cfssl自签证书

Posted 2022-05-17 wemux

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了cfssl自签证书相关的知识，希望对你有一定的参考价值。

cfssl是一个开源的证书管理工具，使用json文件生成证书，相比openssl更方便使用。

下载软件包

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

获取默认设置

cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json

创建CA配置文件

cat > ca-config.json << EOF

  "signing": 
    "default": 
      "expiry": "87600h"
    ,
    "profiles": 
      "www": 
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      
    
  

EOF

创建CA签名请求

cat > ca-csr.json << EOF

    "CA": "expiry": "87600h",
    "CN": "etcd CA",
    "key": 
        "algo": "rsa",
        "size": 2048
    ,
    "names": [
        
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        
    ]

EOF

生成CA和私钥

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

自签证书请求

cat > server-csr.json << EOF

    "CN": "etcd",
    "hosts": [
    "192.168.31.61",
    "192.168.31.62",
    "192.168.31.63"
    ],
    "key": 
        "algo": "rsa",
        "size": 2048
    ,
    "names": [
        
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing"
        
    ]

EOF

生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

检查证书文件过期时间

cat server.pem |openssl x509 -noout -enddate

以上是关于cfssl自签证书的主要内容，如果未能解决你的问题，请参考以下文章