centOS7生成多级证书链(openssl)

首先进行初始化

rm -rf /etc/pki/CA/*.old
touch /etc/pki/CA/index.txt
echo 01 > /etc/pki/CA/serial
echo 02 > /etc/pki/CA/serial
rm -rf keys
mkdir keys

生成根CA并自签(CN=rootCA)

openssl genrsa -des3 -out keys/rootCA.key 2048
openssl req -new -x509 -days 180 -key keys/rootCA.key -out keys/rootCA.crt

生成二级CA(CN=secondCA)

openssl genrsa -des3 -out keys/secondCA.key 2048
openssl rsa -in keys/secondCA.key -out keys/secondCA.key
openssl req -new -days 180 -key keys/secondCA.key -out keys/secondCA.csr
openssl ca -extensions v3_ca -in keys/secondCA.csr -config /etc/pki/tls/openssl.cnf -days 180 -out keys/secondCA.crt -cert keys/rootCA.crt -keyfile keys/rootCA.key

生成三级CA(CN=thirdCA)

openssl genrsa -des3 -out keys/thirdCA.key 2048
openssl rsa -in keys/thirdCA.key -out keys/thirdCA.key
openssl req -new -days 180 -key keys/thirdCA.key -out keys/thirdCA.csr
openssl ca -extensions v3_ca -in keys/thirdCA.csr -config /etc/pki/tls/openssl.cnf -days 180 -out keys/thirdCA.crt -cert keys/secondCA.crt -keyfile keys/secondCA.key

使用三级CA签发服务器证书

openssl genrsa -des3 -out keys/server.key 2048
openssl rsa -in keys/server.key -out keys/server.key
openssl req -new -days 180 -key keys/server.key -out keys/server.csr
openssl ca -in keys/server.csr -config /etc/pki/tls/openssl.cnf -days 180 -out keys/server.crt -cert keys/thirdCA.crt -keyfile keys/thirdCA.key

最后将RootCA导入受信任的根证书颁发机构，其他两个证书导入中级CA机构，服务器证书根据需要导入

 

参考资料:https://www.cnblogs.com/gsls200808/p/4502044.html