<一,openssl CA自签发证书>
1,生成私钥
openssl genrsa 1024 > private.key;
2,从私钥中生成公钥（可选项）
openssl rsa -in private.key -pubout > public.key;
3,生成证书请求文件
openssl req -new -key private.key -out my.csr;
CA的配置
3． 配置做成CA
cd /etc/pki/tls
vim openssl.cnf
找到[ CA_default ]
dir = /etc/pki/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
保存退出
接着cd ../CA目录下：
mkdir certs crl newcerts
touch index.txt serial
echo 00 > serial
4． 创建CA的证书：CA要想给别人发证首先自己得有证
cd private
openssl genrsa 1024 > cakey.pem
生成自签的证书
cd ..
openssl req –new –x509 –key private/cakey.pem –out cacert.pem
给请求者发证：切到
openssl ca –in my.csr –out my.crt
<配置阿里云tomcat https>
1,首先配置jdk1.7及tomcat7
配置阿里云公网SLB后使用SLB 的ip访问ECS所发布的app
测试使用公网SLB https访问后端ECS所发布的tomcat app
1,我们首先使用crt未安装在客户端情况
2,我们使用winscp讲147上的my.crt下载下来
