背景描述

在局域网中部署组件时，想要通过证书来实现身份的认证，确保通信的安全性，可以通过cfssl工具来进行CA证书，服务端证书，客户端证书的创建。

背景描述
部署cfssl工具
- 下载，上传cfssl,cfssljson，cfssl-certinfo工具到服务器上
- 增加命令的执行权限，并且增加到相关目录
创建CA根证书
创建etcd服务端证书
- 创建etcd的csr文件
- 用CA签发etcd证书和私钥

部署cfssl工具

下载，上传cfssl,cfssljson，cfssl-certinfo工具到服务器上

[root@nccztsjb-node-17 data]# ls -ltr

total 35936

-rw-r--r-- 1 root root 15108368 Nov 27 14:07 cfssl_1.5.0_linux_amd64

-rw-r--r-- 1 root root  9663504 Nov 27 14:21 cfssljson_1.5.0_linux_amd64

-rw-r--r-- 1 root root 12021008 Nov 30 11:22 cfssl-certinfo_1.5.0_linux_amd64

增加命令的执行权限，并且增加到相关目录

[root@nccztsjb-node-17 data]# chmod +x cfssl*

[root@nccztsjb-node-17 data]# cp cfssl_1.5.0_linux_amd64 /usr/local/bin/cfssl

[root@nccztsjb-node-17 data]# cp cfssljson_1.5.0_linux_amd64 /usr/local/bin/cfssljson

[root@nccztsjb-node-17 data]# cp cfssl-certinfo_1.5.0_linux_amd64 /usr/local/bin/cfssl-certinfo

[root@nccztsjb-node-17 data]# cfssl version

Version: 1.5.0

Runtime: go1.12.12

备注：此时cfssl工具安装完成。

创建CA根证书

ca根证书主要是用来签发其他的证书

创建ca配置文件

cat >ca-config.json <<EOF

{

  "signing": {

    "default": {

      "expiry": "262800h"

    },

    "profiles": {

      "kubernetes": {

        "usages": [

            "signing",

            "key encipherment",

            "server auth",

            "client auth"

        ],

        "expiry": "262800h"

      }

    }

  }

}

EOF

说明：可以设置默认的签名出来的证书的有效时间。可以同时设置不同的profile用于不同的用途。

创建ca的csr文件

cat > ca-csr.json <<EOF

{

  "CN": "kubernetes",

  "key": {

    "algo": "rsa",

    "size": 2048

  },

  "names": [

    {

      "C": "CN",

      "ST": "Beijing",

      "L": "Beijing",

      "O": "DC",

      "OU": "System"

    }

  ],

  "ca": {

    "expiry": "262800h"

  }

}

EOF

创建CA证书及私钥

[root@nccztsjb-node-17 data]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca

2020/12/04 14:20:39 [INFO] generating a new CA key and certificate from CSR

2020/12/04 14:20:39 [INFO] generate received request

2020/12/04 14:20:39 [INFO] received CSR

2020/12/04 14:20:39 [INFO] generating key: rsa-2048

2020/12/04 14:20:39 [INFO] encoded CSR

2020/12/04 14:20:39 [INFO] signed certificate with serial number 497233672920328375338343228164630446467151606126

[root@nccztsjb-node-17 data]# ls -l ca*

-rw-r--r-- 1 root root  294 Dec  4 14:13 ca-config.json

-rw-r--r-- 1 root root 1045 Dec  4 14:20 ca.csr

-rw-r--r-- 1 root root  246 Dec  4 14:19 ca-csr.json

-rw------- 1 root root 1675 Dec  4 14:20 ca-key.pem

-rw-r--r-- 1 root root 1310 Dec  4 14:20 ca.pem

ca.pem就是ca的证书，ca-key.pem就是ca的私钥。

创建etcd服务端证书

创建etcd的csr文件

cat >etcd-csr.json <<EOF

{

  "CN": "etcd",

  "key": {

    "algo": "rsa",

    "size": 2048

  },

  "names": [

    {

      "C": "CN",

      "ST": "Beijing",

      "L": "Beijing",

      "O": "DC",

      "OU": "System"

    }

  ]

}

EOF

用CA签发etcd证书和私钥

cfssl gencert \

  -ca=ca.pem \

  -ca-key=ca-key.pem \

  -config=ca-config.json \

  -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

2020/12/04 14:33:00 [INFO] generate received request

2020/12/04 14:33:00 [INFO] received CSR

2020/12/04 14:33:00 [INFO] generating key: rsa-2048

2020/12/04 14:33:00 [INFO] encoded CSR

2020/12/04 14:33:00 [INFO] signed certificate with serial number 86899219278041222746661164070003623992607015229

2020/12/04 14:33:00 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for

websites. For more information see the Baseline Requirements for the Issuance and Management

of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);

specifically, section 10.2.3 ("Information Requirements").

[root@nccztsjb-node-17 data]# ls -l etcd*

-rw-r--r-- 1 root root  993 Dec  4 14:33 etcd.csr

-rw-r--r-- 1 root root  201 Dec  4 14:30 etcd-csr.json

-rw------- 1 root root 1679 Dec  4 14:33 etcd-key.pem

-rw-r--r-- 1 root root 1383 Dec  4 14:33 etcd.pem

etcd.csr为etcd的证书请求文件，etcd-key.pem为etcd的私钥，etcd.pem为etcd的证书。至此，etcd的证书签发完成。此证书可以作为etcd的服务端证书来使用。

巴特西

基于CFSSL工具创建CA证书，服务端证书，客户端证书