1.3.5.2. 使用 OpenSSL 创建 root CA 证书

运行以下命令生成您的证书颁发机构 (CA) RSA 私钥：

openssl genrsa -out ca.key 4096

使用您的 CA 密钥生成自签名 CA 证书。运行以下命令：

openssl req -x509 -new -nodes -key ca.key -days 400 -out ca.crt -config req.cnf

您的 req.cnf 文件可能类似以下文件：

[ req ]               # Main settings
default_bits = 4096       # Default key size in bits.
prompt = no               # Disables prompting for certificate values so the configuration file values are used.
default_md = sha256       # Specifies the digest algorithm.
distinguished_name = dn   # Specifies the section that includes the distinguished name information.
x509_extensions = v3_ca   # The extentions to add to the self signed cert

[ dn ]               # Distinguished name settings
C = US                    # Country
ST = North Carolina             # State or province
L = Raleigh                # Locality
O = Red Hat Open Shift     # Organization
OU = Red Hat Advanced Container Management        # Organizational unit
CN = www.redhat.com  # Common name.

[ v3_ca ]          # x509v3 extensions
basicConstraints=critical,CA:TRUE # Indicates whether the certificate is a CA certificate during the certificate chain verification process.