sh 在MacOS上使用SubjectAltName为localhost创建自签名证书

Posted 2021-05-07

# SSL self signed localhost start to finish, no red warnings. 

# 1) Create your private key (any password will do, we remove it below)

openssl genrsa -des3 -out localhost.orig.key 2048


# 2) Remove the password

openssl rsa -in localhost.orig.key -out localhost.key


# 3) Generate the csr (Certificate signing request)

openssl req -new -sha256 -key localhost.key -subj "/C=US/ST=UT/O=Degreed/CN=localhost" -reqexts SAN -extensions SAN -config <(cat /System/Library/OpenSSL/openssl.cnf <(printf "[SAN]\nsubjectAltName=@alt_names\n[alt_names]\nDNS=localhost\nIP.1=127.0.0.1")) -out localhost.csr

# verify the csr with the following

openssl req -in localhost.csr -text -noout

# 4) Generate self signed ssl certificate 

openssl x509 -req -days 3650 -extensions SAN -extfile <(cat /System/Library/OpenSSL/openssl.cnf <(printf "[SAN]\nsubjectAltName=@alt_names\n[alt_names]\nDNS=localhost\nIP.1=127.0.0.1")) -in localhost.csr -signkey localhost.key -out localhost.crt


# 5) Generate combined .pfx file for IIS

openssl pkcs12 -export -inkey localhost.key -in localhost.crt -out localhost.pfx