标签：通讯 ase bin 技术 c99 baseline make close public
准备工作
需要两套证书，一套k8s通讯使用，一套etcd内部通讯使用
下载证书生成工具
[root@k8s-master01 k8s]# curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl [root@k8s-master01 k8s]# curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson [root@k8s-master01 k8s]# curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo [root@k8s-master01 k8s]# chmod +x /usr/local/bin/cfssl*
etcd自签证书
1、为etcd创建自签证书
创建CA配置json文件
1 [root@k8s-master01 etcd]# cat ca-csr.json 2 { 3 "CN": "etcd CA", 4 "key": { 5 "algo": "rsa", 6 "size": 2048 7 }, 8 "names": [ 9 { 10 "C": "CN", 11 "L": "Heibei", 12 "ST": "WuHan" 13 } 14 ] 15 } 16 [root@k8s-master01 etcd]# cat ca-config.json 17 { 18 "signing": { 19 "default": { 20 "expiry": "876000h" 21 }, 22 "profiles": { 23 "www": { 24 "expiry": "876000h", 25 "usages": [ 26 "signing", 27 "key encipherment", 28 "server auth", 29 "client auth" 30 ] 31 } 32 } 33 } 34 }
2、自建CA
[root@k8s-master01 etcd]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca - 2019/11/01 17:35:11 [INFO] generating a new CA key and certificate from CSR 2019/11/01 17:35:11 [INFO] generate received request 2019/11/01 17:35:11 [INFO] received CSR 2019/11/01 17:35:11 [INFO] generating key: rsa-2048 2019/11/01 17:35:11 [INFO] encoded CSR 2019/11/01 17:35:11 [INFO] signed certificate with serial number 92590521640563530821402907840883867551598481151 [root@k8s-master01 etcd]# ls *.pem ca-key.pem ca.pem
ca.pem为ca的数字证书
ca-key.pem为ca的私钥
3、创建etcd证书的配置文件
1 [root@k8s-master01 etcd]# cat server-csr.json 2 { 3 "CN": "etcd", 4 "hosts": [ 5 "10.16.8.161", 6 "10.16.8.162", 7 "10.16.8.163" 8 ], 9 "key": { 10 "algo": "rsa", 11 "size": 2048 12 }, 13 "names": [ 14 { 15 "C": "CN", 16 "L": "HuBei", 17 "ST": "WuHan" 18 } 19 ] 20 }
4、为etcd生成域名证书
1 [root@k8s-master01 etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server 2 2019/11/01 17:43:28 [INFO] generate received request 3 2019/11/01 17:43:28 [INFO] received CSR 4 2019/11/01 17:43:28 [INFO] generating key: rsa-2048 5 2019/11/01 17:43:29 [INFO] encoded CSR 6 2019/11/01 17:43:29 [INFO] signed certificate with serial number 54870045087631859810761264273552824049503170814 7 2019/11/01 17:43:29 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for 8 websites. For more information see the Baseline Requirements for the Issuance and Management 9 of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org); 10 specifically, section 10.2.3 ("Information Requirements"). 11 12 [root@k8s-master01 etcd]# ls server*.pem 13 server-key.pem server.pem
5、会用到的证书为
1 [root@k8s-master01 etcd]# ll *.pem 2 -rw------- 1 root root 1679 11月 1 17:35 ca-key.pem 3 -rw-r--r-- 1 root root 1257 11月 1 17:35 ca.pem 4 -rw------- 1 root root 1679 11月 1 17:43 server-key.pem 5 -rw-r--r-- 1 root root 1330 11月 1 17:43 server.pem
标签：通讯 ase bin 技术 c99 baseline make close public
原文地址：https://www.cnblogs.com/xw115428/p/11955879.html
