##################################################### # # 创建CA X509 version 1.0根证书 # ##################################################### #创建证书存放目录 CertPath=/k8s/tlsv2 DomainName=ca.huawei.com # 1、创建证书文件存放目录 mkdir -p ${CertPath} && cd ${CertPath} # 2、创建CA证书的私钥"ca.key" openssl genrsa -out ${CertPath}/ca.key # 3、 创建CA证书请求"ca.csr" openssl req -new \ -subj "/C=CN/ST=GuangDong/L=DongGuan/O=HW/OU=IT/CN=${DomainName}" \ -key ${CertPath}/ca.key \ -out ${CertPath}/ca.csr # 4、 创建3年有效期的CA证书"ca.crt" openssl x509 -req \ -days 3650 \ -in ${CertPath}/ca.csr \ -signkey ${CertPath}/ca.key \ -out ${CertPath}/ca.crt # 5、查看证书文件 openssl x509 -in ${CertPath}/ca.crt -text -noout chmod 777 ${CertPath}/ca* && ls -l ${CertPath}/ ##################################################### # # 生成X509 3.0证书,证书key文件不加密 # CA签署的服务器证书 # ##################################################### ServerName=server DomainName=huawei.com # 1、创建服务证书的私钥"xxx.key" openssl genrsa -out ${CertPath}/${ServerName}.key # 2、创建服务器证书请求文件 "xxx.csr" openssl req -new \ -subj "/C=CN/ST=GuangDong/L=DongGuan/O=HW/OU=IT/CN=${ServerName}.${DomainName}" \ -key ${CertPath}/${ServerName}.key \ -out ${CertPath}/${ServerName}.csr # 3、创建证书扩展文件 cat > ${CertPath}/my-ssl.conf <<EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth subjectAltName = @alt_names [ alt_names ] DNS.1 = kubernetes DNS.2 = kubernetes.default DNS.3 = kubernetes.default.svc DNS.4 = kubernetes.default.svc.cluster DNS.5 = kubernetes.default.svc.cluster.local DNS.6 = www.huawei.com DNS.7 = localhost IP.1 = 168.7.10.201 IP.2 = 168.7.10.202 IP.3 = 168.7.10.203 IP.4 = 168.7.10.204 IP.4 = 127.0.0.1 EOF # 4、签发X509 3.0服务器证书文件 openssl x509 -req \ -in ${CertPath}/${ServerName}.csr \ -out ${CertPath}/${ServerName}.crt \ -days 3650 \ -CAcreateserial -CA ${CertPath}/ca.crt \ -CAkey ${CertPath}/ca.key \ -CAserial serial \ -extfile ${CertPath}/my-ssl.conf # 4、签发X509 1.0服务器证书文件,即: "xxx.crt" # openssl x509 -req \ # -in ${CertPath}/${ServerName}.csr \ # -out ${CertPath}/${ServerName}.crt \ # -days 3650 \ # -CAcreateserial -CA ${CertPath}/ca.crt \ # -CAkey ${CertPath}/ca.key # 5、查看证书文件 openssl x509 -in ${CertPath}/${ServerName}.crt -text -noout chmod 777 ${CertPath}/${ServerName}.* && ls -l ${CertPath}/