使用 cfssl 自签证书
Generate self-signed certificates
If you build Container Linux cluster on top of public networks it is recommended to enable encryption for Container Linux services to prevent traffic interception and man-in-the-middle attacks. For these purposes you have to use Certificate Authority (CA), private keys and certificates signed by CA. Let’s use cfssl and walk through the whole process to create all these components.
NOTE: We will use basic procedure here. If your configuration requires advanced security options, please refer to official cfssl documentation.
Download cfssl
CloudFlare’s distributes cfssl source code on github page and binaries on cfssl website .
Our documentation assumes that you will run cfssl on your local x86_64 Linux host.
|
|
Initialize a certificate authority
First of all we have to save default cfssl
options for future substitutions:
mkdir ~/cfssl
cd ~/cfssl
cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json
Certificate types which are used inside Container Linux
- client certificate :
server-client
模式下,用于客户端侧使用。 例如etcdctl
,etcd proxy
, ordocker
clients. - server certificate :
server-client
模式下,用于服务端侧使用。 例如docker
server orkube-apiserver
. - peer certificate : 用于 etcd 集群节点成员之间通信使用。
Configure CA options
Now we can configure signing options inside ca-config.json
config file. Default options contain following preconfigured fields:
- profiles: www with
server auth
(TLS Web Server Authentication) X509 V3 extension and client withclient auth
(TLS Web Client Authentication) X509 V3 extension. - expiry: with
8760h
default value (or 365 days)
For compliance let’s rename www profile into server, create additional peer profile with both server auth
and client auth
extensions, and set expiry to 43800h (5 years):
|
|
You can also modify ca-csr.json
Certificate Signing Request (CSR):
|
|
And generate CA with defined options:
|
|
You’ll get following files:
ca-key.pem
ca.csr
ca.pem
- Please keep
ca-key.pem
file in safe. This key allows to create any kind of certificates within your CA. - *.csr files are not used in our example.
Generate server certificate
cfssl print-defaults csr > server.json
Most important values for server certificate are Common Name (CN) and hosts. We have to substitute them, for example:
...
"CN": "coreos1",
"hosts": [
"192.168.122.68",
"ext.example.com",
"coreos1.local",
"coreos1"
],
...
Now we are ready to generate server certificate and private key:
|
|
Or without CSR json file:
|
|
You’ll get following files:
server-key.pem
server.csr
server.pem
Generate peer certificate
cfssl print-defaults csr > member1.json
Substitute CN and hosts values, for example:
...
"CN": "member1",
"hosts": [
"192.168.122.101",
"ext.example.com",
"member1.local",
"member1"
],
...
Now we are ready to generate member1 certificate and private key:
|
|
Or without CSR json file:
|
|
You’ll get following files:
member1-key.pem
member1.csr
member1.pem
Repeat these steps for each etcd
member hostname.
Generate client certificate
cfssl print-defaults csr > client.json
For client certificate we can ignore hosts values and set only Common Name (CN) to client value:
...
"CN": "client",
"hosts": [""],
...
Generate client certificate:
|
|
Or without CSR json file:
|
|
You’ll get following files:
client-key.pem
client.csr
client.pem
TLDR
Download binaries
|
|
Create directory to store certificates:
|
|
Generate CA and certificates
|
|
Verify data
|
|
Things to know
- Don’t put your
ca-key.pem
into a Container Linux Config, it is recommended to store it in safe place. This key allows to generate as much certificates as possible. - Keep key files in safe. Don’t forget to set proper file permissions, i.e.
chmod 0600 server-key.pem
. - Certificates in this TLDR example have both
server auth
andclient auth
X509 V3 extensions and you can use them with servers and clients’ authentication. - You are free to generate keys and certificates for wildcard
*
address as well. They will work on any machine. It will simplify certificates routine but increase security risks.
More information
For another examples, check out these documents:
- 原文链接:https://typonotes.com/posts/2020/05/28/cfssl/
- 本文为原创文章,转载注明出处。
- 欢迎 扫码关注公众号
Go与云原生
或 订阅网站 https://typonotes.com/ 。 - 第一时间看后续精彩文章。觉得好的话,请猛击文章右下角「在看」,感谢支持。
![](/mp/qrcode.png)