六、运行“nmake -f ms\ntdll.mak install”安装编译后的OpenSSL到指定目录。
七、查看安装结果C:\usr\local\ssl或C:\openssl-0.9.8.e下包含了三个文件夹Bin、include、lib。bin下包括openssl.exe（openssl指令程序）、ssleay32.dll（ssl协议动态库）、libeay32.dll（密码算法库）。lib下包括libeay32.lib，ssleay32.lib。Include目录包括了OpenSSL开发设计的头文件。
至此，OpenSSL在windows下编译完成了。
最后一步编译时可能出现错误：“NMAKE : fatal error U1077: 'ml' : return code '0x1' Stop.”，产生这种错误的可能原因是vc6的bin目录下没有ml.exe这个文件。该文件包含在MASM程序中。我的解决办法是到网上下载了一个MASM程序(http://www.masm32.com/masmdl.htm)，安装上之后把ml.exe拷贝到VC6的bin目录下即可解决。
二．生成证书和秘钥
打开openssl.exe文件输入命令
1. 生成RSA密钥的方法
key一般分为public key和private key,在openssl中,private key中包含了public key的信息,所以public key不需要单独创建. 如何创建一个RSA key?
openssl.exe genrsa -des3 -out privkey.pem 2048 (需要添加密码保护)
这个命令会生成一个2048位的密钥，同时有一个des3方法加密的密码，如果你不想要每次都输入密码，可以改成：
openssl.exe genrsa -out privkey.pem 2048
建议用2048位密钥，少于此可能会不安全或很快将不安全。
2. 生成一个证书请求
openssl req -new -key privkey.pem -outcert.csr
这个命令将会生成一个证书请求，当然，用到了前面生成的密钥privkey.pem文件
这里将生成一个新的文件cert.csr，即一个证书请求文件。
3. 生成证书
拿到上面的证书请求文件，去数字证书颁发机构（即CA）申请一个数字证书。CA会给你一个新的文件cacert.pem，那才是你的数字证书。
如果是自己做测试，那么证书的申请机构和颁发机构都是自己。就可以用下面这个命令来生成证书：
openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095
这个命令将用上面生成的密钥privkey.pem生成一个数字证书cacert.pem
参考文档：http://blog.chinaunix.net/uid-20479991-id-216269.html
http://blog.csdn.net/zh516846937/article/details/40188065
http://blog.sina.com.cn/s/blog_4913c1f3010008r7.html
http://my.oschina.net/sad7girl/blog/73711
1.生成X509格式的CA自签名证书
$openssl req -new -x509 -keyout ca.key -out ca.crt
2.生成服务端的私钥(key文件)及csr文件
$openssl genrsa -des3 -out server.key 1024
$openssl req -new -key server.key -out server.csr
3.生成客户端的私钥(key文件)及csr文件
$openssl genrsa -des3 -out client.key 1024
$openssl req -new -key client.key -out client.csr
4.用生成的CA的证书为刚才生成的server.csr,client.csr文件签名
$openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key
$openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key
5.生成p12格式证书
$openssl pkcs12 -export -inkey client.key -in client.crt -out client.pfx
$openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx
6.生成pem格式证书
有时需要用到pem格式的证书，可以用以下方式合并证书文件（crt）和私钥文件（key）来生成
$cat client.crt client.key> client.pem
$cat server.crt server.key > server.pem
7.PFX文件转换为X509证书文件和RSA密钥文件
$openssl pkcs12 -in server.pfx -nodes -out server.pem
$openssl rsa -in server.pem -out server2.key
$openssl x509 -in server.pem -out server2.crt
这样生成服务端证书：ca.crt, server.key, server.crt, server.pem, server.pfx，客户端证书：ca.crt, client.key, client.crt, client.pem, client.pfx
C:\CA256>openssl genrsa -aes256 -out rootca.key 8192
Loading 'screen' into random state - done
Generating RSA private key, 8192 bit long modulus
......................++
...........................................++
e is 65537 (0x10001)
Enter pass phrase for rootca.key:
Verifying - Enter pass phrase for rootca.key:
C:\CA256>openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt
Enter pass phrase for rootca.key:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:sichuan
Locality Name (eg, city) []:chengdu
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Root Bitnum CA
Organizational Unit Name (eg, section) []:bitnum
Common Name (e.g. server FQDN or YOUR name) []:Root Bitnum CA
Email Address []:Root Bitnum CA
C:\CA256>cd C:\C256
C:\C256>openssl genrsa -out server-key.pem 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
...++++++
.++++++
e is 65537 (0x10001)
C:\C256>openssl req -new -sha256 -out server-req.csr -key server-key.pem
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:sichuan
Locality Name (eg, city) []:chengdu
Organization Name (eg, company) [Internet Widgits Pty Ltd]:bitnun server
Organizational Unit Name (eg, section) []:bitnun
Common Name (e.g. server FQDN or YOUR name) []:192.168.1.116
Email Address []:192.168.1.116
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:bitnum
C:\C256>openssl x509 -req -sha256 -in server-req.csr -out server-cert.pem -signkey server-key.pem -CA rootca.crt -CAkey rootca.key -CAcreateserial -days 3650
Loading 'screen' into random state - done
Signature ok
subject=/C=CN/ST=sichuan/L=chengdu/O=bitnun server/OU=bitnun/CN=192.168.1.116/emailAddress=192.168.1.116
Getting Private key
Getting CA Private Key
Enter pass phrase for rootca.key:
C:\C256>openssl pkcs12 -export -clcerts -in server-cert.pem -inkey server-key.pem -out server.p12
Loading 'screen' into random state - done
Enter Export Password:
Verifying - Enter Export Password:
C:\C256>