{"id":19858839,"url":"https://github.com/fishdrowned/ssl","last_synced_at":"2025-04-04T10:06:21.590Z","repository":{"id":38290670,"uuid":"72751841","full_name":"Fishdrowned/ssl","owner":"Fishdrowned","description":"Self-signed Wildcard SSL Certificate Generator","archived":false,"fork":false,"pushed_at":"2024-07-26T21:37:13.000Z","size":172,"stargazers_count":526,"open_issues_count":5,"forks_count":181,"subscribers_count":13,"default_branch":"master","last_synced_at":"2025-03-28T09:04:12.747Z","etag":null,"topics":["certificate","ssl","wildcard"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Fishdrowned.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-11-03T14:10:40.000Z","updated_at":"2025-03-24T01:55:34.000Z","dependencies_parsed_at":"2024-12-07T03:15:30.651Z","dependency_job_id":null,"html_url":"https://github.com/Fishdrowned/ssl","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fishdrowned%2Fssl","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fishdrowned%2Fssl/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fishdrowned%2Fssl/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fishdrowned%2Fssl/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Fishdrowned","download_url":"https://codeload.github.com/Fishdrowned/ssl/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247156060,"owners_count":20893160,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate","ssl","wildcard"],"created_at":"2024-11-12T14:24:40.702Z","updated_at":"2025-04-04T10:06:21.560Z","avatar_url":"https://github.com/Fishdrowned.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 自签泛域名证书\n此工具用于颁发泛域名证书，方便开发环境调试。\n\n请勿用于生产环境，生产环境还是购买正式的证书。  \n或者到 [Let's Encrypt](https://letsencrypt.org/) 可以申请到免费证书  \n（支持多域名和泛域名）。\n\n## 优点\n1. 你可以创建任意网站证书，只需导入一次根证书，无需多次导入；\n1. 减少重复又无谓的组织信息输入，创建证书时只需要输入域名；\n1. 泛域名证书可以减少 `nginx` 配置，例如你要模拟 CDN：  \n假设你的项目网站是 `example.dev`，CDN 网站设置为 `cdn.example.dev`，  \n你只需在 `nginx` 里面配置一个网站，`server_name` 同时填写  `example.dev`  \n和 `cdn.example.dev`，它们可以使用同一个 `*.example.dev` 的证书。\n1. 现在你只需要一个证书，就可以搞定所有项目网站！\n\n使用 `SAN` 来支持多域名和泛域名：\n```ini\nsubjectAltName=DNS:*.one.dev,DNS:one.dev,DNS:*.two.dev,DNS:two.dev,DNS:*.three.dev,DNS:three.dev\n```\n\n## 系统要求\n1. Linux，openssl\n1. 事先用 `hosts` 或者 `dnsmasq` 解析你本地开发的域名，  \n例如把 `example.dev` 指向 `127.0.0.1`\n\n## 使用\n```bash\n./gen.cert.sh \u003cdomain\u003e [\u003cdomain2\u003e] [\u003cdomain3\u003e] [\u003cdomain4\u003e] ...\n```\n把 `\u003cdomain\u003e` 替换成你的域名，例如 `example.dev`\n\n运行的输出像这样：\n\n![Output Screen](docs/output.png)\n\n如果有多个项目网站，可以把所有网站都加上去，用空格隔开。\n\n生成的证书位于：\n```text\nout/\u003cdomain\u003e/\u003cdomain\u003e.crt\nout/\u003cdomain\u003e/\u003cdomain\u003e.bundle.crt\n```\n\n证书有效期是 2 年，你可以修改 `ca.cnf` 来修改这个年限。\n\n根证书位于：  \n`out/root.crt`  \n成功之后，把根证书导入到操作系统里面，信任这个证书。\n\n根证书的有效期是 20 年，你可以修改 `gen.root.sh` 来修改这个年限。\n\n证书私钥位于：  \n`out/cert.key.pem`\n\n其中 `\u003cdomain\u003e.bundle.crt` 是已经拼接好 CA 的证书，可以添加到 `nginx` 配置里面。  \n然后你就可以愉快地用 `https` 来访问你本地的开发网站了。\n\n## 清空\n你可以运行 `flush.sh` 来清空所有历史，包括根证书和网站证书。\n\n## 配置\n你可以修改 `ca.cnf` 来修改你的证书年限。\n```ini\ndefault_days    = 730\n```\n\n可以修改 `gen.root.sh` 来自定义你的根证书名称和组织。\n\n也可以修改 `gen.cert.sh` 来自定义你的网站证书组织。\n\n## 参考 / 致谢\n[Vault and self signed SSL certificates](http://dunne.io/vault-and-self-signed-ssl-certificates)\n\n[利用OpenSSL创建自签名的SSL证书备忘](http://wangye.org/blog/archives/732/)\n\n[Provide subjectAltName to openssl directly on command line](http://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-command-line)\n\n## 关于 Let's Encrypt 客户端\n官方客户端 `certbot` [太复杂了](https://github.com/Neilpang/acme.sh/issues/386)，推荐使用 [acme.sh](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)。\n\n## 关于 .dev 域名\n[Chrome to force .dev domains to HTTPS via preloaded HSTS](https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/) ([2017-9-16](https://chromium-review.googlesource.com/c/chromium/src/+/669923))\n\n## 关于 Chrome 信任证书问题\n看到有人反映 Chrome 下无法信任证书，可参考 [这个文档](docs/chrome-trust.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffishdrowned%2Fssl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffishdrowned%2Fssl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffishdrowned%2Fssl/lists"}