
rm -rf ./ca*
rm -rf ./client*
rm -rf ./server*

#1.生成CA证书的私钥，并使用私钥，签名CA证书
ipsec pki --gen --outform pem > ca.pem
ipsec pki --self --in ca.pem --dn "C=CN, O=VPN, CN=StrongSwanCA_119.28.134.86" --ca --lifetime 3650 --outform pem >ca.cert.pem


#2.生成服务器证书所需的私钥,并用CA证书签发服务器证书
ipsec pki --gen --outform pem > server.pem  
ipsec pki --pub --in server.pem | ipsec pki --issue --lifetime 1200 --cacert ca.cert.pem \
    --cakey ca.pem --dn "C=CN, O=VPN, CN=119.28.134.86" \
    --san="119.28.134.86" --flag serverAuth --flag ikeIntermediate \
    --outform pem > server.cert.pem

#3.生成客户端证书
ipsec pki --gen --outform pem > client.pem
ipsec pki --pub --in client.pem | ipsec pki --issue --cacert ca.cert.pem \
    --cakey ca.pem --dn "C=CN, O=VPN, CN=VPNClient_119.28.134.86" \
    --outform pem > client.cert.pem

#4.生成 pkcs12 证书 pkcs12 证书用来导入手机或电脑的

openssl pkcs12 -export -inkey client.pem -in client.cert.pem -name "VPNClient_119.28.134.86"\
         -certfile ca.cert.pem -caname "StrongSwanCA_119.28.134.86"  -out client.cert.p12


#mkdir /etc/strongswan
#mkdir /etc/strongswan/ipsec.d
#mkdir /etc/strongswan/ipsec.d/cacerts/
#mkdir /etc/strongswan/ipsec.d/private/
#mkdir /etc/strongswan/ipsec.d/certs/

cp -r -f ca.cert.pem     /usr/local/etc/ipsec.d/cacerts/
cp -r -f server.cert.pem /usr/local/etc/ipsec.d/certs/
cp -r -f server.pem      /usr/local/etc/ipsec.d/private/
cp -r -f client.cert.pem /usr/local/etc/ipsec.d/certs/
cp -r -f client.pem      /usr/local/etc/ipsec.d/private/

