openssl创建使用中级证书实例

1.签发根CA
       openssl genrsa -des3 -out myrootca.key 1024
      openssl req -new -key myrootca.key -out myrootca.req
      openssl x509 -req -days 7305 -extfile rootca.conf -signkey myrootca.key -in myrootca.req -out myrootca.crt
2.签发中级CA
  openssl genrsa -out subca.key 1024
    openssl req -new -key subca.key -out subca.req
        openssl x509 -req -days 3650 -sha1 -extfile subca.conf -CA myrootca.crt -CAkey myrootca.key -CAserial myrootca.srl -CAcreateserial -in subca.req -out subca.crt
1.使用中级CA签发一个服务器证书

openssl x509 -req -days 3650 -sha1 -extfile server.conf -CA subca.crt -CAkey subca.key -CAserial subca.srl -CAcreateserial -in certreq.txt -out serverbysubca.crt

1.使用根CA签发一个服务器证书
openssl x509 -req -days 3650 -sha1 -extfile server.conf -CA myrootca.crt -CAkey myrootca.key -CAserial myrootca.srl -CAcreateserial -in myhost.req -out myhost.crt

rootca.conf：

basicConstraints = CA:true
keyUsage = keyCertSign, cRLSign

subca.conf

basicConstraints = CA:true,pathlen:0

keyUsage = keyCertSign, cRLSign

nsCertType = sslCA, emailCA, objCA

server.conf

basicConstraints = CA:false

keyUsage=digitalSignature,keyEncipherment,dataEncipherment, keyAgreement

nsCertType = server

extendedKeyUsage = serverAuth, msSGC, nsSGC