[TOC] ``` ### openssl req openssl req -new -nodes -key server.key -out server.csr -subj "/O=SYSU/CN=server.com" # 生成证书签名请求文件,-nodes表示不加密 openssl req -in server.csr -text # 查看证书签名请求文件内容 openssl req -verify -in server.csr # 验证请求文件 ### openssl x509 openssl x509 -noout -dates -in server.crt # 查看证书有效期 openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt # 签名 openssl x509 -in server.crt -text # 查看证书内容 openssl verify -verbose -CAfile ca.crt server.crt # 验证证书 openssl s_client -connect <ip>:<port> -showcerts # 获取服务证书 ```