OpenSSL签发内网IP的SSL证书

操作系统：Linux

需要系统里安装有OpenSSL

直接执行如下sh文件

生成证书

#!/bin/bash

area="CQ"
ip_address="192.168.1.180"
organization="QY"
cert_dir="/www/cert"

# 创建证书目录
mkdir -p $cert_dir
cd $cert_dir

# 生成根证书
openssl genrsa -out rootCA.key 2048

# 创建根CA证书 (rootCA.pem)
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 7300 -out rootCA.pem -subj "/C=CN/ST=$area/L=$area/O=$organization/OU=IT/CN=$organization"

# 服务器私钥
openssl genrsa -out "$ip_address.key" 2048


# 创建证书签名请求 (CSR) 的配置文件 (san.cnf)
cat > san.cnf <<EOF
[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
req_extensions     = req_ext

[ dn ]
C=CN
ST=$area
L=$area
O=$organization
OU=IT
CN=$ip_address

[ req_ext ]
subjectAltName=@alt_names

[ alt_names ]
IP.1=$ip_address
EOF

# 生成CSR
openssl req -new -key "$ip_address.key" -out "$ip_address.csr" -config san.cnf

# 生成自签名证书 (使用根CA签发服务器证书)
openssl x509 -req -in "$ip_address.csr" -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out "$ip_address.crt" -days 7300 -sha256 -extfile san.cnf -extensions req_ext

echo "生成证书完成..."

部署到Nginx

listen 8081 ssl http2;
server_name 192.168.1.11;
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/project/public;

#SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
#error_page 404/404.html;
#HTTP_TO_HTTPS_END
ssl_certificate /www/server/panel/vhost/cert/project/192.168.1.180.pem;
ssl_certificate_key /www/server/panel/vhost/cert/project/192.168.1.180.key;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
error_page 497 https://$host$request_uri;

访问https://192.168.1.180就可以访问了