Python中使用RSA算法生成数字证书

在Python中使用RSA算法生成数字证书需要借助于cryptography库，下面是一个使用RSA算法生成数字证书的示例代码：

from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.backends import default_backend

# 生成RSA私钥
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()
)

# 生成CSR（证书签名请求）
subject = issuer = x509.Name([
    x509.NameAttribute(NameOID.COUNTRY_NAME, u"CN"),
    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u"Beijing"),
    x509.NameAttribute(NameOID.LOCALITY_NAME, u"Beijing"),
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, u"Organization"),
    x509.NameAttribute(NameOID.COMMON_NAME, u"www.example.com")
])
builder = x509.CertificateSigningRequestBuilder().subject_name(
    subject
).add_extension(
    x509.SubjectAlternativeName([
        x509.DNSName(u"example.com"),
        x509.DNSName(u"www.example.com")
    ]),
    critical=False,
)

csr = builder.sign(private_key, hashes.SHA256(), default_backend())

# 生成自签名证书
builder = x509.CertificateBuilder().subject_name(
    subject
).issuer_name(
    issuer
).public_key(
    csr.public_key()
).serial_number(
    x509.random_serial_number()
).not_valid_before(
    datetime.datetime.utcnow()
).not_valid_after(
    datetime.datetime.utcnow() + datetime.timedelta(days=365)
).add_extension(
    x509.SubjectAlternativeName([
        x509.DNSName(u"example.com"),
        x509.DNSName(u"www.example.com")
    ]),
    critical=False
).add_extension(
    x509.BasicConstraints(ca=True, path_length=None),
    critical=True
)

certificate = builder.sign(private_key, hashes.SHA256(), default_backend())

# 保存私钥和证书到文件
with open("private_key.pem", "wb") as f:
    f.write(private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    ))

with open("certificate.pem", "wb") as f:
    f.write(certificate.public_bytes(serialization.Encoding.PEM))

在上面的示例中，首先通过rsa.generate_private_key生成了一个RSA私钥；然后使用私钥生成了证书签名请求（CSR）；接着使用CSR、私钥以及其他一些配置参数生成了自签名证书签发请求；最后将私钥和证书保存到了文件中。

使用这个示例，你可以根据自己的需求生成数字证书，并使用这些证书进行加密、解密和签名等操作。