首先要有一个CA根证书，然后用CA根证书来签发用户证书。
用户进行证书申请：一般先生成一个私钥，然后用私钥生成证书请求(证书请求里应含有公钥信息)，再利用证书服务器的CA 根证书来签发证书。
特别说明:
（1）自签名证书(一般用于顶级证书、根证书): 证书的名称和认证机构的名称相同.
（2）根证书：根证书是CA认证中心给自己颁发的证书,是信任链的起始点。任何安装CA根证书的服务器都意味着对这个CA认证中心是信任的。
数字证书则是由证书认证机构（CA）对证书申请者真实身份验证之后，用CA的根证书对申请人的一些基本信息以及申请人的公钥进行签名（相当于加盖发证书机构的公章）后形成的一个数字文件。数字证书包含证书中所标识的实体的公钥（就是说你的证书里有你的公钥），由于证书将公钥与特定的个人匹配，并且该证书的真实性由颁发机构保证（就是说可以让大家相信你的证书是真的），因此，数字证书为如何找到用户的公钥并知道它是否有效这一问题提供了解决方案。
.key格式：私有的密钥
.csr格式：证书签名请求（证书请求文件），含有公钥信息，certificate signing request的缩写
.crt（cer）格式：证书文件，certificate的缩写
.crl格式：证书吊销列表，Certificate Revocation List的缩写
.pem(p12)格式：用于导出，导入证书时候的证书的格式，有证书开头，结尾的格式
openssl command [ command_opts ] [ command_args ]
version 用于查看版本信息
enc 用于加解密
ciphers 列出加密套件
genrsa 用于生成私钥
rsa RSA密钥管理(例如:从私钥中提取公钥)
req 生成证书签名请求(CSR)
crl 证书吊销列表(CRL)管理
ca CA管理(例如对证书进行签名)
dgst 生成信息摘要
rsautl 用于完成RSA签名、验证、加密和解密功能
passwd 生成散列密码
rand 生成伪随机数
speed 用于测试加解密速度
s_client 通用的SSL/TLS客户端测试工具
X509 X.509证书管理
verify X.509证书验证
pkcs7 PKCS#7协议数据管理
openssl version [-a] [-v] [-b] [-o] [-f] [-p] [-d]
-a：打印所有信息。
-v：仅打印版本信息
-b：打印当前版本构建的日期
-o：库构建时的相关信息
-f：编译参数
-p：平台信息
-d: 列出openssl的安装目录
openssl genrsa [-out filename] [-passout arg] [-des] [-des3] [-idea] [-f4] [-3] [-rand file(s)]
[-engine id] [numbits]
-out fiename: 指定输出文件。如果没有设定此选项，将会输出到标准输出。
-passout arg: 指定密码来源。
-des|-des3|-idea：用来加密私钥文件的三种对称加密算法。
-F4|-3：指定指数。-f4为0x1001
-rand file(s)：指定随机种子。
-engine id：硬件引擎。
numbits: 生成的密钥位数。必须是本指令的最后一个参数。默认为512bits。
openssl req [-help] [-inform PEM|DER] [-outform PEM|DER] [-in filename] [-passin arg] [-out filename] [-passout arg] [-text] [-pubkey] [-noout] [-verify] [-modulus] [-new] [-rand file…] [-writerand file] [-newkey rsa:bits] [-newkey alg:file] [-nodes] [-key filename] [-keyform PEM|DER] [-keyout filename] [-keygen_engine id] [-digest] [-config filename] [-multivalue-rdn] [-x509] [-days n] [-set_serial n] [-newhdr] [-addext ext] [-extensions section] [-reqexts section] [-precert] [-utf8] [-nameopt] [-reqopt] [-subject] [-subj arg] [-sigopt nm:v] [-batch] [-verbose] [-engine id]
常用如下：
-new：表示生成一个新的证书签署请求；
-x509：专用于生成CA自签证书；
-key：指定生成证书用到的私钥文件；
-out FILNAME：指定生成的证书的保存路径；
-days：指定证书的有效期限，单位为day，默认是365天；
mkdir ssl
cd ssl
mkdir demoCA
cd demoCA
touch index.txt serial
echo 01 > demoCA/serial
mkdir newcerts
openssl version -a
cp /usr/lib/ssl/openssl.cnf ~/ssl
生成CA私钥（.key）–>生成CA证书请求（.csr）–>自签名得到根证书（.crt）（CA给自已颁发的证书）
1、创建根证私钥
openssl genrsa -out ca.key 2048
2、创建根证书请求文件
openssl req -new -key ca.key -out ca.csr
3、自签根证书
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt -days 3650
配置如下：
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:bx
Organizational Unit Name (eg, section) []:bx
Common Name (e.g. server FQDN or YOUR name) []:CA
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
1、生成服务端key
openssl genrsa -des3 -out server.key 2048
2、生成服务端请求文件
openssl req -new -key server.key -out server.csr
3、生成服务端证书，使用根证书签发
openssl ca -in server.csr -cert ca.crt -keyfile ca.key -out server.crt -days 3650
4.生成pem格式证书
cat server.key server.crt > server.pem
5.生成p12格式证书
openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12
配置如下：
Enter pass phrase for server.key:输入相应的密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:bx //需要和根证书一样
Organizational Unit Name (eg, section) []:bx //需要和根证书一样
Common Name (e.g. server FQDN or YOUR name) []:192.168.1.105 输入相应服务器的ip
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
openssl genrsa -des3 -out client.key 2048
openssl req -new -key client.key -out client.csr
openssl ca -in client.csr -cert ca.crt -keyfile ca.key -out client.crt -days 3650
cat client.key client.crt > client.pem
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
配置如下：
Enter pass phrase for client.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:bx
Organizational Unit Name (eg, section) []:bx
Common Name (e.g. server FQDN or YOUR name) []:client
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Common Name (e.g. server FQDN or YOUR name) []:client
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []: