在申请正规的ssl证书之前，需要先在本机生成CSR文件
Login to your server via your terminal client (ssh). At the prompt, type:
登陆ssh，在提示符下输入命令：
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
where server is the name of your server.
这里是server.csr，自己根据自己情况命名。
This will begin the process of generating two files: the Private-Key file for the decryption of your SSL Certificate, and a certificate signing request (CSR) file used to apply for your SSL Certificate. This command will prompt for the following X.509 attributes of the certificate:
这将生成两个文件，一个是私钥文件用于解密你的SSL证书，还有就是用于申请SSL的证书签名请求CSR文件。
在生成过程中有如下提示：
Country Name (C): Use the two-letter code without punctuation for country, for example: US or CA.
State or Province (S): Spell out the state completely; do not abbreviate the state or province name, for example: California.
Locality or City (L): The Locality field is the city or town name, for example: Berkeley.
Organization (O): If your company or department has an &, @, or any other symbol using the shift key in its name, you must spell out the symbol or omit it to enroll, for example: XY & Z Corporation would be XYZ Corportation or XY and Z Corportation.
Organizational Unit (OU): This field is the name of the department or organization unit making the request.
Common Name (CN): The Common Name is the Host + Domain Name. It looks like “www.company.com” or “company.com”.
Please do not enter your email address, challenge password or an optional company name when generating the CSR.
在生成CSR过程中，请不要填写email，强密码和备用公司名
最后将生成server.csr
如果要自认证证书 server.crt
openssl x509 -req -in server.csr -signkey server.key -out server.crt
计算 crt 的 finger print
SHA-256 openssl x509 -noout -fingerprint -sha256 -inform pem -in [certificate-file.crt] SHA-1 openssl x509 -noout -fingerprint -sha1 -inform pem -in [certificate-file.crt] MD5 openssl x509 -noout -fingerprint -md5 -inform pem -in [certificate-file.crt]