lc/my
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

更新 lssl.sh

Browse Source
This commit is contained in:
lc
2025-10-22 02:51:51 +00:00
parent 0e49c534b2
commit f2736557ea
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lssl.sh
View File

@@ -17,7 +17,7 @@ NGX_CONF_DIR="/etc/nginx/conf.d"
set -e set -e
echo "==== 2. 生成根CA（有效期10年） ====" echo "==== 2. 生成根CA--有效期10年 ===="
sudo openssl genrsa -out myCA.key 4096 sudo openssl genrsa -out myCA.key 4096
sudo openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.crt \ sudo openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.crt \
-subj "/C=CN/ST=Beijing/L=Beijing/O=MyCompany/OU=IT/CN=MyInternalCA" -subj "/C=CN/ST=Beijing/L=Beijing/O=MyCompany/OU=IT/CN=MyInternalCA"
@@ -25,7 +25,7 @@ sudo openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.cr
echo "==== 3. 生成站点私钥 ====" echo "==== 3. 生成站点私钥 ===="
sudo openssl genrsa -out site.key 2048 sudo openssl genrsa -out site.key 2048
echo "==== 4. 创建站点CSR配置（包含SAN: $SERVER_IP） ====" echo "==== 4. 创建站点CSR配置(包含SAN: $SERVER_IP) ===="
cat > site.cnf <<EOF cat > site.cnf <<EOF
[req] [req]
default_bits = 2048 default_bits = 2048
@@ -64,7 +64,7 @@ subjectAltName = @alt_names
IP.1 = $SERVER_IP IP.1 = $SERVER_IP
EOF EOF
echo "==== 7. 用根CA签发站点证书（有效期1年） ====" echo "==== 7. 用根CA签发站点证书(有效期1年) ===="
sudo openssl x509 -req -in site.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial \ sudo openssl x509 -req -in site.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial \
-out site.crt -days 365 -sha256 -extfile v3.ext -out site.crt -days 365 -sha256 -extfile v3.ext
@@ -75,7 +75,7 @@ echo " https://$SERVER_IP:$PORT1 → 后端 $BACKEND1"
echo " https://$SERVER_IP:$PORT2 → 后端 $BACKEND2" echo " https://$SERVER_IP:$PORT2 → 后端 $BACKEND2"
echo " https://$SERVER_IP:$PORT3 → 后端 $BACKEND3" echo " https://$SERVER_IP:$PORT3 → 后端 $BACKEND3"
echo echo
echo "💡 导入根CA后，浏览器应显示安全小锁。" echo "💡 导入根CA后,浏览器应显示安全小锁。"
echo "- Windows: 双击myCA.crt → 安装到本地计算机 → 受信任的根证书颁发机构" echo "- Windows: 双击myCA.crt → 安装到本地计算机 → 受信任的根证书颁发机构"
echo "- macOS: 双击myCA.crt → 钥匙串(系统) → 始终信任" echo "- macOS: 双击myCA.crt → 钥匙串(系统) → 始终信任"
echo "- Linux(Ubuntu): sudo cp myCA.crt /usr/local/share/ca-certificates/ && sudo update-ca-certificates" echo "- Linux(Ubuntu): sudo cp myCA.crt /usr/local/share/ca-certificates/ && sudo update-ca-certificates"