https://help.aliyun.com/document_detail/160093.html

如果是自签名的证书，那需要生成根证书
=生成根证书=
生成根私钥
openssl genrsa -out root.key 2048

生成根的csr文件
openssl req -new -out root.csr -key root.key

Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:sh
Locality Name (eg, city) [Default City]:sh
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your servers hostname) []:root
Email Address []:[]
A challenge password []:
An optional company name []:

根据csr文件和私钥生成证书
openssl x509 -req -in root.csr -out root.crt -signkey root.key -CAcreateserial -days 3650

=================================================================================

=server================
=生成服务端证书=
openssl genrsa -out server.key 2048

openssl req -new -out server.csr -key server.key

Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:sh
Locality Name (eg, city) [Default City]:sh
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your servers hostname) []:
Email Address []:[]
A challenge password []:
An optional company name []:

//服务端证书 使用根证书进行签名认证
openssl x509 -req -in server.csr -out server.crt -signkey server.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650

=================================================================================

生成pfx文件：
openssl pkcs12 -export -in test.pem -inkey server.key -out test.pfx -passout pass:123456