Development Self-signed SSL with local trust

0-self-signed-ssl.md

Create self-signed certificate for nginx/apache

chmod +x ./*.sh
./1-create-cert.sh
## add to trusted certs for macOS
./2-osx-trust-cert.sh
echo "See sample nginx config"
cat 3-sample-nginx.conf
echo "Add example.com into your /etc/hosts"
echo "127.0.0.1 example.com"

1-create-cert.sh

#!/bin/sh

function gen(){
    domain=${1:-example.com}
    fileName=${3:-example.com}
    days=${2:-3650}

    echo "Create ssl for $domain in $days days"

    openssl genrsa -des3 -out ${fileName}.key 2048
    cat <<-EOF >/tmp/sample_crt_cfg.txt
    [req]
    distinguished_name = req_distinguished_name
    req_extensions = v3_req
    prompt = no
    [req_distinguished_name]
    C = US
    ST = VA
    L = Example City
    O = Example Company
    OU = Example Unit
    CN = ${domain}
    [v3_req]
    basicConstraints=CA:FALSE
    keyUsage=digitalSignature,keyEncipherment
    extendedKeyUsage=serverAuth,clientAuth
    subjectAltName = @alt_names
    [alt_names]
    DNS.1 = *.example.com
    EOF

    openssl req -new -x509 -key ${fileName}.key -extensions 'v3_req' -out ${fileName}.cert -days $days -config /tmp/sample_crt_cfg.txt

    # Remove passphase for local running
    openssl rsa -in ${fileName}.key -out ${fileName}.key

    # Verify
    openssl x509 -noout -text -in ${fileName}.cert
    openssl rsa -noout -text -in ${fileName}.key
    echo "Output: ${fileName}.cert ${fileName}.key"
}

#replace with your self-signed domain if you want
gen 'example.com' '3650' 'example.com'

2-osx-trust-cert.sh

#!/bin/sh
# your cert file was create by above scrips.
cert=${1:-example.com.cert}
sudo security remove-trusted-cert -d  $cert
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $cert

3-sample-nginx.conf

#user  nobody;
worker_processes  1;
error_log  logs/error.log;
pid        logs/nginx.pid;
events {
	worker_connections  1024;
}

http {
	include       mime.types;
	default_type  application/octet-stream;
	access_log  logs/access.log ;

	sendfile        on;
	keepalive_timeout  60;
  
	server {
		listen			 8443 ssl default;
		server_name  _ ;
		ssl_certificate      ssl/example.com.cert;
		ssl_certificate_key  ssl/example.com.key;
		location / {
            ## 404 or point to static/alias/root
			return 404;
		}
	}
  
    ## Your virtual host for each domain here
    ## could seperate to a file conf.d/example.com.conf
	server {
		listen			 8443 ssl;    
		server_name  example.com;
        ## simple config for dev only
        ## relative path to current nginx working dir
		ssl_certificate      ssl/example.com.cert;
		ssl_certificate_key  ssl/example.com.key;
        ssl_session_cache    shared:SSL:1m;
		ssl_session_timeout  5m;
		ssl_ciphers  HIGH:!aNULL:!MD5;
		ssl_prefer_server_ciphers  on;    
        location / {
            ## pass to php/tomcat server
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
		}
	}
    ## uncomment to include conf if you want
	#include conf.d/*.conf

}

4-img-browser.png