PS C:Usersabcfyprojects> mkcertUsing the local CA at "C:UsersabcfyAppDataLocalmkcert" Usage of mkcert: $ mkcert -install Install the local CA in the system trust store. $ mkcert example.org Generate "example.org.pem" and "example.org-key.pem". $ mkcert example.com myapp.dev localhost 127.0.0.1 ::1 Generate "example.com+4.pem" and "example.com+4-key.pem". $ mkcert "*.example.it" Generate "_wildcard.example.it.pem" and "_wildcard.example.it-key.pem". $ mkcert -uninstall Uninstall the local CA (but do not delete it).For more options, run "mkcert -help".
$ mkcert -installUsing the local CA at "C:UsersabcfyAppDataLocalmkcert" ✨
仅仅这么一条简单的命令，就帮助我们将 mkcert 使用的根证书加入了本地可信 CA 中，以后由该 CA 签发的证书在本地都是可信的。
在 Windows 的可信 CA 列表可以找到该证书
生成自签证书
生成自签证书的命令十分简单:
代码语言：javascript代码运行次数：0运行复制
mkcert domain1 [domain2 [...]]
直接跟多个要签发的域名或 ip 就行了，比如签发一个仅本机访问的证书(可以通过 127.0.0.1 和 localhost，以及 ipv6 地址::1 访问)
代码语言：javascript代码运行次数：0运行复制
mkcert localhost 127.0.0.1 ::1Using the local CA at "C:UsersabcfyAppDataLocalmkcert" Created a new certificate valid for the following names ? - "localhost" - "127.0.0.1" - "::1"The certificate is at "./localhost+2.pem" and the key at "./localhost+2-key.pem"
通过输出，我们可以看到成功生成了 localhost+2.pem 证书文件和 localhost+2-key.pem 私钥文件，只要在 web server 上使用这两个文件就可以了。
-cert-file FILE, -key-file FILE, -p12-file FILECustomize the output paths.-clientGenerate a certificate for client authentication.-ecdsaGenerate a certificate with an ECDSA key.-pkcs12Generate a ".p12" PKCS #12 file, also know as a ".pfx" file,containing certificate and key for legacy applications.-csr CSRGenerate a certificate based on the supplied CSR. Conflicts withall other flags and arguments except -install and -cert-file.
pem 证书生成
不需要额外的任何操作，使用
mkcert domain.com
，即可生成
domain.com.pem
和
domain.com-key.pem
pfx 证书生成
密码：changeit
代码语言：javascript代码运行次数：0运行复制
C:Usersalbertxiao>mkcert -pkcs12 *.example.comUsing the local CA at "C:UsersalbertxiaoAppDataLocalmkcert" Created a new certificate valid for the following names ? - "*.example.com"Reminder: X.509 wildcards only go one level deep, so this won't match a.b.example.com ℹ️The PKCS#12 bundle is at "./_wildcard.example.com.p12" The legacy PKCS#12 encryption password is the often hardcoded default "changeit" ℹ️
如果期望我们自签证书在局域网内使用，以上三个条件都需要满足。很明显自签证书一定可以满足证书在有效期内，那么需要保证后两条。我们签发的证书必须匹配浏览器的地址栏，比如局域网的 ip 或者域名，此外还需要信任 CA。
我们先重新签发一下证书，加上本机的局域网 ip 认证:
代码语言：javascript代码运行次数：0运行复制
mkcert localhost 127.0.0.1 ::1 192.168.31.170Using the local CA at "C:UsersabcfyAppDataLocalmkcert" Created a new certificate valid for the following names ? - "localhost" - "127.0.0.1" - "::1" - "192.168.31.170"The certificate is at "./localhost+3.pem" and the key at "./localhost+3-key.pem"
微信扫一扫 
支付宝扫一扫 
