Openssl Win64生成證書
一、準備工作：
1、 下載win64的Openssl，可到http://slproweb.com/products/Win32OpenSSL.html下載，這裡下載1.0.1j版本。
先安裝Visual C++ 2008Redistributables (x64)，然後安裝Win64 OpenSSL v1.0.1j。這裡我安裝到D:\OpenSSL-Win64\目錄下。
2、 下載Openssl原始碼，去官網http://www.openssl.org/下載即可。
解壓openssl-1.0.1j.tar.gz，找到\openssl-1.0.1j\apps目錄，拷貝demoCA目錄和openssl.cnf檔案到Openssl的安裝目錄下的bin目錄下（即D:\OpenSSL-Win64\bin\）。
3、在D:\OpenSSL-Win64\bin目錄下，建立ca、jks、server、client四個目錄。
二、開始生成證書：
開啟命令提示行（cmd.exe），----如果是win7環境需要以管理員身份執行cmd.exe（一般在C:\Windows\System32下查詢到cmd.exe右建以管理員身份執行），
並切換到Openssl安裝目錄的bin目錄下。如下圖：
依次執行下述命令。
（一）生成CA證書
1.建立私鑰：
D:\OpenSSL-Win64\bin>openssl genrsa -out ca/ca-key.pem 1024
2.建立證書請求：
D:\OpenSSL-Win64\bin>openssl req -new -out ca/ca-req.csr -key ca/ca-key.pem -config openssl.cnf
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BJ
Locality Name (eg, city) []:BJ
Organization Name (eg, company) [Internet Widgits PtyLtd]:ple
Organizational Unit Name (eg, section) []:live
Common Name (eg, YOUR name) []:root
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
3.自簽署證書：
D:\OpenSSL-Win64\bin>openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -days 3650
4.將證書匯出成瀏覽器支援的.p12格式：
D:\OpenSSL-Win64\bin>openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12
密碼：passca
（二）生成server證書
1.建立私鑰：
D:\OpenSSL-Win64\bin>openssl genrsa -out server/server-key.pem 1024
2.建立證書請求：
D:\OpenSSL-Win64\bin>openssl req -new -out server/server-req.csr -key server/server-key.pem -config openssl.cnf
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BJ
Locality Name (eg, city) []:BJ
Organization Name (eg, company) [Internet Widgits PtyLtd]:ple
Organizational Unit Name (eg, section) []:live
Common Name (eg, YOUR name) []:localhost 註釋：一定要寫伺服器所在的ip地址//紅色這裡是本機測試，所以我寫localhost
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
3.自簽署證書：
D:\OpenSSL-Win64\bin>openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -signkey server/server-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
4.將證書匯出成瀏覽器支援的.p12格式：
D:\OpenSSL-Win64\bin>openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12
密碼：passca
（三）生成client證書
1.建立私鑰：
D:\OpenSSL-Win64\bin>openssl genrsa -out client/client-key.pem 1024
2.建立證書請求：
D:\OpenSSL-Win64\bin>openssl req -new -out client/client-req.csr -key client/client-key.pem -config openssl.cnf
----- Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BJ
Locality Name (eg, city) []:BJ
Organization Name (eg, company) [Internet Widgits PtyLtd]:ple
Organizational Unit Name (eg, section) []:live
Common Name (eg, YOUR name) []:client
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
3.自簽署證書：
D:\OpenSSL-Win64\bin>openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -signkeyclient/client-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
4.將證書匯出成瀏覽器支援的.p12格式：
D:\OpenSSL-Win64\bin>openssl pkcs12 -export -clcerts-in client/client-cert.pem -inkey client/client-key.pem -out client/client_err.p12
密碼：passca
5. 生成客戶端證書匯出成瀏覽器支援的.p12格式（用於匯入瀏覽器）：
D:\OpenSSL-Win64\bin>openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -outclient/client.p12
密碼：passca
（四）根據ca證書生成jks檔案
D:\OpenSSL-Win64\bin>keytool -keystore D:/OpenSSL-Win64/bin/jks/truststore.jks -keypass 222222-storepass 222222 -alias ca -import -trustcacerts -file D:/OpenSSL-Win64/bin/ca/ca-cert.pem