生成支持配置SAN的自签证书

gen-selfsign-ssl-with-san.sh

#!/bin/sh

# create self-signed server certificate with SAN support:

read -p "Enter your domain [www.example.com]: " DOMAIN
read -p "Enter additional domains (space separated) or press enter to skip: " ADDITIONAL_DOMAINS

# Create OpenSSL config file
cat > openssl.cnf << EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[dn]
C=US
ST=Mars
L=iTranswarp
O=iTranswarp
OU=iTranswarp
CN=$DOMAIN

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = $DOMAIN
EOF

# Add additional domains to config if provided
if [ ! -z "$ADDITIONAL_DOMAINS" ]; then
    i=2
    for domain in $ADDITIONAL_DOMAINS; do
        echo "DNS.$i = $domain" >> openssl.cnf
        i=$((i+1))
    done
fi

echo "Create server key..."

openssl genrsa -des3 -out $DOMAIN.key 2048

echo "Create server certificate signing request..."

openssl req -new -key $DOMAIN.key -out $DOMAIN.csr -config openssl.cnf

echo "Remove password..."

mv $DOMAIN.key $DOMAIN.origin.key
openssl rsa -in $DOMAIN.origin.key -out $DOMAIN.key

echo "Sign SSL certificate..."

openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt \
    -extensions req_ext -extfile openssl.cnf

# Clean up
rm openssl.cnf

echo "TODO:"
echo "Copy $DOMAIN.crt to /etc/nginx/ssl/$DOMAIN.crt"
echo "Copy $DOMAIN.key to /etc/nginx/ssl/$DOMAIN.key"
echo "Add configuration in nginx:"
echo "server {"
echo "    ..."
echo "    listen 443 ssl;"
echo "    ssl_certificate     /etc/nginx/ssl/$DOMAIN.crt;"
echo "    ssl_certificate_key /etc/nginx/ssl/$DOMAIN.key;"
echo "}"