littleca-shell

mkdir myca
cd myca
mkdir newcerts certs crl
touch index.txt serial
echo 01 > serial

1.生成 ca私钥
openssl genrsa -out private/cakey.pem 2048
2. 对ca 证书进行自签名 根证书自签名
openssl req -new -x509 -key private/cakey.pem -out cacert.pem

# ca目录配置
dir		= g://openssl/ca		# Where everything is kept

# 客户端证书和根证书属性匹配规则
 For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional



将policy_match 修改为optional  match 表示属性必须一致