werkzeug 中 serving 中的一段代码，注释好像有亮点。。。。

def generate_adhoc_ssl_pair(cn=None):
from random import random
crypto = _get_openssl_crypto_module()

# pretty damn sure that this is not actually accepted by anyone
if cn is None:
cn = '*'

cert = crypto.X509()
cert.set_serial_number(int(random() * sys.maxsize))
cert.gmtime_adj_notBefore(0)
cert.gmtime_adj_notAfter(60 * 60 * 24 * 365)

subject = cert.get_subject()
subject.CN = cn
subject.O = 'Dummy Certificate'

issuer = cert.get_issuer()
issuer.CN = 'Untrusted Authority'
issuer.O = 'Self-Signed'

pkey = crypto.PKey()
pkey.generate_key(crypto.TYPE_RSA, 2048)
cert.set_pubkey(pkey)
cert.sign(pkey, 'sha256')

return cert, pkey