openssl - ワイルドカード サブドメインの自己署名証明書を生成しますか?

Question

openssl に関する優れたチュートリアルと、開発用の正しい証明書を生成する方法を誰か教えてもらえますか? ここで良いチュートリアルを見つけましたhttp://www.akadia.com/services/ssh_test_certificate.html しかし、いくつかのサブドメインの実際の例が必要です。

Answer 1

If you want a simple wildcard - then follow that very example - but instead of entering {{{public.akadia.com}}} enter {{{*.akadia.com}}}.

That should be it. Try. If it works (it usually does) for your user communtity then you are done.

If you also want this value in the subject alternative name as a DNS field - then you'll need to do a bit more. http://therowes.net/~greg/2008/01/08/creating-a-certificate-with-multiple-hostnames/ has a good example.

The short of it is that you need to find the openssl.conf file which came with your openssl install (locate openss.cnf) and then edit/ensure it has these entries:

 ....
 [ v3_req ]
 basicConstraints = CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 ....
 subjectAltName          = @altdns

 ...
 [altdns]
 DNS.1   = *.arkadia.com
 DNS.2   = arkadia.com

and then follow the instructions of akadia.com with the provisio that you pass a parameter

openssl req -config aboveedited.openssl.cf

to the openssl commands pointing to above