openssl 로 사설 인증서 생성

export CERT_DIR="/data/cert"
export DOMAIN="hyunsoft"


openssl genrsa -out ${CERT_DIR}/ca.key 2048

openssl req -x509 -new -nodes -key ${CERT_DIR}/ca.key -days 3650 -out ${CERT_DIR}/ca.crt -subj "/CN=${DOMAIN}-ca" -extensions v3_ca -config ${CERT_DIR}/openssl.conf


openssl genrsa -out ${CERT_DIR}/${DOMAIN}.key 2048

openssl req -new -key ${CERT_DIR}/${DOMAIN}.key -subj "/CN=${DOMAIN}" | openssl x509 -req -CA ${CERT_DIR}/ca.crt -CAkey ${CERT_DIR}/ca.key -CAcreateserial -out ${CERT_DIR}/${DOMAIN}.crt -days 3650 -extensions v3_req_server -extfile ${CERT_DIR}/openssl.conf

 

검증

openssl x509 -text -noout -in ${DOMAIN}.crt

openssl.conf sample

[ req ]
distinguished_name = req_distinguished_name
[req_distinguished_name]

[ v3_ca ]
basicConstraints = critical, CA:TRUE
keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign

[ v3_req_client ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth

[ v3_req_server ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names_registry

[ alt_names_registry ]
DNS.1 = localhost
DNS.2 = regi-210
DNS.2 = regi-210.hyunsoft.co.kr
IP.1 = 127.0.0.1
IP.2 = 192.168.1.252