1、安装OpenSSL (Linux无需此步骤)

1.1、下载windows上适用的openssl

下载地址，因我的电脑是64位的，所以我选择下载OpenSSL 1.0.2t Light（64-bit）

按照默认位置安装即可，无需多余设置

1.2、设置环境变量

2、生成证书

2.1 Windows版

以管理员身份运行cmd，生成证书

我的电脑只有一个盘，所以我先cd到了c盘，然后运行命令，换言之，在哪里运行命令，哪里就是输出路径

完整过程如下图所示

2.2 Linux版同理

2.3 关键信息

2.3.1 单机环境，使用域名配置

echo "subjectAltName=DNS:zhangs.esrichina.com.com" > cert_extensions

2.3.2 分布式部署，使用域名配置

echo "subjectAltName=DNS.1:zhangs.esrichina.com.com,DNS.2:p1.esrichina.com.com,DNS.3:p2.esrichina.com.com,DNS.4:s1.esrichina.com.com,DNS.5:s2.esrichina.com.com,DNS.6:t1.esrichina.com.com" > cert_extensions

2.3.3 单机配置，使用IP配置

echo "subjectAltName=DNS:zhangs.esrichina.com.com,IP:192.168.100.83" > cert_extensions

3、完整代码

其中echo这句的写法参照上面三种情况

c:\>openssl genrsa -out 136zhengshu.key 2048
Generating RSA private key, 2048 bit long modulus
................................................+++++
.....+++++
e is 65537 (0x10001)
&nbsp;
c:\>openssl req -new -key 136zhengshu.key -out 136zhengshu.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:EsriChina
Organizational Unit Name (eg, section) []:Esrichina
Common Name (e.g. server FQDN or YOUR name) []:192.168.100.136
Email Address []:aoj@esrichina.com.cn
&nbsp;
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:1234
An optional company name []:esrichina
&nbsp;
c:\>echo subjectAltName=IP:192.168.100.136,DNS:win136.esrichina.com >cert_extensions
&nbsp;
c:\>openssl x509 -req -sha256 -in 136zhengshu.csr -signkey 136zhengshu.key -extfile cert_extensions -out 136zhengshu.crt -days 3650
Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=EsriChina/OU=Esrichina/CN=192.168.100.136/emailAddress=aoj@esrichina.com.cn
Getting Private key
&nbsp;
&nbsp;
&nbsp;
c:\>openssl pkcs12 -inkey 136zhengshu.key -in 136zhengshu.crt -export -out 136zhengshu.pfx
Enter Export Password:
Verifying - Enter Export Password:
&nbsp;
c:\>

生成的文件如下：