用IP自签发一个HTTPS证书
用IP自签发一个证书
自签发的Nginx证书,用IP地址而非域名进行签发,并安装到浏览器的过程如下:
1. 生成自签发证书
生成私钥:
openssl genrsa -out server.key 2048生成证书签名请求(CSR):
openssl req -new -key server.key -out server.csr在提示中填写信息时,可以在
Common Name (CN)字段输入要使用的 IP 地址:[root@QNXGXUUAOAW006 opt]# openssl req -new -key server.key -out server.csrYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:BJLocality Name (eg, city) [Default City]:BJOrganization Name (eg, company) [Default Company Ltd]:ORGOrganizational Unit Name (eg, section) []:ORGCommon Name (eg, your name or your server's hostname) []:10.53.234.106Email Address []:Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:生成自签名证书:
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
2. 安装证书到浏览器
为了防止浏览器报错,你需要将证书导入信任列表