手動製作CA證書
阿新 • • 發佈：2018-12-30
一、安裝 CFSSL
#下面三個安裝包，無需下載，之前百度雲中的壓縮包中都有
[[email protected] ~]# cd /usr/local/src [[email protected]-node1 src]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 [[email protected] src]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 [[email protected] src]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64[[email protected] src]# chmod +x cfssl* [[email protected]-node1 src]# mv cfssl-certinfo_linux-amd64 /opt/kubernetes/bin/cfssl-certinfo [[email protected]-node1 src]# mv cfssljson_linux-amd64 /opt/kubernetes/bin/cfssljson [[email protected]-node1 src]# mv cfssl_linux-amd64 /opt/kubernetes/bin/cfssl 複製cfssl命令檔案到k8s-node1和k8s-node2節點。如果實際中多個節點，就都需要同步複製。 [[email protected]-node1 ~]# scp /opt/kubernetes/bin/cfssl* 192.168.56.12: /opt/kubernetes/bin [[email protected]-node1 ~]# scp /opt/kubernetes/bin/cfssl* 192.168.56.13: /opt/kubernetes/bin
二、建立生成證書臨時存放目錄
[[email protected] ~]# cd /usr/local/src/ [[email protected]-node1 src]# mkdir ssl && cd ssl [[email protected]-node1 ssl]# pwd /usr/local/src/ssl
三、建立用來生成CA檔案的JSON配置檔案
[[email protected] ssl]# vim ca-config.json { "signing": { "default": { "expiry": "8760h" }, "profiles": { "kubernetes": { "usages": [ "signing", "key encipherment", "server auth", "client auth" ], "expiry": "8760h" } } } }
四、建立用來生成CA證書請求(CSR)的JSON配置檔案
[[email protected] ssl]# vim ca-csr.json { "CN": "kubernetes", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "k8s", "OU": "System" } ] }
五、生成CA證書(ca.pem)和金鑰(ca-key.pem)
[[email protected] ssl]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca 2018/05/30 20:57:27 [INFO] generating a new CA key and certificate from CSR 2018/05/30 20:57:27 [INFO] generate received request 2018/05/30 20:57:27 [INFO] received CSR 2018/05/30 20:57:27 [INFO] generating key: rsa-2048 2018/05/30 20:57:27 [INFO] encoded CSR 2018/05/30 20:57:27 [INFO] signed certificate with serial number 373140524131197437929619452877769287318483665014 [[email protected]-node1 ssl]# ls -l total 20 -rw-r--r-- 1 root root 290 May 30 20:55 ca-config.json -rw-r--r-- 1 root root 1001 May 30 20:57 ca.csr -rw-r--r-- 1 root root 208 May 30 20:56 ca-csr.json -rw------- 1 root root 1675 May 30 20:57 ca-key.pem
六、分發證書
[[email protected] ssl]# cp ca.csr ca.pem ca-key.pem ca-config.json /opt/kubernetes/ssl SCP證書到k8s-node1和k8s-node2節點 [[email protected]-node1 ssl]# scp ca.csr ca.pem ca-key.pem ca-config.json 192.168.56.12:/opt/kubernetes/ssl [[email protected]-node1 ssl]# scp ca.csr ca.pem ca-key.pem ca-config.json 192.168.56.13:/opt/kubernetes/ssl