如何制作和使用自签名证书

openssl req -x509 -newkey rsa:2048 -keyout ssl/${fileName}.key -out ssl/${fileName}.crt -days 3600 -nodes ...

enerating a RSA private key
....................................................................................................................................................................................................................................................................++++
.............................................................++++
writing new private key to 'example.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:XX
Locality Name (eg, city) []:XXXX
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example, Inc
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:example.com
Email Address []:example@soulteary.com

#!/bin/sh

OUTPUT_FILENAME="lab.com"

printf "[req]
prompt                  = no
default_bits            = 4096
default_md              = sha256
encrypt_key             = no
string_mask             = utf8only

distinguished_name      = cert_distinguished_name
req_extensions          = req_x509v3_extensions
x509_extensions         = req_x509v3_extensions

[ cert_distinguished_name ]
C  = CN
ST = BJ
L  = BJ
O  = HomeLab
OU = HomeLab
CN = lab.com

[req_x509v3_extensions]
basicConstraints        = critical,CA:true
subjectKeyIdentifier    = hash
keyUsage                = critical,digitalSignature,keyCertSign,cRLSign #,keyEncipherment
extendedKeyUsage        = critical,serverAuth #, clientAuth
subjectAltName          = @alt_names

[alt_names]
DNS.1 = lab.com
DNS.2 = *.lab.com
DNS.3 = *.page.lab.com

">ssl/${OUTPUT_FILENAME}.conf

openssl req -x509 -newkey rsa:2048 -keyout ssl/$OUTPUT_FILENAME.key -out ssl/$OUTPUT_FILENAME.crt -days 3600 -nodes -config ssl/${OUTPUT_FILENAME}.conf

docker run --rm -it -e CERT_DNS="domain.com;*.domain.com;*.a.domain.com" -v `pwd`/certs:/ssl soulteary/certs-maker

User Input: { CERT_DNS: 'domain.com;*.domain.com;*.a.domain.com' }
Generating a RSA private key
................................................................................................................................................+++++
.........................................................+++++
writing new private key to 'ssl/domain.com.key'
-----

version: '2'

services:

  certs-maker:
    image: soulteary/certs-maker
    environment:
      - CERT_DNS=a.com;b.com;c.com;*.d.com;
    volumes:
      - ./certs:/ssl

sudo keytool -import -alias charles -file /Path-To-Certs/key.crt -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit

cp *.crt /usr/local/share/ca-certificates/
update-ca-certificates

FROM alpine

RUN apk update && apk add ca-certificates && rm -rf /var/cache/apk/*

ADD ./ssl/*.crt /usr/local/share/ca-certificates/

RUN update-ca-certificates --fresh

server {
    listen 80;
    server_name localhost;
    location = /favicon.ico {
        empty_gif;
    }
    location / {
        root /public;
        autoindex on;
        sub_filter '<h1>Index of /</h1>'  '<h1>Get Certs</h1>';
        sub_filter_once on;
    }
}

version: '2'

services:

  nginx:
    image: nginx:1.19.6-alpine
    ports:
      - 8080:80
    volumes: 
      - ./default.conf:/etc/nginx/templates/default.conf.template:ro
      - ./public:/public:ro

version: '2'

services:

  nginx:
    image: nginx:1.19.6-alpine
    ports:
      - 8080:80
    volumes: 
      - ./public:/public:ro
    command: >
      /bin/sh -c "
      echo \"daemon off;\" >> /etc/nginx/nginx.conf;
      echo \"server {
            listen 80;
            server_name localhost;
            location = /favicon.ico {
                empty_gif;
            }
            location / {
                root /public;
                autoindex on;
                sub_filter '<h1>Index of /</h1>'  '<h1>Get Certs</h1>';
                sub_filter_once on;
            }
        }\" > /etc/nginx/conf.d/default.conf; nginx;
      "