证书颁发机构在 Linux 中有效但在 MacOS 中失败

Question

我想创建一个自签名的根证书颁发机构，以便该 CA 签名的证书受到信任该 CA 的操作系统的信任。

按照几个不同的指南操作后，我成功生成了可在 Linux 机器上运行的证书颁发机构。但是，在将相同的生成过程应用于我的 Mac 时失败了。

generate.sh下面是生成 CA 和服务器证书的脚本（ ）：

#!/bin/sh

mkdir -p ./out

# CA configuration
openssl genrsa -out ./out/CA.key 2048
openssl req -x509 \
    -new \
    -nodes \
    -key ./out/CA.key \
    -sha256 -days 365 \
    -subj "/C=NA/ST=NA/L=NA/O=org/OU=orgunit/CN=special-name"\
    -out ./out/CA.pem

# server certificate
openssl genrsa -out ./out/server.key 2048
openssl req -new -key ./out/server.key \
    -subj "/C=NA/ST=NA/L=NA/O=org/OU=orgunit/CN=special-name"\
    -out ./out/server.csr
    
echo "extendedKeyUsage = serverAuth
subjectAltName=DNS:localhost" | openssl x509 -req -in ./out/server.csr \
    -CA ./out/CA.pem \
    -CAkey ./out/CA.key \
    -CAcreateserial \
    -out ./out/server.crt \
    -days 825 \
    -sha256 \
    -extfile /dev/stdin > /dev/null

我花了一些时间试图弄清楚发生了什么，但网上的每个解决方案似乎都不同。

以下是生成和测试证书的过程：

./generate.sh
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./out/CA.pem
docker build -t cert-test .
docker run -d -p 443:443 --name cert-test cert-test
curl https://localhost:443

服务器证书被加载到由此Dockerfile 创建的容器中：

FROM nginx:latest

COPY ./nginx/nginx.conf /etc/nginx/conf.d/
COPY ./out/server.crt /etc/ssl/certs/
COPY ./out/server.key /etc/ssl/private

EXPOSE 443
CMD ["nginx", "-g", "daemon off;"]

随附./nginx/nginx.conf：

server {
    listen              443 ssl;
    server_name         localhost;
    ssl_certificate     /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        root    /usr/share/nginx/html;
        index   index.html index.html;
    }
}

所有这些都可以在证书混乱。

预期结果：curl https://localhost:443返回 nginx 欢迎页面。

实际结果：curl https://localhost:443不返回 nginx 欢迎页面，而是指出该网站不安全/无效：

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

为什么这个过程在 ios/macos 上会失败，我该如何解决？我已经仔细检查过了iOS 13 和 macOS 10.15 中受信任证书的要求， 提前致谢。