openssl 生成自签名证书

[ req ]
default_bits        = 2048
default_md          = sha256
prompt             = no
distinguished_name = req_distinguished_name
x509_extensions     = v3_ca

[ req_distinguished_name ]
CN = localhost

[ v3_ca ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = localhost

保存上面的代码为：openssl.cnf，然后依次运行下面的命令：

openssl genrsa -out localhost.key 2048

openssl req -new -key localhost.key -out localhost.csr -config openssl.cnf

openssl x509 -req -days 365 -in localhost.csr -signkey localhost.key -out localhost.crt -extensions v3_ca -extfile openssl.cnf -set_serial 01

最后把生成的.csr 文件导入到受信任的根证书就行了。一定不要漏掉了openssl.cnf 里的keyUsage， 否则就算添加为受信任的根证书了，浏览器也会认为不安全。