安装gmssl:
Download (GmSSL-master.zip), uncompress it and go to the source code folder. On Linux and OS X, run the following commands:
https://github.com/guanzhi/GmSSL.git
$ ./config
$ make
$ sudo make install
PATH=$HOME/work/gmbrowser/usr/local/gmssl/bin:$PATH
LD_LIBRARY_PATH=$HOME/work/gmbrowser/usr/local/gmssl/lib:$LD_LIBRARY_PATH
配置
mkdir certs clr newcerts private
touch index.txt
echo “01” > serial
创建的子目录及文件的含义：
certs：存放已颁发的证书；
newcerts：存放CA指令生成的新证书；
private：存放私钥；
crl：存放已吊销的整数；
index.txt：penSSL定义的已签发证书的文本数据库文件，这个文件通常在初始化的时候是空的；
serial：证书签发时使用的序列号参考文件，该文件的序列号是以16进制格式进行存放的，该文件必须提供并且包含一个有效的序列号。
----------------------------------------------------------------------------------------------------------
国密根证书：
gmssl ecparam -genkey -name sm2p256v1 -out private/root-key1.pem
gmssl req -x509 -sm3 -days 365 -key private/rootkey.pem -out newcerts/rootcert.pem
----------------------------------------------------------------------------------------------------------
国密二级证书：
gmssl ecparam -genkey -name sm2p256v1 -out private/ca-key.pem
gmssl req -new -sm3 -key private/ca-key.pem -out ca-csr.pem
cd ..
gmssl ca -md sm3 -extensions v3_ca -in demoCA/ca-csr.pem -out demoCA/newcerts/ca-cert.pem -days 365 -cert demoCA/newcerts/root-cert1.pem -keyfile demoCA/private/root-key1.pem
----------------------------------------------------------------------------------------------------------
用户证书：
gmssl ecparam -genkey -name sm2p256v1 -out private/user1key.pem
gmssl req -new -sm3 -key private/user1key.pem -out user1csr.pem
cd ..
gmssl ca -in demoCA/user1csr.pem -out demoCA/newcerts/user1cert.pem -days 365 -cert demoCA/newcerts/rootcert.pem -keyfile demoCA/private/rootkey.pem
在签名二级证书和用户证书时，两者的区别:
key usage扩展为Digital Signature, Non-Repudiation, Key Encipherment (e0)，证书可以用来加密和签名
key usage扩展为Digital Signature, Non-Repudiation，没有加密功能，只能用来签名。
gmssl 命令中的-md -batch的作用还未找到。
----------------------------------------------------------------------------------------------------------
查看国密证书：
gmssl x509 -text -in newcerts/sub-cacert.pem -noout
----------------------------------------------------------------------------------------------------------
国密证书合成pfx：
gmssl pkcs12 -export -out your_pfx_certificate.pfx -inkey clientguomikey.key -in clientguomi.crt
----------------------------------------------------------------------------------------------------------
遇到问题：
failed to update database
TXT_DB error number 2
原因：
This thing happens when certificates share common data. You cannot have two
certificates that look otherwise the same.
措施：
删除demoCA下的index.txt,并再touch下