1)生成根证书
1.1) 生成RSA私钥

openssl genrsa -out cakey.pem 2048

1.2) 生成证书请求

openssl req -new -key cakey.pem -out cacsr.pem

1.3) 签发自签名证书

openssl x509 -in cacsr.pem -req -signkey cakey.pem -days 999 -out cacert.pem

2) 生成用户证书
1.1) 生成RSA私钥

openssl genrsa -out clikey.pem 2048

1.2) 生成证书请求

openssl req -new -key clikey.pem -out clicsr.pem

1.3) 签发证书

openssl x509 -in clicsr.pem -req -CA cacert.pem -CAkey cakey.pem -days 999 -set_serial 01 -out clicert.pem