生成CA自签证书：

openssl genrsa -out ca-key.pem 1024

openssl req -new -out ca-req.csr -key ca-key.pem -subj "/C=CN/ST=Jiangsu/L=Changzhou/O=XXXXX/CN=www.XXXXXX.com.cn"

openssl x509 -req -in ca-req.csr -out ca-cert.pem -signkey ca-key.pem -days 3650

openssl pkcs12 -export -clcerts -in ca-cert.pem -inkey ca-key.pem -out ca.p12

keytool -keystore truststore.jks -keypass 123456 -storepass 123456 -alias ca -import -trustcacerts -file ca-cert.pem

pause

XXXXX生成服务端证书：

openssl genrsa -out server-key.pem 1024

openssl req -new -out server-req.csr -key server-key.pem -subj "/C=CN/ST=Jiangsu/L=Changzhou/O=XXXXX/CN=XXXXXX"

openssl x509 -req -in server-req.csr -out server-cert.pem -signkey server-key.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -days 3650

openssl pkcs12 -export -clcerts -in server-cert.pem -inkey server-key.pem -out server.p12

pause

生成客户端证书：

openssl genrsa -out client-key.pem 1024

openssl req -new -out client-req.csr -key client-key.pem  -subj "/C=CN/ST=Jiangsu/L=XXXXX/O=XXXXX/CN=测试证书01"

openssl x509 -req -in client-req.csr -out client-cert.pem -signkey client-key.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -days 3650

openssl pkcs12 -export -clcerts -in client-cert.pem -inkey client-key.pem -out client.p12

pause