1、生成x509格式的CA自簽名證書
openssl req -new -x509 -keyout ca.key -out ca.crt
2、生成服務端的私鑰（key文件）及申請證書文件csr文件
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
3、生成客戶端的私鑰（key文件）及申請證書csr文件
openssl genrsa -des3 -out client.key 1024
openssl req -new -key client.key -out client.csr
4、用生成的CA的證書爲剛纔生成的server.csr，client.csr文件簽名
openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key
openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key
5、生成p12格式證書
openssl pkcs12 -export -inkey client.key -in client.crt -out client.pfx
openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx
6、生成pem格式證書
有時需要用到pem格式的證書，可以用以下方式合併證書文件（crt）和私鑰文件（key）來生成。
cat client.crt client.key> client.pem
cat server.crt server.key > server.pem
7、pfx文件轉換爲X509證書文件和RSA密鑰文件
openssl pkcs12 -in server.pfx -nodes -out server.pem
openssl x509 -in server.pem -out server2.crt
openssl rsa -in server.pem -out server2.key
注意：CA在簽證時會出現如下錯誤，解決方法：
[root@station23 test]# openssl ca -in my.csr -out ldap.crt
Using configuration from /etc/pki/tls/openssl.cnf
I am unable to access the /etc/pki/CA/newcerts directory
/etc/pki/CA/newcerts: No such file or directory
[root@station23 test]# mkdir /etc/pki/CA/newcerts
[root@station23 test]# openssl ca -in my.csr -out ldap.crt
Using configuration from /etc/pki/tls/openssl.cnf
/etc/pki/CA/index.txt: No such file or directory
unable to open '/etc/pki/CA/index.txt'
23016:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('/etc/pki/CA/index.txt','r')
23016:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354:
[root@station23 test]# touch /etc/pki/CA/index.txt
[root@station23 test]# openssl ca -in my.csr -out ldap.crt
Using configuration from /etc/pki/tls/openssl.cnf
/etc/pki/CA/serial: No such file or directory
error while loading serial number
23031:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('/etc/pki/CA/serial','r')
23031:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354:
[root@station23 test]# touch /etc/pki/CA/serial
[root@station23 test]# echo 00 > /etc/pki/CA/serial
