研发环境：SSL证书快速部署

目录

概述

生成证书

单域名证书（dev.luckybin.top）

Linux

Windows（PowerShell）

通配符证书（*.luckybin.top）

Linux

Windows（PowerShell）

Nginx配置示例

单域名配置

通配符证书配置

证书有效性测试

注意事项

概述

本文档提供研发环境自签名证书生成指南，涵盖单域名证书和通配符证书两种类型，支持Windows和Linux系统。

• OpenSSL版本：1.1.1及以上

• 域名：dev.luckybin.top

• 环境：Windows / Linux

生成证书

单域名证书（dev.luckybin.top）

Linux

# 创建证书目录 mkdir -p /usr/local/nginx/conf/cert # 生成单域名证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout /usr/local/nginx/conf/cert/dev.luckybin.top.key \ -out /usr/local/nginx/conf/cert/dev.luckybin.top.crt \ -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=dev.luckybin.top" \ -addext "subjectAltName=DNS:dev.luckybin.top,IP:192.168.60.201"

Windows（PowerShell）

# 创建证书目录 C:\nginx\conf\cert # 生成单域名证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 ` -keyout "C:\nginx\conf\cert\dev.luckybin.top.key" ` -out "C:\nginx\conf\cert\dev.luckybin.top.crt" ` -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=dev.luckybin.top" ` -addext "subjectAltName=DNS:dev.luckybin.top,IP:192.168.60.201"

通配符证书（*.luckybin.top）

Linux

# 生成通配符证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout /usr/local/nginx/conf/cert/wildcard.luckybin.top.key \ -out /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt \ -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=*.luckybin.top" \ -addext "subjectAltName=DNS:*.luckybin.top,DNS:luckybin.top,DNS:dev.luckybin.top"

Windows（PowerShell）

# 生成通配符证书 openssl req -x509 -nodes -days 365 -newkey rsa:2048 ` -keyout "C:\nginx\conf\cert\wildcard.luckybin.top.key" ` -out "C:\nginx\conf\cert\wildcard.luckybin.top.crt" ` -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=*.luckybin.top" ` -addext "subjectAltName=DNS:*.luckybin.top,DNS:luckybin.top,DNS:dev.luckybin.top"

Nginx配置示例

单域名配置

server { listen 443 ssl; server_name dev.luckybin.top; # 单域名证书 ssl_certificate /usr/local/nginx/conf/cert/dev.luckybin.top.crt; ssl_certificate_key /usr/local/nginx/conf/cert/dev.luckybin.top.key; # 可选：HTTP重定向到HTTPS location / { # 应用配置... } }

通配符证书配置

server { listen 443 ssl; server_name ~^(?<subdomain>.+)\.luckybin\.top$; # 通配符证书 ssl_certificate /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt; ssl_certificate_key /usr/local/nginx/conf/cert/wildcard.luckybin.top.key; location / { # ... } }

证书有效性测试

# 测试HTTPS连接 curl -v https://dev.luckybin.top --cacert /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt # 检查证书链 openssl s_client -connect dev.luckybin.top:443 -servername dev.luckybin.top </dev/null 2>/dev/null | openssl x509 -text

注意事项

1. 证书用途：仅限研发测试环境使用，切勿用于生产环境

2. 有效期：证书默认365天，到期前需重新生成

3. 浏览器警告：首次访问会有安全警告，需手动信任证书

4. 通配符限制：*.luckybin.top不匹配luckybin.top（需额外添加）