nginxproxymanager 结合 step-ca

1.安装 npm

2.启动step-ca

services:
  app: 
    image: smallstep/step-ca
    container_name: step-ca
    hostname: step-ca
    restart: unless-stopped
    dns:
      - 114.114.114.114
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./step:/home/step
    environment:
      - DOCKER_STEPCA_INIT_NAME=Smallstep
      - DOCKER_STEPCA_INIT_DNS_NAME=localhost,172.16.0.1,ca.example.com
      - DOCKER_STEPCA_INIT_PASSWORD=123456
    networks:
      npm:
        ipv4_address: 172.16.0.251
    logging:
      driver: json-file
      options:
        max-size: 100m
        max-file: 5
networks:
  npm:
    external: true

3. 给主系统安装step

4. 主系统安装证书

step certificate install --all /compose/172_016_000_251_stepca/step/certs/root_ca.crt

5. 主系统生成证书

使用独立模式生成证书 将证书应用于 npm 的 ca.example.com

step certificate create ca ca.crt ca.key --profile leaf --not-after=87600h --ca /compose/172_016_000_251_stepca/step/certs/intermediate_ca.crt --ca-key /compose/172_016_000_251_stepca/step/secrets/intermediate_ca_key --san ca.example.com --san localhost --san 172.16.0.251 --kty RSA --size 2048 --no-password --insecure --bundle

6. 主系统安装配置联网版的证书

$CA_FINGERPRINT=$(step certificate fingerprint /compose/172_016_000_251_stepca/step/certs/root_ca.crt)
step ca bootstrap --ca-url https://localhost:9000 --fingerprint $CA_FINGERPRINT --install

7. 主系统利用联网形式生成ca.example.com 并重新替换 npm中的证书

step ca certificate ca.example.com ca.example.com.crt ca.example.com.key --san ca.example.com -- *.example.com --kty RSA --size 2084

Gen

step certificate create --profile root-ca "Step Root CA" root_ca.crt root_ca.key --no-password --insecure --kty RSA --size 2048

openssl pkcs12 -inkey root_ca.key -in root_ca.crt -export -out root_ca.pfx
openssl rsa -inform PEM -outform DER -text -in mykey.pem -out mykey.der

step certificate create pod.com pod.com.crt pod.com.key --profile leaf --not-after=87600h --ca root_ca.crt --ca-key root_ca.key  --san pod.com --san "*.pod.com" --san localhost --san 127.0.0.1 --san 192.168.5.128 --kty RSA --size 2048 --no-password --insecure --bundle

#crl
step ca revoke "myserver.local" --reason superseded
step ca crl --issuser "Step Root CA" crl.pem
step certificate create "myserver.local" pod.com pod.com.crt pod.com.key --profile leaf --not-after=87600h --ca root_ca.crt --ca-key root_ca.key  --san pod.com --san "*.pod.com" --san localhost --san 127.0.0.1 --san 192.168.5.128 --kty RSA --size 2048 --no-password --insecure --bundle --crl http://127.0.0.1/crl.pem

#空的crl.pem
touch empty_crl.pem
openssl ca -gencrl -keyfile my_ca.key -cert my_ca.crt -out my_ca.crl
openssl crl -in empty_crl.pem -noout -text