環境：

CentOS 6.8 x86_64

安裝

openssl openssl-devel
cp /etc/pki/tls/openssl.cnf openssl.cnf

修改openssl.cnf

[ req ]
distinguished_name = req_distinguished_name
default_md = sha256 #將sha1改為sha256
req_extensions = v3_req  #取消這行註釋

確保req_distinguished_name下沒有 0.xxx 的標籤，有的話把0.xxx的0. 去掉

[ req_distinguished_name ]
countryName
 
              = Country Name (2 letter code)
countryName_default = CN
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default = GuangDong
localityName              = Locality Name (eg, city)
localityName_default = ShenZhen
organizationalUnitName             = Organizational Unit Name (eg, section)
organizationalUnitName_default
 
 = 303 IT Lab
commonName         = IT Lab
commonName_max = 64
[ v3_req ]
Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names    #增加這行

# 新增以下部分
[ alt_names ]
DNS.1 = abc.com
DNS.2 = *.abc.com
DNS.3 = xyz.com
DNS.4 = *.xyz.com
# 可以自行增加多域名
 

建立相關目錄及檔案

mkdir -p CA/{certs,crl,newcerts,private}
touch CA/index.txt
echo 00 > CA/serial

1.生成ca.key並自簽署

openssl req -utf8 -sha256 -new -x509 -days 3650 -keyout ca.key -out ca.crt -config openssl.cnf

2.生成server.key

openssl genrsa -out server.key 2048

3.生成證書籤名請求

openssl req -utf8 -new -sha256 -key server.key -out server.csr -config openssl.cnf

Common Name 就是在這一步填寫 *.abc.com common name一定要在alt_names中包含

4.檢視簽名請求檔案資訊

openssl req -in server.csr -text

檢查 Signature Algorithm 是不是sha256WithRSAEncryptio

5.使用自簽署的CA，簽署server.scr

openssl ca -in server.csr -md sha256  -out server.crt -cert ca.crt -keyfile ca.key -extensions v3_req -config openssl.cnf

注意：即便是你前面是sha256的根證書和sha256的請求檔案，如果不加-md sha256，預設是按照sha1進行簽名的

6.檢視證書

openssl x509 -in server.crt -text

同樣檢查 Signature Algorithm 是不是sha256WithRSAEncryptio

7.同理生成客戶端證書

# client

openssl genrsa -out client.key 2048

openssl req -utf8 -new -sha256 -key client.key -out client.csr -config openssl.cnf

openssl ca -in client.csr -md sha256  -out client.crt -cert ca.crt -keyfile ca.key -extensions v3_req -config openssl.cnf -days 3650

8.將證書轉成p12格式

openssl pkcs12 -export -clcerts -in ca.crt -inkey ca.key -out ca.p12
openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12