基于CFSSL工具创建CA证书，服务端证书，客户端证书
背景描述
在局域网中部署组件时，想要通过证书来实现身份的认证，确保通信的安全性，可以通过cfssl工具来进行CA证书，服务端证书，客户端证书的创建。
目录
部署cfssl工具
下载，上传cfssl,cfssljson，cfssl-certinfo工具到服务器上
[root@nccztsjb-node-17 data]# ls -ltr
total 35936
-rw-r--r-- 1 root root 15108368 Nov 27 14:07 cfssl_1.5.0_linux_amd64
-rw-r--r-- 1 root root 9663504 Nov 27 14:21 cfssljson_1.5.0_linux_amd64
-rw-r--r-- 1 root root 12021008 Nov 30 11:22 cfssl-certinfo_1.5.0_linux_amd64
增加命令的执行权限，并且增加到相关目录
[root@nccztsjb-node-17 data]# chmod +x cfssl*
[root@nccztsjb-node-17 data]# cp cfssl_1.5.0_linux_amd64 /usr/local/bin/cfssl
[root@nccztsjb-node-17 data]# cp cfssljson_1.5.0_linux_amd64 /usr/local/bin/cfssljson
[root@nccztsjb-node-17 data]# cp cfssl-certinfo_1.5.0_linux_amd64 /usr/local/bin/cfssl-certinfo
[root@nccztsjb-node-17 data]# cfssl version
Version: 1.5.0
Runtime: go1.12.12
备注：此时cfssl工具安装完成。
创建CA根证书
ca根证书主要是用来签发其他的证书
创建ca配置文件
cat >ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "262800h"
},
"profiles": {
"kubernetes": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "262800h"
}
}
}
}
EOF
说明：可以设置默认的签名出来的证书的有效时间。可以同时设置不同的profile用于不同的用途。
创建ca的csr文件
cat > ca-csr.json <<EOF
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "Beijing",
"L": "Beijing",
"O": "DC",
"OU": "System"
}
],
"ca": {
"expiry": "262800h"
}
}
EOF
创建CA证书及私钥
[root@nccztsjb-node-17 data]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca
2020/12/04 14:20:39 [INFO] generating a new CA key and certificate from CSR
2020/12/04 14:20:39 [INFO] generate received request
2020/12/04 14:20:39 [INFO] received CSR
2020/12/04 14:20:39 [INFO] generating key: rsa-2048
2020/12/04 14:20:39 [INFO] encoded CSR
2020/12/04 14:20:39 [INFO] signed certificate with serial number 497233672920328375338343228164630446467151606126
[root@nccztsjb-node-17 data]# ls -l ca*
-rw-r--r-- 1 root root 294 Dec 4 14:13 ca-config.json
-rw-r--r-- 1 root root 1045 Dec 4 14:20 ca.csr
-rw-r--r-- 1 root root 246 Dec 4 14:19 ca-csr.json
-rw------- 1 root root 1675 Dec 4 14:20 ca-key.pem
-rw-r--r-- 1 root root 1310 Dec 4 14:20 ca.pem
ca.pem就是ca的证书，ca-key.pem就是ca的私钥。
创建etcd服务端证书
创建etcd的csr文件
cat >etcd-csr.json <<EOF
{
"CN": "etcd",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "Beijing",
"L": "Beijing",
"O": "DC",
"OU": "System"
}
]
}
EOF
用CA签发etcd证书和私钥
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=kubernetes etcd-csr.json | cfssljson -bare etcd
2020/12/04 14:33:00 [INFO] generate received request
2020/12/04 14:33:00 [INFO] received CSR
2020/12/04 14:33:00 [INFO] generating key: rsa-2048
2020/12/04 14:33:00 [INFO] encoded CSR
2020/12/04 14:33:00 [INFO] signed certificate with serial number 86899219278041222746661164070003623992607015229
2020/12/04 14:33:00 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
[root@nccztsjb-node-17 data]# ls -l etcd*
-rw-r--r-- 1 root root 993 Dec 4 14:33 etcd.csr
-rw-r--r-- 1 root root 201 Dec 4 14:30 etcd-csr.json
-rw------- 1 root root 1679 Dec 4 14:33 etcd-key.pem
-rw-r--r-- 1 root root 1383 Dec 4 14:33 etcd.pem
etcd.csr为etcd的证书请求文件，etcd-key.pem为etcd的私钥，etcd.pem为etcd的证书。至此，etcd的证书签发完成。此证书可以作为etcd的服务端证书来使用。
