cfssl生成链式自签名证书
生成大纲
总共生成三个证书,一个根证书,一个中间证书签发商,一个服务证书。为方便理解,根证书表示为ca0,中间证书表示为ca1,服务证书表示为server。在本文中,服务证书为生成给harbor使用的证书。
生成
生成所有的证书请求文件和配置
mkdir -p server ca1 ca0
# 生成配置文件
cat << EOF > config.json
{
"signing": {
"default": {
"expiry": "262800h"
},
"profiles": {
"intermediate": {
"usages": ["cert sign", "crl sign"],
"expiry": "700800h",
"ca_constraint": {
"is_ca": true,
"max_path_len": 1
}
},
"host": {
"usages": [
"client auth",
"signing",
"digital signing",
"key encipherment",
"server auth"
],
"expiry": "262800h"
}
}
}
}
EOF
# 生成ca0证书请求文件
cat << EOF > ca0/ca0.json
{
"CN": "Zeng Chunmiao",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "Guangzhou",
"O": "Zeng Chunmiao",
"OU": "Zeng Chunmiao Root CA",
"ST": "China"
}
]
}
EOF
# 生成ca1证书请求文件
cat << EOF > ca1/ca1.json
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "HangZhou",
"L": "XS",
"O": "k8s",
"OU": "System"
}
]
}
EOF
# 生成服务证书请求
cat << EOF > server/server-csr.json
{
"CN": "harbor",
"hosts": [
"127.0.0.1",
"harbor.ggdefe.com",
"harbor.ggdefe.com.cn"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "HangZhou",
"L": "XS",
"O": "k8s",
"OU": "System"
}
]
}
EOF
开始生成
- 生成根证书ca0
cfssl gencert -initca ca0/ca0.json | cfssljson -bare ca0/ca0
ls ca0
- 生成中间证书ca1
cfssl gencert -ca=./ca0/ca0.pem -ca-key=./ca0/ca0-key.pem -config=./config.json -profile=intermediate ./ca1/ca1.json | cfssljson -bare ./ca1/ca1
ls ca1
- 生成服务证书
cfssl gencert -ca=./ca1/ca1.pem -ca-key=./ca1/ca1-key.pem -config=./config.json -profile=host ./server/server-csr.json | cfssljson -bare ./server/server
ls server
- 生成链式证书
mkdir chain -p
# 生成公钥 注意顺序
cat server/server.pem ca1/ca1.pem > ./chain/chain.crt
# 生成私钥
cp server/server-key.pem ./chain/server-key.pem
输出结果
🛹 find ./
./
./ca0
./ca0/ca0-key.pem
./ca0/ca0.csr
./ca0/ca0.json
./ca0/ca0.pem
./ca1
./ca1/ca1-key.pem
./ca1/ca1.csr
./ca1/ca1.json
./ca1/ca1.pem
./chain
./chain/chain.crt
./chain/server-key.pem
./config.json
./server
./server/server-csr.json
./server/server-key.pem
./server/server.csr
./server/server.pem