自签名证书

openssl genrsa -out myserver.key 2048

csr.conf

[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
req_extensions     = req_ext
distinguished_name = dn

[ dn ]
C  = CN
ST = Shanghai
L  = Shanghai
O  = MyCustomOrganization
OU = Dev Department
CN = example.com

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = example.com
IP.1  = 192.168.3.12

字段	含义	举例
O	组织名	MyCompany
OU	部门名	Dev Team
CN	主域名	example.com
DNS.*	SAN 域名	www.example.com
IP.*	IP 地址	192.168.1.10

生成 CSR（使用配置文件）

openssl req -new -key myserver.key -out myserver.csr -config csr.conf

生成自签名证书（仅测试用）
openssl x509 -req -in myserver.csr -signkey myserver.key
-out myserver.crt -days 365 -extensions req_ext -extfile csr.conf

server {
    listen 443 ssl;
    server_name localhost;

    ssl_certificate     /etc/nginx/ssl/myserver.crt;
    ssl_certificate_key /etc/nginx/ssl/myserver.key;

    root /var/www/html;
    index index.html;
}