记录证书生成（c++客户端用pem，java服务端用.keystore）

//证书

 

mkdir newcerts private 

echo '01' > serial 

touch index.txt 

vi ./openssl.cnf

openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 3650 -config ./openssl.cnf 

 

keytool -genkey -alias client -validity 3650 -keyalg RSA -keystore mycerts -keysize 2048

keytool -keystore mycerts -certreq -alias client -sigalg MD5withRSA -file clientapp.crs

openssl ca -out clientapp.pem -config ./openssl.cnf -infiles clientapp.crs 

openssl x509 -in clientapp.pem -out clientapp.der -outform DER

keytool -keystore mycerts -alias systemca -import -file cacert.pem -keyfile ./private/cakey.pem -notext

 

 

 

服务端

 

keytool -genkey -alias sslserver -validity 3650 -keyalg RSA -keysize 2048 -keystore sslserver.keystore -keypass NWSX1qaz -storepass NWSX1qaz

keytool -certreq -alias sslserver -sigalg SHA1withRSA -file sslserver.csr -keypass NWSX1qaz -storepass NWSX1qaz -keystore sslserver.keystore

openssl ca -in sslserver.csr -out sslserver.crt -cert cacert.pem -keyfile ./private/cakey.pem -notext -config ./openssl.cnf

openssl x509 -in sslserver.crt -out sslserver.der -outform DER

keytool -import -v -trustcacerts -alias ca_root -file cacert.pem -storepass NWSX1qaz -keystore sslserver.keystore

keytool -import -v -alias sslserver -file sslserver.der -keypass NWSX1qaz -storepass NWSX1qaz -keystore sslserver.keystore

 

客户端

keytool -genkey -alias sslclient -validity 3650 -keyalg RSA -keysize 2048 -keystore sslclient.keystore -keypass NWSX1qaz -storepass NWSX1qaz

keytool -certreq -alias sslclient -sigalg SHA1withRSA -file sslclient.csr -keypass NWSX1qaz -storepass NWSX1qaz -keystore sslclient.keystore

openssl ca -in sslclient.csr -out sslclient.crt -cert cacert.pem -keyfile ./private/cakey.pem -notext -config ./openssl.cnf

openssl x509 -in sslclient.crt -out sslclient.der -outform DER

keytool -import -v -trustcacerts -alias ca_root -file cacert.pem -storepass NWSX1qaz -keystore sslclient.keystore

keytool -import -v -alias sslclient -file sslclient.der -keypass NWSX1qaz -storepass NWSX1qaz -keystore sslclient.keystore

 

 

 

证书密码：NWSX1qaz