1. 下載 cfssl 工具
curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl
curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson
curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo
# cp -rf cfssl cfssl-certinfo cfssljson /usr/local/bin
chmod +x /usr/local/bin/cfssl*
cfssl -- 命令行工具
cfssljsion -- 從cfssl獲取JSON輸出
cfssl-certinfo -- 查看證書信息
2. 創(chuàng)建CA
# 創(chuàng)建ca命令 -> ca-pem然想、ca-key.pem
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
3. 填寫表單申請證書
# 生成證書命令 -> server.pem闻书、server-key.pem
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
json 文件及參數(shù)說明
# 請求創(chuàng)建ca簽名申請表
cat > ca-csr.json << EOF
{
"CN": "etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "Beijing",
"ST": "Beijing"
}
]
}
EOF
# ca配置文件，指定ca有效期、使用場景
cat < ca-config.json << EOF
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"www": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
# 請求證書申請表
cat > server-csr.json << EOF
"CN": "etcd",
"hosts": [
"192.168.31.63",
"192.168.31.65",
"192.168.31.66"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
EOF
server-csr.json -- 請求證書申請表
ca-config.json -- 指定ca有效期译红、使用場景
ca-csr.json -- 請求創(chuàng)建ca簽名申請表
profile -- 使用場景
*key.pem --私鑰
*pem -- 公鑰
