https - 自建 https 证书

Page / - 最后修改者 Qiongpan Ke 打开 2023-07-07

自建 https 证书

最后修改者 Qiongpan Ke

打开 2023-07-07

内容列表

1. 生成一个 RSA 私钥

2. 创建免密的 RSA 私钥

3. 导出 RSA 私钥对应的公钥

4. 生成一个 CA 根证书签名请求

5. 使用 RSA 私钥对 CA 根证书签名请求进行自签

6. 生成 https 服务器的 RSA 密钥

7. 创建免密的 RSA 私钥

8. 导出 RSA 私钥对应的公钥

9. 生成一个 https 证书签名请求

10. 使用 CA 根证书对 https 证书签名请求进行签发

11. 将私钥和证书打包成 p12 文件

12. 将 p12 文件转换为 jks 文件

13. 查看 https 证书内容

Contents

1. 生成一个 RSA 私钥

2. 创建免密的 RSA 私钥

3. 导出 RSA 私钥对应的公钥

4. 生成一个 CA 根证书签名请求

5. 使用 RSA 私钥对 CA 根证书签名请求进行自签

6. 生成 https 服务器的 RSA 密钥

7. 创建免密的 RSA 私钥

8. 导出 RSA 私钥对应的公钥

9. 生成一个 https 证书签名请求

10. 使用 CA 根证书对 https 证书签名请求进行签发

11. 将私钥和证书打包成 p12 文件

12. 将 p12 文件转换为 jks 文件

13. 查看 https 证书内容

参考文章：《Nginx自建SSL证书部署HTTPS网站》

1. 生成一个 RSA 私钥

openssl genrsa -aes256 -out ca_rsa_private.key 4096

执行结果如下：

$ openssl genrsa -aes256 -out ca_rsa_private.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.........++++
....................................................................................................................................................................................................................................++++
e is 65537 (0x010001)
Enter pass phrase for ca_rsa_private.key:
Verifying - Enter pass phrase for ca_rsa_private.key:
$ ls -ltr
total 4
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key

2. 创建免密的 RSA 私钥

相比需要输入密码的 RSA 密钥，使用免密的 RSA 密钥，配置在 web 容器中，不需要在每次启动或重新加载配置时手动输入密码（部份 web 容器则直接在配置文件中配置 RSA 密钥的密码）。

openssl rsa -in ca_rsa_private.key -out ca_rsa_private_nopass.key

执行结果如下：

$ openssl rsa -in ca_rsa_private.key -out ca_rsa_private_nopass.key
Enter pass phrase for ca_rsa_private.key:
writing RSA key
$ ls -ltr
total 8
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key

3. 导出 RSA 私钥对应的公钥

openssl rsa -in ca_rsa_private_nopass.key -pubout -out ca_rsa_public.key

执行结果如下：

$ openssl rsa -in ca_rsa_private_nopass.key -pubout -out ca_rsa_public.key
writing RSA key
$ ls -ltr
total 12
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key

4. 生成一个 CA 根证书签名请求

openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=Example.com's Root CA/emailAddress=iana@iana.org" -key ca_rsa_private_nopass.key -out ca.csr

执行结果如下：

$ openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=Example.com's Root CA/emailAddress=iana@iana.org" -key ca_rsa_private_nopass.key -out ca.csr
$ ls -ltr
total 16
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr

5. 使用 RSA 私钥对 CA 根证书签名请求进行自签

# openssl x509 -req -days $((365 * 100)) -sha256 -extensions v3_ca -in ca.csr -signkey ca_rsa_private_nopass.key -out ca.crt
#mkdir -p ./demoCA
#touch ./demoCA/index.txt
#openssl ca -days $((365 * 100)) -md sha256 -extensions v3_ca -selfsign -in ca.csr -keyfile ca_rsa_private_nopass.key -out ca.crt -outdir . -create_serial
openssl req -x509 -days $((365 * 100)) -sha256 -nodes -in ca.csr -key ca_rsa_private_nopass.key -out ca.crt

执行结果如下：

$ openssl req -x509 -days $((365 * 100)) -sha256 -nodes -in ca.csr -key ca_rsa_private_nopass.key -out ca.crt
$ ls -ltr
total 20
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt

6. 生成 https 服务器的 RSA 密钥

openssl genrsa -aes256 -out https_rsa_private.key 4096

执行结果如下：

$ openssl genrsa -aes256 -out https_rsa_private.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
......................................++++
.............................++++
e is 65537 (0x010001)
Enter pass phrase for https_rsa_private.key:
Verifying - Enter pass phrase for https_rsa_private.key:
$ ls -ltr
total 24
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key

7. 创建免密的 RSA 私钥

相比需要输入密码的 RSA 密钥，使用免密的 RSA 密钥，配置在 web 容器中，不需要在每次启动或重新加载配置时手动输入密码（部份 web 容器则直接在配置文件中配置 RSA 密钥的密码）。

openssl rsa -in https_rsa_private.key -out https_rsa_private_nopass.key

执行结果如下：

$ openssl rsa -in https_rsa_private.key -out https_rsa_private_nopass.key
Enter pass phrase for https_rsa_private.key:
writing RSA key
$ ls -ltr
total 28
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key

8. 导出 RSA 私钥对应的公钥

openssl rsa -in https_rsa_private_nopass.key -pubout -out https_rsa_public.key

执行结果如下：

$ openssl rsa -in https_rsa_private_nopass.key -pubout -out https_rsa_public.key
writing RSA key
$ ls -ltr
total 32
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key

9. 生成一个 https 证书签名请求

openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=*.example.com/emailAddress=iana@iana.org" -key https_rsa_private_nopass.key -out https.csr

执行结果如下：

$ openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=*.example.com/emailAddress=iana@iana.org" -key https_rsa_private_nopass.key -out https.csr
$ ls -ltr
total 36
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr

10. 使用 CA 根证书对 https 证书签名请求进行签发

创建的过期时间不要太长，建议不超过2年，否则部份浏览器不会信任该证书，如: iPhone 上的 Safari、Chrome 等。

另外，在 Chrome 58 之后，不再只校验 CommonName 项是否与访问域名或IP匹配，还需要配置 subjectAltName 项。

# 首次使用 CA 根证书签发 https 证书的同时创建 ca.srl 序列号参考文件
# 第二次以后使用 CA 根证书签发 https 证书时直接引用之前创建的 ca.srl 序列号参考文件，并递增其序列号。
openssl x509 -req -days $((356 * 2)) -sha256 -extfile <(cat /etc/ssl/openssl.cnf <(
cat <<EOF
[v3_san]
subjectAltName = @alt_names
[alt_names]
DNS.1 = example.com
DNS.2 = *.example.com
EOF
)) -extensions v3_san -CA ca.crt -CAkey ca_rsa_private_nopass.key -$(if [ -f ca.srl ]; then echo CAserial ca.srl; else echo CAcreateserial; fi) -in https.csr -out https.crt

执行结果如下：

$ openssl x509 -req -days $((356 * 2)) -sha256 -extfile <(cat /etc/ssl/openssl.cnf <(
t <<E> cat <<EOF
> [v3_san]
> subjectAltName = @alt_names
>
> [alt_names]
> DNS.1 = example.com
> DNS.2 = *.example.com
> EOF
> )) -extensions v3_san -CA ca.crt -CAkey ca_rsa_private_nopass.key -$(if [ -f ca.srl ]; then echo CAserial ca.srl; else echo CAcreateserial; fi) -in https.csr -out https.crt
Signature ok
subject=C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = *.example.com, emailAddress = iana@iana.org
Getting CA Private Key
$ ls -ltr
total 40
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
-rwxrwxrwx 1 stduser stduser 41 Jul 7 05:17 ca.srl
-rwxrwxrwx 1 stduser stduser 2106 Jul 7 05:17 https.crt

11. 将私钥和证书打包成 p12 文件

openssl pkcs12 -export -inkey https_rsa_private_nopass.key -in https.crt -out https.keystore.p12 -name https

执行结果如下：

$ openssl pkcs12 -export -inkey https_rsa_private_nopass.key -in https.crt -out https.keystore.p12 -name https
Enter Export Password:
Verifying - Enter Export Password:
$ ls -ltr
total 48
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
-rwxrwxrwx 1 stduser stduser 41 Jul 7 05:17 ca.srl
-rwxrwxrwx 1 stduser stduser 2106 Jul 7 05:17 https.crt
-rwxrwxrwx 1 stduser stduser 4328 Jul 7 05:18 https.keystore.p12

12. 将 p12 文件转换为 jks 文件

keytool -importkeystore -srckeystore https.keystore.p12 -srcstoretype pkcs12 -destkeystore https.keystore.jks -deststoretype jks -v

执行结果如下：

$ keytool -importkeystore -srckeystore https.keystore.p12 -srcstoretype pkcs12 -destkeystore https.keystore.jks -deststoretype jks -v
Importing keystore https.keystore.p12 to https.keystore.jks...
Enter destination keystore password:
Re-enter new password:
Enter source keystore password:
Entry for alias https successfully imported.
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled
[Storing https.keystore.jks]
Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore https.keystore.jks -destkeystore https.keystore.jks -deststoretype pkcs12".
$ ls -ltr
total 52
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul 7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul 7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul 7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul 7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul 7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser 800 Jul 7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul 7 05:16 https.csr
-rwxrwxrwx 1 stduser stduser 41 Jul 7 05:17 ca.srl
-rwxrwxrwx 1 stduser stduser 2106 Jul 7 05:17 https.crt
-rwxrwxrwx 1 stduser stduser 4328 Jul 7 05:18 https.keystore.p12
-rwxrwxrwx 1 stduser stduser 4026 Jul 7 05:18 https.keystore.jks

13. 查看 https 证书内容

openssl x509 -in ca.crt -noout -text
openssl x509 -in https.crt -noout -text
keytool -list -v -keystore https.keystore.p12
keytool -list -v -keystore https.keystore.jks

执行结果如下：

$ openssl x509 -in ca.crt -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
13:33:c1:cb:4a:05:23:9b:c4:9a:95:68:fc:88:9e:40:12:68:e4:af
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
Validity
Not Before: Jul 6 21:14:41 2023 GMT
Not After : Jun 12 21:14:41 2123 GMT
Subject: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (4096 bit)
Modulus:
00:aa:d9:c7:6d:ec:ba:79:67:c9:69:41:b4:12:30:
eb:05:83:b2:cc:38:a9:76:c6:40:b3:61:28:40:00:
e7:81:18:fb:81:ec:7e:bb:4c:03:95:b4:16:1b:47:
eb:39:66:50:60:fa:d1:ab:25:b4:92:23:36:85:86:
6c:df:9b:ed:d1:fb:5a:4b:3f:79:b7:66:2e:4e:47:
d0:c8:16:1a:2b:d7:db:2a:db:80:55:7a:88:5f:f9:
45:91:87:29:3b:2a:e6:9b:90:d0:c6:58:b9:35:14:
10:2f:5b:42:c6:7b:2e:54:6d:53:7d:97:b8:7e:fb:
48:08:49:2f:e3:67:31:b8:fb:92:0f:63:88:4b:b3:
a4:3a:c5:0f:09:68:a9:bf:96:8c:64:b7:82:5e:88:
2d:4b:08:af:70:92:ec:e4:6b:0a:bb:36:29:6e:13:
55:0d:61:a7:bc:e1:0b:68:91:5e:52:71:b4:a6:b0:
d2:9d:a6:21:8e:b1:49:70:40:ac:32:ec:97:14:35:
a2:1b:43:e6:9c:cb:fa:0e:99:09:da:91:2a:96:9b:
fc:ad:69:f9:46:70:1e:23:74:07:ec:17:b9:09:dc:
55:f3:c0:1b:0e:bf:7c:c9:6b:10:b9:79:89:23:98:
26:63:35:14:09:dd:35:6e:84:a8:db:50:7d:f7:ad:
13:f4:a2:8f:7a:79:d7:e1:62:86:3e:bd:fb:68:d1:
c5:b2:bc:00:80:1b:7a:e9:c5:f8:75:d5:6a:e4:e2:
29:38:f1:7f:42:f6:4e:dd:44:df:04:ec:28:e6:40:
70:ee:85:6d:33:9a:8d:2f:fa:15:d2:21:88:89:86:
45:08:bb:fd:1e:37:6a:d5:07:b0:38:12:df:50:02:
50:53:ea:cc:76:e0:56:22:b8:e8:80:27:23:85:ea:
5d:57:e4:44:22:ed:86:5e:08:8a:6e:d2:55:ea:06:
f2:b5:84:26:de:b9:55:26:1d:15:58:84:5f:41:00:
60:43:3b:56:e2:2c:e0:31:cf:54:f2:dd:44:0c:c8:
62:49:4a:f3:e1:8e:c7:56:8b:cd:da:9e:b8:d7:ef:
1e:63:50:47:c5:59:93:71:76:d0:bc:c3:93:fe:fb:
39:3d:0c:bb:03:6c:2f:4c:0b:7a:ef:32:c8:18:c2:
c9:ad:10:a4:8b:5f:a4:23:ab:80:2f:66:fb:a1:41:
12:bc:15:2d:15:3d:1b:b7:9c:f9:22:cc:a6:11:06:
8b:43:f9:23:05:c7:c8:a6:79:12:c3:10:7f:9e:72:
ef:aa:99:67:7e:fc:e7:06:0d:38:0c:2c:f2:37:45:
1a:5b:e1:cb:7a:87:27:46:c7:44:b1:01:c7:51:8f:
4f:08:67
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
46:8E:37:91:A4:56:D5:63:C8:25:43:A0:E8:E1:16:66:3C:F0:22:E6
X509v3 Authority Key Identifier:
keyid:46:8E:37:91:A4:56:D5:63:C8:25:43:A0:E8:E1:16:66:3C:F0:22:E6
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
97:e7:45:3f:b7:59:34:e7:c6:22:fc:ba:4c:82:60:0e:8c:73:
b2:c9:31:bf:ea:ad:cc:70:79:eb:3b:31:bb:aa:73:f8:12:e8:
d8:37:8a:d3:b2:77:42:03:47:3f:23:8c:82:74:69:f8:ad:45:
08:60:cf:c3:90:67:9f:55:1f:b5:7a:aa:73:12:d6:73:97:65:
72:45:74:63:e3:23:5f:47:c9:b8:48:e2:d2:58:c7:f8:af:0e:
79:eb:ab:82:7a:17:f7:3b:62:60:82:7a:f9:32:23:f8:3f:1d:
24:80:92:47:80:a7:2f:ef:d2:eb:0b:7f:16:da:d1:7d:0e:6a:
be:28:7c:d2:85:48:83:f6:d8:87:35:3d:72:7c:36:ea:3e:31:
04:81:ae:3a:97:56:c9:95:d6:b6:8f:16:3e:fb:94:35:ee:dc:
7a:c6:85:ef:67:0b:31:bc:c3:e0:d8:2f:d2:93:93:0d:b1:61:
c4:92:0a:c1:f4:13:df:8b:b4:70:e0:74:7c:c5:56:cc:82:1d:
db:02:0c:2b:ca:61:af:3a:51:b1:be:a9:0c:b8:44:22:6d:69:
97:82:01:c9:0f:d8:90:8f:aa:1d:f4:cc:a8:72:0f:03:8d:d7:
e3:32:22:1b:60:99:84:25:b3:10:7a:a8:99:5c:c7:c4:f5:4a:
94:47:37:21:bb:39:f2:ff:f1:f8:c2:59:92:44:58:e4:d5:2e:
df:d4:13:2f:58:9e:87:d5:4f:92:a8:bd:de:11:c1:97:97:0b:
08:04:b2:9d:83:77:19:6f:ee:6a:c2:e3:59:92:d4:3a:c1:f0:
46:06:14:45:e8:eb:de:47:26:4a:e3:54:aa:12:ca:34:63:d2:
ab:ab:3f:b4:c8:84:b9:47:d4:b1:e7:c5:83:37:0f:97:18:42:
29:a6:db:df:97:da:02:8e:01:f1:43:1a:c5:a5:41:b4:4e:a0:
15:ae:08:d7:07:e6:cb:6c:43:a6:9c:0f:9c:0f:f8:ff:07:e3:
15:5e:cf:92:04:f9:9c:cc:9d:c3:ff:62:f2:31:ae:fb:2a:10:
41:70:d7:74:1c:d0:5e:08:5e:12:e8:82:2a:8e:78:51:61:e6:
e7:76:de:37:2a:89:fc:6f:a2:91:13:47:ee:bc:52:7f:2e:e5:
b0:c1:99:4d:52:47:7d:19:74:de:b9:6b:8e:4e:7a:c1:80:e7:
90:0a:d5:fc:e7:2d:fd:d7:76:83:66:0a:d3:a2:08:c5:33:87:
8f:91:ef:cf:70:06:4c:c0:90:b5:9f:84:00:ee:02:c0:06:da:
ff:16:59:d8:0d:cd:fb:8d:6f:41:74:29:02:81:4e:65:86:1e:
64:23:c5:07:84:ee:f1:dd
$ openssl x509 -in https.crt -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0c:7b:a6:5b:70:e6:ab:18:82:fb:20:5c:50:63:43:e7:dc:fd:b5:ee
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
Validity
Not Before: Jul 6 21:17:44 2023 GMT
Not After : Jun 17 21:17:44 2025 GMT
Subject: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = *.example.com, emailAddress = iana@iana.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (4096 bit)
Modulus:
00:d3:86:0e:43:53:f0:af:db:7b:a6:51:b9:13:0d:
49:ec:b9:a7:da:10:8b:81:38:76:c0:a4:b2:8e:1d:
3e:71:45:8b:97:45:d5:20:40:d6:39:47:2b:14:cc:
f4:d0:c1:82:ea:27:b9:cb:b9:4e:3d:8e:52:74:74:
e1:2b:72:87:1f:a7:7f:ad:37:84:ed:63:8f:31:9d:
19:6a:a9:f4:88:b2:64:d8:39:6e:31:b6:d1:12:fe:
84:95:15:ac:f1:66:11:50:42:9b:fc:c4:fe:10:7c:
b9:c8:a2:80:23:7b:8a:81:8a:65:c2:cd:cf:e1:fe:
e6:84:4f:92:0a:45:65:81:f4:c1:c4:37:29:aa:76:
30:9f:af:38:04:57:95:ca:38:e4:ba:3e:10:c3:e7:
26:63:f7:25:fb:f1:8d:17:4d:80:63:46:b0:bb:da:
e4:ec:3a:70:4d:fe:da:62:27:24:36:bf:9d:19:d7:
cf:85:61:ac:e2:2e:c5:14:36:22:89:06:a5:96:d2:
3b:7c:a4:d2:76:fb:bb:40:09:d5:43:95:1a:1f:58:
63:a1:3a:d7:13:de:80:71:ff:ae:a3:45:fe:76:74:
5a:67:95:c3:ce:20:a5:46:eb:cc:0f:ab:14:54:3e:
16:4f:b1:ea:a3:72:b3:80:9a:da:bf:47:f3:30:a7:
2d:66:40:6f:9a:cd:3a:0b:59:2d:c0:40:8f:1c:f3:
b5:45:63:02:c5:6f:b0:d9:0f:ee:97:a0:ca:60:3b:
de:75:0b:03:91:f3:79:77:57:30:07:d7:de:d6:52:
8e:d5:20:17:00:79:0c:16:37:24:2c:0a:17:5e:b4:
a7:0a:67:7a:82:3e:07:76:0a:30:91:cf:cf:2e:be:
59:cf:a5:85:8e:2a:d2:46:ef:62:97:f2:08:b9:c8:
2a:ce:62:2f:39:67:24:65:6e:fa:9f:3c:4b:76:34:
53:15:87:c4:f0:51:ce:3f:de:47:e2:60:48:17:62:
0f:0e:77:bf:ec:77:c7:e2:26:ae:1e:bc:b1:79:44:
4c:50:81:98:43:9e:18:09:af:5c:41:a3:03:28:f8:
7c:41:82:72:d0:c8:08:2e:29:81:06:10:fd:7c:67:
8d:fa:c1:ce:f8:95:90:32:45:11:32:91:45:66:75:
4e:97:09:6e:fd:82:bc:a9:03:90:ab:12:44:4d:46:
37:61:89:0e:b7:56:4a:f2:91:01:e2:3a:1b:41:48:
07:29:95:e1:4f:d8:0b:57:69:bc:7f:1a:f9:5e:51:
28:83:1e:c3:86:96:69:b1:1b:b3:e9:27:09:fd:46:
ef:5b:32:21:55:0b:c1:49:76:a9:65:02:bd:4a:26:
89:5f:f9
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:example.com, DNS:*.example.com
Signature Algorithm: sha256WithRSAEncryption
7c:27:ba:df:25:e0:cf:96:ea:ae:e1:03:d7:f5:19:c2:96:11:
51:c9:ee:df:c9:65:2f:27:22:fd:0c:84:87:ba:a4:f3:32:ac:
29:87:2e:a8:8c:a9:ac:46:a5:2c:fb:60:54:51:b6:b8:8e:9a:
b5:00:b5:7d:ef:86:30:2d:f6:f6:df:50:b4:16:f6:bf:ed:dc:
51:c4:20:80:1f:27:2e:83:72:0b:a6:df:0b:52:7a:62:6e:64:
d1:a0:aa:80:93:ab:4f:ab:06:ed:9a:a4:3f:29:dc:a3:6f:d1:
81:0d:77:81:9d:8f:a3:0b:0f:d0:1b:41:23:e9:fe:64:15:6d:
20:70:5a:50:b8:16:cd:06:e9:ee:c3:9a:9d:ea:77:86:09:e3:
4a:29:2b:42:c6:a8:32:82:1d:80:5e:7f:3d:68:c1:a8:c7:e2:
d5:ab:2d:c9:4c:0a:63:fd:28:31:b8:cb:88:02:37:b7:45:20:
f3:ac:24:15:65:fb:17:6e:82:ce:8b:bc:d9:ef:40:eb:70:fa:
5a:b4:35:e1:8a:6c:7e:33:0b:c1:23:2c:da:be:68:72:b1:a1:
44:43:6c:86:56:d0:9f:a6:cc:7f:d0:0e:b5:69:87:9e:d4:b4:
6a:ac:8a:0a:01:a3:93:17:e4:da:88:7d:0f:e4:b3:5f:2a:fa:
b6:f4:42:94:85:11:49:63:89:90:e8:eb:6a:e1:fa:fd:0d:02:
32:76:03:56:28:b3:b6:12:a5:e3:16:65:bb:56:fe:62:ea:c9:
3c:57:df:a3:c7:a6:bf:34:fb:d1:dd:a2:01:97:8b:ab:bd:eb:
fe:e6:50:cd:6e:14:f6:c8:1c:a0:d4:ba:ae:77:a6:2d:14:af:
53:94:4f:45:9a:23:9c:5e:45:3c:1c:b1:1a:18:9d:45:b5:dc:
31:e2:f8:4b:94:e7:05:cf:9d:d4:50:52:74:bc:96:6c:43:03:
be:d1:77:87:cd:d4:76:fe:0b:bd:a1:33:ed:39:0d:6b:96:2e:
a2:5a:58:36:b4:bf:5a:8b:3f:27:cf:0d:74:69:1a:eb:3b:c9:
63:ea:0a:7a:00:e1:4d:f7:e6:33:9e:f9:88:e1:3b:66:35:54:
c3:39:12:c8:ba:65:97:cc:83:a8:03:c8:1c:24:a3:29:5e:9d:
dd:dc:8d:bf:b1:f8:a2:1a:02:2c:51:b1:64:cb:c9:57:9e:de:
ae:34:bc:2e:ae:86:14:5d:0d:75:f5:04:38:d4:dd:b8:75:7b:
8f:2f:1d:46:11:2a:62:77:d3:d8:d0:0b:d4:2b:6c:10:10:97:
93:a0:da:53:5c:9a:b0:77:b8:a9:ca:7e:ce:6d:a2:72:5e:ee:
39:fc:e2:f7:dd:a1:dc:12
$ keytool -list -v -keystore https.keystore.p12
Enter keystore password:
Keystore type: PKCS12
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: https
Creation date: Jul 7, 2023
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: EMAILADDRESS=iana@iana.org, CN=*.example.com, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Issuer: EMAILADDRESS=iana@iana.org, CN=Example.com's Root CA, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Serial number: c7ba65b70e6ab1882fb205c506343e7dcfdb5ee
Valid from: Fri Jul 07 05:17:44 CST 2023 until: Wed Jun 18 05:17:44 CST 2025
Certificate fingerprints:
SHA1: FA:10:E7:11:4F:47:5E:1A:93:E1:DC:EE:AE:53:DF:4D:91:C4:3B:34
SHA256: 19:41:78:84:25:D3:25:EE:D1:0F:BA:11:34:6A:70:EA:70:A9:CC:1B:CD:A0:96:0C:F0:71:8D:BA:13:3E:59:C6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3
Extensions:
#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: example.com
DNSName: *.example.com
]
*******************************************
*******************************************
$ keytool -list -v -keystore https.keystore.jks
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: https
Creation date: Jul 7, 2023
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: EMAILADDRESS=iana@iana.org, CN=*.example.com, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Issuer: EMAILADDRESS=iana@iana.org, CN=Example.com's Root CA, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Serial number: c7ba65b70e6ab1882fb205c506343e7dcfdb5ee
Valid from: Fri Jul 07 05:17:44 CST 2023 until: Wed Jun 18 05:17:44 CST 2025
Certificate fingerprints:
SHA1: FA:10:E7:11:4F:47:5E:1A:93:E1:DC:EE:AE:53:DF:4D:91:C4:3B:34
SHA256: 19:41:78:84:25:D3:25:EE:D1:0F:BA:11:34:6A:70:EA:70:A9:CC:1B:CD:A0:96:0C:F0:71:8D:BA:13:3E:59:C6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3
Extensions:
#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: example.com
DNSName: *.example.com
]
*******************************************
*******************************************
Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore https.keystore.jks -destkeystore https.keystore.jks -deststoretype pkcs12".