以前用SSL证书的时候对一些概念了解比较模糊，对x.509、pem、csr等一大堆概念没有一个整体的认识。于是下决心仔细研究一番，接下来会写一系列文章，这是第一篇，先介绍一下CSR。
基本概念
CSR全称Certificate Signing Request（证书请求文件），是证书申请者向证书颁发机构（CA）申请证书时需要提供的文件。里面包含了一些申请者的基本信息，比如Common Name、 Organization等。同时也包含了申请者的公钥。
生成CSR的时候一般也会同时生成一个私钥，和csr是配对生效的，如果私钥丢失，那么这个CSR将不会再起作用。
CA收到申请者的CSR之后会进行一系列操作，比如确认申请者信息之类的。然后用自己的私钥给CSR签名，生成证书文件，颁发给申请者。
CSR需要满足pkcs#10语法标准，详情可以参考RFC2986。
生成方法
首先需要安装openssl，然后：
openssl req -new -keyout z.key -out z.csr
这条命令将会生成一个私钥文件z.key，然后生成对应的CSR，需要填写基本信息，比如：
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BeiJing
Locality Name (eg, city) []:BeiJing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Zzzz
Organizational Unit Name (eg, section) []:dev
Common Name (e.g. server FQDN or YOUR name) []:zqqf16.info
Email Address []:your@email.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
打开z.key文件，可以看到私钥，类似这样的：
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIj6V2J4snMfMCAggA
MBQGCCqGSIb3DQMHBAgCsEw8GV7nDASCBMhm0VvIGGreMAjQne7gx56nv85HLl/T
e0TWboN4PGlq4lmaWJSE9iYolz.....
.....
-----END ENCRYPTED PRIVATE KEY-----
这是用PEM(Privacy Enhanced Mail)格式存储的，内容用Base64编码过。同样的，z.csr文件也是类似的格式：
-----BEGIN CERTIFICATE REQUEST-----
MIIC4jCCAcoCAQAwgYUxCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdCZWlKaW5nMRAw
DgYDVQQHDAdCZWlKaW5nMQ0wCwYDVQQKDARaenp6MQwwCgYDVQQLDANkZXYxFDAS
BgNVBAMMC3pxcWYxNi5p.....
....
-----END CERTIFICATE REQUEST-----
如果想看CSR的内容可以用
openssl req -in z.csr -noout -text
将会输出详细信息
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=CN, ST=BeiJing, L=BeiJing, O=Zzzz, OU=dev, CN=zqqf16.info/emailAddress=your@email.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b6:f8:ce:49:05:00:ff:53:5f:50:1a:00:c9:a1:
b8:4a:1d:19:c6:50:c3:22:11:30:cb:6f:ea:5e:5e:
3b:d9:e1:fa:5f:4b:5a:8a:51:88:1f:82:4f:b9:23:
52:de:80:2e:f4:b7:6a:b8:27:62:e7:3c:c1:7f:ef:
bb:5e:18:87:17:81:a3:11:f5:8b:25:c2:a3:fb:b2:
d9:4b:07:64:5d:93:1e:13:c1:b7:ce:ac:86:42:c2:
be:82:8c:76:d9:57:7e:c3:1d:0d:7c:3c:92:ce:0c:
ed:18:1f:45:83:28:d9:98:00:c1:b2:85:a7:52:4b:
f9:6e:45:f2:76:5f:c1:7d:1e:0d:65:3e:2b:ef:8e:
5f:89:83:7c:33:35:37:5b:40:11:48:4a:ec:b7:11:
4a:67:75:04:7e:d8:e9:68:ee:81:eb:38:70:a2:0d:
4e:d7:42:1c:fe:7e:fc:da:2e:15:69:8e:8f:ed:f6:
48:08:73:d1:65:2c:5b:90:52:ba:3c:62:b7:f5:80:
74:4b:03:34:5e:16:08:9c:3c:9b:85:47:94:3f:85:
ab:4d:d0:cf:7a:4c:ea:fb:50:59:69:2d:f2:93:b6:
44:48:a1:06:2c:6f:8b:f5:89:a3:9c:33:37:17:83:
40:27:3a:c5:e9:5a:57:5f:4a:e7:71:ba:57:7b:97:
e2:09
Exponent: 65537 (0x10001)
Attributes:
challengePassword :unable to print attribute
Signature Algorithm: sha1WithRSAEncryption
01:62:8d:cf:95:9a:99:29:d5:ca:e6:27:19:9f:e6:8f:33:4d:
16:5e:99:d9:1f:e8:bc:bb:0a:c6:8d:0a:35:68:13:b1:33:91:
16:22:be:57:a1:59:13:e2:21:fa:1a:c2:ce:dd:c7:44:f6:53:
ab:ee:bc:4f:78:80:af:37:8d:59:55:5a:cb:9b:3e:8b:dd:9a:
bd:50:22:b5:23:27:98:31:2d:98:05:c4:1c:bf:fa:49:4a:c2:
a7:c6:f7:96:ed:4d:11:e7:75:64:54:e3:e7:a3:c3:3e:81:88:
bb:89:7d:78:e6:06:0b:c4:b7:eb:f1:9f:e8:ff:23:3d:b3:35:
f9:8f:c1:11:a4:72:55:95:3e:e6:38:d0:93:45:21:9e:77:2e:
44:b6:43:58:68:5d:91:3a:5d:d3:50:c8:df:57:ba:2b:03:f2:
43:29:da:9f:2b:c3:f1:10:21:26:b1:5f:bb:b7:9c:0c:1e:da:
ae:62:09:ef:b1:a3:d6:18:6d:aa:3d:52:a2:af:10:50:69:78:
94:26:1c:79:7c:ca:4f:a6:a1:37:82:b7:dd:68:8e:f6:ee:e1:
ec:57:12:44:f5:34:2e:8e:aa:61:91:1f:6a:77:a6:88:fe:9b:
a2:f5:e9:9a:11:ad:2a:31:d6:72:59:7e:e0:78:9f:b4:3f:af:
c7:94:34:7f