备注:
certtool的用法

1. 生成PKCS#10格式的证书请求:
   --generate-request --outfile request.pem
2. 生成自签名的CA根证书:
   --generate-self-signed
3. 签署普通证书:
   --generate-certificate
   --load-request request.pem
   --load-ca-privkey="pkcs11:model=TPM2;object={LABEL};type=public"
   --load-ca-certificate=ca-cert.pem
4. 生成CRL证书吊销列表:
   --generate-crl

例子

p11tool --list-privkeys pkcs11:model=TPM2
LABEL=000B6BE4EB4A8835675AFF0FFFF9CCF7C8AFAF72806EF40A864F6FE498A3A5808CB4

# 制作一个数字证书申请(request.pem)
certtool --generate-request \--load-privkey "pkcs11:model=TPM2;object=${LABEL};type=private" \--load-pubkey "pkcs11:model=TPM2;object=${LABEL};type=public" \--template cert.cfg \--outfile request.pem

# 制作一个自签名的根证书
certtool --generate-self-signed \--load-privkey "pkcs11:model=TPM2;object=${LABEL};type=private" \--load-pubkey "pkcs11:model=TPM2;object=${LABEL};type=public" \--template cert.cfg \--outfile self-signed-cert.der --outder

# 模板文件: cert.cfg
# -------------------
# X.509 Certificate options
#
# DN options# The organization of the subject.
organization = "my_company_name"# The organizational unit of the subject.
#unit = ""# The locality of the subject.
#locality = ""# The state of the certificate owner.
# 省份/州/行政区划
#state = ""# The country of the subject. Two letter code.
# 国家代码: 中国=CN 美国=US
country = CN# The common name of the certificate owner.
# 证书持有者名称(Common Name)
cn = "刘群"# A user id of the certificate owner.
#uid = "liuqun"# Set domain components
#dc = "name"
#dc = "domain"# If the supported DN OIDs are not adequate you can set
# any OID here.
# For example set the X.520 Title and the X.520 Pseudonym
# by using OID and string pairs.
#dn_oid = "2.5.4.12 Dr."
#dn_oid = "2.5.4.65 jackal"# An alternative way to set the certificate's distinguished name directly
# is with the "dn" option. The attribute names allowed are:
# C (country), street, O (organization), OU (unit), title, CN (common name),
# L (locality), ST (state), placeOfBirth, gender, countryOfCitizenship,
# countryOfResidence, serialNumber, telephoneNumber, surName, initials,
# generationQualifier, givenName, pseudonym, dnQualifier, postalCode, name,
# businessCategory, DC, UID, jurisdictionOfIncorporationLocalityName,
# jurisdictionOfIncorporationStateOrProvinceName,
# jurisdictionOfIncorporationCountryName, XmppAddr, and numeric OIDs.
#dn = "cn = Nikos,st = New Something,C=GR,surName=Mavrogiannopoulos,2.5.4.9=Arkadias"# The serial number of the certificate
# Comment the field for a time-based serial number.
serial = 007# In how many days, counting from today, this certificate will expire.
# Use -1 if there is no expiration date.
expiration_days = 700# Alternatively you may set concrete dates and time. The GNU date string
# formats are accepted. See:
# http://www.gnu.org/software/tar/manual/html_node/Date-input-formats.html#activation_date = "2004-02-29 16:21:42"
#expiration_date = "2025-02-29 16:24:41"# X.509 v3 extensions# A dnsname in case of a WWW server.
#dns_name = "www.none.org"
#dns_name = "www.morethanone.org"# An othername defined by an OID and a hex encoded string
#other_name = "1.3.6.1.5.2.2 302ca00d1b0b56414e5245494e2e4f5247a11b3019a006020400000002a10f300d1b047269636b1b0561646d696e"
#other_name_utf8 = "1.2.4.5.6 A UTF8 string"
#other_name_octet = "1.2.4.5.6 A string that will be encoded as ASN.1 octet string"# Allows writing an XmppAddr Identifier
#xmpp_name = juliet@im.example.com# Names used in PKINIT
#krb5_principal = user@REALM.COM
#krb5_principal = HTTP/user@REALM.COM# A subject alternative name URI
#uri = "http://www.example.com"# An IP address in case of a server.
#ip_address = "192.168.1.1"# An email in case of a person
email = "none@none.org"
# TLS feature (rfc7633) extension. That can is used to indicate mandatory TLS
# extension features to be provided by the server. In practice this is used
# to require the Status Request (extid: 5) extension from the server. That is,
# to require the server holding this certificate to provide a stapled OCSP response.
# You can have multiple lines for multiple TLS features.# To ask for OCSP status request use:
#tls_feature = 5# Challenge password used in certificate requests
#challenge_password = 123456# Password when encrypting a private key
#password = secret# An URL that has CRLs (certificate revocation lists)
# available. Needed in CA certificates.
#crl_dist_points = "http://www.getcrl.crl/getcrl/"# Whether this is a CA certificate or not
# 本证书是否作为 CA 证书
#ca# Subject Unique ID (in hex)
#subject_unique_id = 00153224# Issuer Unique ID (in hex)
#issuer_unique_id = 00153225#### 密钥用途限定
#### Key usage# The following key usage flags are used by CAs and end certificates# Whether this certificate will be used to sign data (needed
# in TLS DHE ciphersuites). This is the digitalSignature flag
# in RFC5280 terminology.
signing_key# Whether this certificate will be used to encrypt data (needed
# in TLS RSA ciphersuites). Note that it is preferred to use different
# keys for encryption and signing. This is the keyEncipherment flag
# in RFC5280 terminology.
encryption_key# Whether this key will be used to sign other certificates. The
# keyCertSign flag in RFC5280 terminology.
#cert_signing_key# Whether this key will be used to sign CRLs. The
# cRLSign flag in RFC5280 terminology.
#crl_signing_key# The keyAgreement flag of RFC5280. It's purpose is loosely
# defined. Not use it unless required by a protocol.
#key_agreement# The dataEncipherment flag of RFC5280. It's purpose is loosely
# defined. Not use it unless required by a protocol.
#data_encipherment# The nonRepudiation flag of RFC5280. It's purpose is loosely
# defined. Not use it unless required by a protocol.
#non_repudiation#### 密钥用途扩展项
#### Extended key usage (key purposes)# The following extensions are used in an end certificate
# to clarify its purpose. Some CAs also use it to indicate
# the types of certificates they are purposed to sign.# Whether this certificate will be used for a TLS client;
# this sets the id-kp-serverAuth (1.3.6.1.5.5.7.3.1) of
# extended key usage.
#tls_www_client# Whether this certificate will be used for a TLS server;
# This sets the id-kp-clientAuth (1.3.6.1.5.5.7.3.2) of
# extended key usage.
#tls_www_server# Whether this key will be used to sign code. This sets the
# id-kp-codeSigning (1.3.6.1.5.5.7.3.3) of extended key usage
# extension.
#code_signing_key# Whether this key will be used to sign OCSP data. This sets the
# id-kp-OCSPSigning (1.3.6.1.5.5.7.3.9) of extended key usage extension.
#ocsp_signing_key# Whether this key will be used for time stamping. This sets the
# id-kp-timeStamping (1.3.6.1.5.5.7.3.8) of extended key usage extension.
#time_stamping_key# Whether this key will be used for email protection. This sets the
# id-kp-emailProtection (1.3.6.1.5.5.7.3.4) of extended key usage extension.
#email_protection_key# Whether this key will be used for IPsec IKE operations (1.3.6.1.5.5.7.3.17).
# 能否用于 VPN (IPSec IKEv1/IKEv2) 身份认证和密钥协商
#ipsec_ike_key### adding custom key purpose OIDs# for microsoft smart card logon
# key_purpose_oid = 1.3.6.1.4.1.311.20.2.2# for email protection
# key_purpose_oid = 1.3.6.1.5.5.7.3.4# for any purpose (must not be used in intermediate CA certificates)
# key_purpose_oid = 2.5.29.37.0### end of key purpose OIDs### Adding arbitrary extensions
# This requires to provide the extension OIDs, as well as the extension data in
# hex format. The following two options are available since GnuTLS 3.5.3.
#add_extension = "1.2.3.4 0x0AAB01ACFE"# As above but encode the data as an octet string
#add_extension = "1.2.3.4 octet_string(0x0AAB01ACFE)"# For portability critical extensions shouldn't be set to certificates.
#add_critical_extension = "5.6.7.8 0x1AAB01ACFE"# When generating a certificate from a certificate
# request, then honor the extensions stored in the request
# and store them in the real certificate.
#honor_crq_extensions# Alternatively only specific extensions can be copied.
#honor_crq_ext = 2.5.29.17
#honor_crq_ext = 2.5.29.15# Path length contraint. Sets the maximum number of
# certificates that can be used to certify this certificate.
# (i.e. the certificate chain length)
#path_len = -1
#path_len = 2# OCSP URI
# ocsp_uri = http://my.ocsp.server/ocsp# CA issuers URI
# ca_issuers_uri = http://my.ca.issuer# Certificate policies
#policy1 = 1.3.6.1.4.1.5484.1.10.99.1.0
#policy1_txt = "This is a long policy to summarize"
#policy1_url = http://www.example.com/a-policy-to-read#policy2 = 1.3.6.1.4.1.5484.1.10.99.1.1
#policy2_txt = "This is a short policy"
#policy2_url = http://www.example.com/another-policy-to-read### 限定条件 Name constraints# DNS
#nc_permit_dns = example.com
#nc_exclude_dns = test.example.com# EMAIL
#nc_permit_email = "nmav@ex.net"# Exclude subdomains of example.com
#nc_exclude_email = .example.com# Exclude all e-mail addresses of example.com
#nc_exclude_email = example.com# IP
#nc_permit_ip = 192.168.0.0/16
#nc_exclude_ip = 192.168.5.0/24
#nc_permit_ip = fc0a:eef2:e7e7:a56e::/64# Options for proxy certificates
#proxy_policy_language = 1.3.6.1.5.5.7.21.1# Options for generating a CRL# The number of days the next CRL update will be due.
# next CRL update will be in 43 days
#crl_next_update = 43# this is the 5th CRL by this CA
# Comment the field for a time-based number.
#crl_number = 5# Specify the update dates more precisely.
#crl_this_update_date = "2004-02-29 16:21:42"
#crl_next_update_date = "2025-02-29 16:24:41"# The date that the certificates will be made seen as
# being revoked.
#crl_revocation_date = "2025-02-29 16:24:41"