自签名证书及私钥

该方法仅供调测环境下使用。

执行如下脚本之前，请确保系统已安装OpenSSL 1.1.1。并执行如下命令。

cd ${HOME}

openssl rand -writerand .rnd

下面内容用户可以直接拷贝后修改，做成shell脚本。执行shell脚本后即可在当前目录下生成证书和私钥，将证书和私钥分别拷贝到开发环境和运行环境后才能支撑调优业务。

DEVICE_IP=10.174.229.196 # your device ip
HOST_IP=10.175.85.66 # your host ip
PASS_PHRASE=Ncx12345 # your pass phrase
KEY_LEN=3072 # [3072, 4096]
VALID_DAYS=365 # the cert will expire after the valid days
COUNTRY=CN # your country name abbr. (2 letter code)
STATE=Zhejiang # your province name
LOCATION=Hangzhou # your city name
ORGANIZATION=ABC # your company name
ORGANIZATION_UNIT=DEF # your section name
COMMON_NAME_ROOT=www.test.com # your domain name
ENCRYPT_MODE=aes256 # [aes256, aes128]

########## 该分割线以上内容请根据实际情况修改，以下内容不建议修改。##########

#generate conf
rm -rf host-ext.cnf  device-ext.cnf
echo "[ ext ]" >> host-ext.cnf
echo "subjectAltName=IP:${HOST_IP}" >> host-ext.cnf
echo "[ ext ]" >> device-ext.cnf
echo "subjectAltName=IP:${DEVICE_IP}" >> device-ext.cnf
 
#generate root cert
openssl req -x509 -newkey rsa:${KEY_LEN} -days ${VALID_DAYS} -nodes -keyout ca-key.pem -out ca-cert.pem -subj "/C=${COUNTRY}/ST=${STATE}/L=${LOCATION}/O=${ORGANIZATION}/OU=${ORGANIZATION_UNIT}/CN=${COMMON_NAME_ROOT}" -addext keyUsage=keyCertSign
 
#generate device cert request
openssl req -newkey rsa:${KEY_LEN} -nodes -keyout device-key.pem -out device-cert.csr -subj "/C=${COUNTRY}/ST=${STATE}/L=${LOCATION}/O=${ORGANIZATION}/OU=${ORGANIZATION_UNIT}/CN=NCS"
#generate device cert
openssl x509 -req -in device-cert.csr -days ${VALID_DAYS} -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out device-cert.pem -extensions ext -extfile device-ext.cnf
 
#generate host cert request
openssl req -newkey rsa:${KEY_LEN} -nodes -keyout host-key.pem -out host-cert.csr -subj "/C=${COUNTRY}/ST=${STATE}/L=${LOCATION}/O=${ORGANIZATION}/OU=${ORGANIZATION_UNIT}/CN=NCA"
#generate host cert
openssl x509 -req -in host-cert.csr -days ${VALID_DAYS} -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out host-cert.pem -extensions ext -extfile host-ext.cnf
 
#encryt private key
openssl rsa -in host-key.pem -passout pass:${PASS_PHRASE} -${ENCRYPT_MODE} -out host-key.pem
openssl rsa -in device-key.pem -passout pass:${PASS_PHRASE} -${ENCRYPT_MODE} -out device-key.pem

经过上述步骤生成的文件说明如下，需要严格按照表1将CA、证书、私钥拷贝到正确的设备。