Elastic Stack 证书创建
1.创建CA证书
./bin/elasticsearch-certutil ca
# 默认文件名:elastic-stack-ca.p12
2.生成节点使用的证书
./bin/elasticsearch-certutil cert \
--ca elastic-stack-ca.p12 \
--dns localhost \
--ip 127.0.0.1,::1 \
--out config/certs/node-1.p12
# --ca为CA证书路径名称
# -dns为节点DNS
# --ip为节点ip
# --out为生成节点证书的路径和名称等,输出文件是PKCS#12密钥库,其中包括节点证书,节点密钥和CA证书
# 或者使用命令 bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 效果跟上面这个一样,生成一个p12结尾的证书
提取出pem证书
# elastic-certificates.p12为上一步节点证书
openssl pkcs12 -in elastic-certificates.p12 -cacerts -nokeys -out elastic-ca.pem
不知道是啥的证书
bin/elasticsearch-certutil ca --pem (elastic-stack-ca.zip)
inflating: ca/ca.crt
inflating: ca/ca.key
批量生成证书
# 创建实例 yaml 文件
vi ~/tmp/cert_blog/instance.yml
# 将实例信息添加到 yml 文件
instances:
- name: 'node1'
dns: [ 'node1.elastic.test.com' ]
- name: "node2"
dns: [ 'node2.elastic.test.com' ]
- name: 'my-kibana'
dns: [ 'kibana.local' ]
- name: 'logstash'
dns: [ 'logstash.local' ]
# 生成 CA 和服务器证书
bin/elasticsearch-certutil cert ca --pem --in instance.yml --out certs.zip
# 会生成一个压缩包,解压后会有一个ca文件夹和各以name命令的文件夹,包含文件如下
cat instance.yml
instances:
- name: '192.168.75.20'
dns: ['192.168.75.20']
- name: '192.168.75.21'
dns: ['192.168.75.21']
- name: '192.168.75.22'
dns: ['192.168.75.22']
- name: '192.168.75.23'
dns: ['192.168.75.23']
bin/elasticsearch-certutil cert ca --pem --in instance.yml --out certs.zip
unzip certs.zip
tree ca/
ca/
└── ca.crt
tree 192.168.75.2*
192.168.75.20
├── 192.168.75.20.crt
└── 192.168.75.20.key
192.168.75.21
├── 192.168.75.21.crt
└── 192.168.75.21.key
192.168.75.22
├── 192.168.75.22.crt
└── 192.168.75.22.key
192.168.75.23
├── 192.168.75.23.crt
└── 192.168.75.23.key
官方文档证书生成
# cat instance.yml
instances:
- name: "node1"
ip:
- "192.0.2.1"
dns:
- "node1.mydomain.com"
- name: "node2"
ip:
- "192.0.2.2"
- "198.51.100.1"
- name: "node3"
- name: "node4"
dns:
- "node4.mydomain.com"
- "node4.internal"
- name: "CN=node5,OU=IT,DC=mydomain,DC=com"
filename: "node5"
bin/elasticsearch-certutil cert --silent --in instances.yml --out test1.zip --pass testpassword
unzip test1.zip
# tree node*
node1
└── node1.p12
node2
└── node2.p12
node3
└── node3.p12
node4
└── node4.p12
node5
└── node5.p12
bin/elasticsearch-certutil csr --silent --in instances.yml --out test2.zip --pass testpassword
unzip test2.zip
# tree node*
node1
├── node1.csr
└── node1.key
node2
├── node2.csr
└── node2.key
node3
├── node3.csr
└── node3.key
node4
├── node4.csr
└── node4.key
node5
├── node5.csr
└── node5.key
官方地址:https://www.elastic.co/guide/en/elasticsearch/reference/master/encrypting-communications-certificates.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.5/certutil.html
分离p12(或pfx)文件中的证书和私钥
p12(或者pfx)文件里一般存放有CA的根证书,用户证书和用户的私钥
假设我们有一个test.p12文件,在安装了openssl的linux服务器上执行以下命令:
提取用户证书:
openssl pkcs12 -in test.p12 -clcerts -nokeys -out cert.pem //pem格式
openssl pkcs12 -in test.p12 -clcerts -nokeys -out cert.crt //crt格式
如果需要携带秘钥,则去掉 -nokeys
openssl pkcs12 -in test.p12 -clcerts -out cert.pem //pem格式
openssl pkcs12 -in test.p12 -clcerts -out cert.crt //crt格式
提取私钥:
openssl pkcs12 -in test.p12 -nocerts -out key.pem
清除秘钥中的密码(在把秘钥部署到某些服务器上时可能需要清除密码)
openssl rsa -in key.pem -out newkey.pem
在java中pkcs12 和jks的相互转换:
# JKS → P12
keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore keystore.p12
# P12 → JKS
keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore keystore.jks