU]:HK
   
2. State or Province Name (full name) [Some-State]:name1
   
3. Locality Name (eg, city) []:name2
   
4. Organization Name (eg, company) [Internet Widgits Pty Ltd]:name3
   
5. Organizational Unit Name (eg, section) []:name4
   
6. Common Name (e.g. server FQDN or YOUR name) []:name5
   
7. Email Address []:your_email_address
   
8. [~] #

複製代碼

去generate一个ca.cert, 最重要就是name5，如果没有FQDN，是否可以IP Address，又或者普通打一个name就算呢？

1、最做ca.cert and ca.key
2、然后server.cert and server.key
3、最后client.cert and client.key

角色

过了5年了，因为V2Ray ws+tls问题，又回到这个问题上，估计要花点时间在这方面。

角色

最后都是用了caddy，里面自动运行Let's encrpt去跟certs and keys。