K3s生成100年CA证书

查看Openssl版本

openssl version

注意：只需要在第1台执行K3s服务的服务器中执行命令生成证书即可

如果版本大于等于1.1.1

# k3s相关CA证书
mkdir -p /var/lib/rancher/k3s/server/tls
cd /var/lib/rancher/k3s/server/tls
openssl genrsa -out client-ca.key 2048
openssl genrsa -out server-ca.key 2048
openssl genrsa -out request-header-ca.key 2048
openssl req -x509 -new -nodes -key client-ca.key -sha256 -days 36500 -out client-ca.crt -addext keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign -subj '/CN=k3s-client-ca'
openssl req -x509 -new -nodes -key server-ca.key -sha256 -days 36500 -out server-ca.crt -addext keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign -subj '/CN=k3s-server-ca'
openssl req -x509 -new -nodes -key request-header-ca.key -sha256 -days 36500 -out request-header-ca.crt -addext keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign -subj '/CN=k3s-request-header-ca'

#etcd相关CA证书
mkdir -p /var/lib/rancher/k3s/server/tls/etcd
cd /var/lib/rancher/k3s/server/tls/etcd
openssl genrsa -out peer-ca.key 2048
openssl genrsa -out server-ca.key 2048
openssl req -x509 -new -nodes -key peer-ca.key -sha256 -days 36500 -out peer-ca.crt -addext keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign -subj '/CN=k3s-peer-ca'
openssl req -x509 -new -nodes -key server-ca.key -sha256 -days 36500 -out server-ca.crt -addext keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign -subj '/CN=k3s-server-ca'

如果版本小于1.1.1

# k3s相关CA证书
mkdir -p /var/lib/rancher/k3s/server/tls
cd /var/lib/rancher/k3s/server/tls
openssl genrsa -out client-ca.key 2048
openssl genrsa -out server-ca.key 2048
openssl genrsa -out request-header-ca.key 2048
openssl req -x509 -new -nodes -key client-ca.key -sha256 -days 36500 -out client-ca.crt -subj '/CN=k3s-client-ca' -extensions key -config <(echo '[req]'; echo 'distinguished_name=req'; echo '[key]'; echo 'keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign'; echo 'basicConstraints=critical,CA:TRUE';)
openssl req -x509 -new -nodes -key server-ca.key -sha256 -days 36500 -out server-ca.crt -subj '/CN=k3s-server-ca' -extensions key -config <(echo '[req]'; echo 'distinguished_name=req'; echo '[key]'; echo 'keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign'; echo 'basicConstraints=critical,CA:TRUE';)
openssl req -x509 -new -nodes -key request-header-ca.key -sha256 -days 36500 -out request-header-ca.crt -subj '/CN=k3s-request-header-ca' -extensions key -config <(echo '[req]'; echo 'distinguished_name=req'; echo '[key]'; echo 'keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign'; echo 'basicConstraints=critical,CA:TRUE';)

# etcd相关CA证书
mkdir -p /var/lib/rancher/k3s/server/tls/etcd
cd /var/lib/rancher/k3s/server/tls/etcd
openssl genrsa -out peer-ca.key 2048
openssl genrsa -out server-ca.key 2048
openssl req -x509 -new -nodes -key peer-ca.key -sha256 -days 36500 -out peer-ca.crt -subj '/CN=k3s-peer-ca' -extensions key -config <(echo '[req]'; echo 'distinguished_name=req'; echo '[key]'; echo 'keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign'; echo 'basicConstraints=critical,CA:TRUE';)
openssl req -x509 -new -nodes -key server-ca.key -sha256 -days 36500 -out server-ca.crt -subj '/CN=k3s-server-ca' -extensions key -config <(echo '[req]'; echo 'distinguished_name=req'; echo '[key]'; echo 'keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign'; echo 'basicConstraints=critical,CA:TRUE';)