cfssl自簽證書

安裝cfssl

7-200 ~]# curl -s -L -o /usr/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 
7-200 ~]# curl -s -L -o /usr/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 
7-200 ~]# curl -s -L -o /usr/bin/cfssl-certinfo https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 
7-200 ~]# chmod +x /usr/bin/cfssl*

2.2 配置

創建生成CA證書的JSON配置文件

7-200 ~]# mkdir /opt/certs
7-200 ~]# vim /opt/certs/ca-config.json
{
    "signing": {
        "default": {
            "expiry": "175200h"
        },
        "profiles": {
            "server": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}

證書類型
client certificate： 客戶端使用，用於服務端認證客戶端,例如etcdctl、etcd proxy、fleetctl、docker客戶端
server certificate: 服務端使用，客戶端以此驗證服務端身份,例如docker服務端、kube-apiserver
peer certificate: 雙向證書，用於etcd集群成員間通信

創建生成CA證書簽名請求（csr）的JSON配置文件

/opt/certs/ca-csr.json
{
    "CN": "kubernetes-ca",
    "hosts": [
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "shanghai",
            "L": "shanghai",
            "O": "phc-dow",
            "OU": "kjdow"
        }
    ],
    "ca": {
        "expiry": "175200h"
    }
}

CN: Common Name，瀏覽器使用該字段驗證網站是否合法，一般寫的是域名。非常重要。瀏覽器使用該字段驗證網站是否合法
C: Country， 國家
ST: State，州，省
L: Locality，地區，城市
O: Organization Name，組織名稱，公司名稱
OU: Organization Unit Name，組織單位名稱，公司部門

生成CA證書和私鑰

7-200 ~]# cd /opt/certs
7-200 certs]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca  
2019/01/18 09:31:19 [INFO] generating a new CA key and certificate from CSR
2019/01/18 09:31:19 [INFO] generate received request
2019/01/18 09:31:19 [INFO] received CSR
2019/01/18 09:31:19 [INFO] generating key: rsa-2048
2019/01/18 09:31:19 [INFO] encoded CSR
2019/01/18 09:31:19 [INFO] signed certificate with serial number 345276964513449660162382535043012874724976422200

7-200 certs]# ls -l
-rw-r--r-- 1 root root  836 Jan 16 11:04 ca-config.json
-rw-r--r-- 1 root root  332 Jan 16 11:10 ca-csr.json
-rw------- 1 root root 1675 Jan 16 11:17 ca-key.pem
-rw-r--r-- 1 root root 1001 Jan 16 11:17 ca.csr
-rw-r--r-- 1 root root 1354 Jan 16 11:17 ca.pem

生成ca.pem、ca.csr、ca-key.pem(CA私鑰,需妥善保管)