之前在Windows上有用Perl编译过OpenSSL，不过只是要用它的两个静态库，这次搭一个https server还要用它来生成自签名证书，其中我的配置文件在openssl/apps/openssl.cnf，编译后openssl.exe在openssl/out32/openssl.exe，编译过程可以去网上查，资料还是挺多的。
OpenSSL默认加载配置文件路径是/usr/local/ssl/openssl.cnf，因而在开始前需要先设定一下'OPENSSL_CONF'环境变量：
D:\Code\openssl\apps>set OPENSSL_CONF=D:\Code\openssl\apps\openssl.cnf之后即可以根据自己的需求来生成密钥和证书了，关于SSL/TLS原理此处也不多赘述，其中包含了多种非对称加密、对称加密算法，下面将罗列生成CA、server、client三方证书的步骤，但对于只做单向鉴定的情况下client证书是不必要的。
D:\Code\openssl\apps>openssl genrsa -out ies/ca-key.pem 1024Generating RSA private key, 1024 bit long modulus.............++++++.....................++++++e is 65537 (0x10001)D:\Code\openssl\apps>openssl req -new -out ies/ca-req.csr -key ies/ca-key.pemYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:Shan-DongLocality Name (eg, city) []:jinanOrganization Name (eg, company) [Internet Widgits Pty Ltd]:iESLabOrganizational Unit Name (eg, section) []:SKCommon Name (e.g. server FQDN or YOUR name) []:www.iessk.comEmail Address []:sorata_kasugano@qq.comPlease enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:.An optional company name []:.D:\Code\openssl\apps>openssl x509 -req -in ies/ca-req.csr -out ies/ca-cert.pem -signkey ies/ca-key.pem -days 3650Signature oksubject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.comGetting Private keyD:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/ca-cert.pem -inkey ies/ca-key.pem -out ies/ca.p12Enter Export Password:Verifying - Enter Export Password:D:\Code\openssl\apps>openssl genrsa -out ies/server-key.pem 1024Generating RSA private key, 1024 bit long modulus......++++++.++++++e is 65537 (0x10001)D:\Code\openssl\apps>openssl req -new -out ies/server-req.csr -key ies/server-key.pemYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:Shan-DongLocality Name (eg, city) []:jinanOrganization Name (eg, company) [Internet Widgits Pty Ltd]:iESLabOrganizational Unit Name (eg, section) []:SKCommon Name (e.g. server FQDN or YOUR name) []:www.iessk.comEmail Address []:sorata_kasugano@qq.comPlease enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:.An optional company name []:.D:\Code\openssl\apps>openssl x509 -req -in ies/server-req.csr -out ies/server-cert.pem -signkey ies/server-key.pem -CA ies/ca-cert.pem -CAkey ies/ca-key.pem -CAcreateserial -days 3650Signature oksubject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.comGetting Private keyGetting CA Private KeyD:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/server-cert.pem -inkey ies/server-key.pem -out ies/server.p12Enter Export Password:Verifying - Enter Export Password:D:\Code\openssl\apps>openssl genrsa -out ies/client-key.pem 1024Generating RSA private key, 1024 bit long modulus......................++++++...............++++++e is 65537 (0x10001)D:\Code\openssl\apps>openssl req -new -out ies/client-req.csr -key ies/client-key.pemYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:Shan-DongLocality Name (eg, city) []:jinanOrganization Name (eg, company) [Internet Widgits Pty Ltd]:iESLabOrganizational Unit Name (eg, section) []:SKCommon Name (e.g. server FQDN or YOUR name) []:www.iessk.comEmail Address []:sorata_kasugano@qq.comPlease enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:.An optional company name []:.D:\Code\openssl\apps>openssl x509 -req -in ies/client-req.csr -out ies/client-cert.pem -signkey ies/client-key.pem -CA ies/ca-cert.pem -CAkey ies/ca-key.pem -CAcreateserial -days 3650Signature oksubject=/C=CN/ST=Shan-Dong/L=jinan/O=iESLab/OU=SK/CN=www.iessk.com/emailAddress=sorata_kasugano@qq.comGetting Private keyGetting CA Private KeyD:\Code\openssl\apps>openssl pkcs12 -export -clcerts -in ies/client-cert.pem -inkey ies/client-key.pem -out ies/client.p12Enter Export Password:Verifying - Enter Export Password:过程都是相同的，先生成1024位的RSA私钥，而后生成证书请求文件（.csr），csr文件经CA私钥签名后生成公钥（即X.509证书），假如需要的话还可以再把它导出为其余格式比方PKCS#12证书（.p12）。