cfssl工具制作证书

安装cfssl

去git下载二进制文件

下载文件 cfssl_1.6.1_linux_amd64 cfssl-certinfo_1.6.1_linux_amd64 cfssljson_1.6.1_linux_amd64

# 赋权限
$ chmod +x cffs*
# 移动到 /usr/local/bin
$ mv cfssl_1.6.1_linux_amd64 /usr/local/bin/cfssl
$ mv cfssl-certinfo_1.6.1_linux_amd64 /usr/local/bin/cfssl-certinfo
$ mv cfssljson_1.6.1_linux_amd64 /usr/local/bin/cfssljson

生成根证书

# 根证书请求配置文件
$ cat ca-csr.json

{
        "CN": "soyuan",
        "key": {
                "algo": "rsa",
                "size": 2048
        },
        "names": [{
                "C": "CN",
                "ST": "Beijing",
                "L": "beijing",
                "O": "soyuan",
                "OU": "spzl"
        }]
}

# 生成证书
$ cfssl gencert -initca ca-csr.json | cfssljson -bare ca

# -base ca 指定生成的证书名称

CN 证书名称

C Country， 国家

L Locality，地区，城市

O Organization Name，组织名称，公司名称

OU Organization Unit Name，组织单位名称，公司部门

ST State，州，省

通过ca签发服务器证书

# 服务器证书请求配置文件

$ cat 172.16.100.92-csr.json
{
    "CN": "172.16.100.92",
    "hosts": [
      "172.16.100.92",
      "kube-master"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "soyuan",
            "OU": "spzl"
        }
    ]
}

# 生成证书策略文件
$ cat ca-config.json
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "server": {
        "expiry": "87600h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ]
      },
      "intermediate": {
        "expiry": "87600h",
        "usages": [
          "signing",
          "key encipherment",
          "cert sign",
          "crl sign",
          "server auth",
          "client auth"
        ]
      }
    }
  }
}

# 生成证书
$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=92 172.16.100.92-csr.json | cfssljson -bare 172.16.100.92
# 单独生成csr文件
$ cfssl genkey csr.json | cfssljson -bare 172.16.100.92
# 证书和私钥合并成pfx
$ openssl pkcs12 -export -out certificate.pfx -inkey private_key.pem -in certificate.pem -certfile intermediate_cert.pem
# pfx 提取证书和私钥
$ openssl pkcs12 -in certificate.pfx -nocerts -nodes -out private_key.pem
$ openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem
$ openssl verify -CAfile ca.pem intermediate.pem 

• 默认策略，指定了证书的有效期是一年(8760h)
• usages.signing, 表示该证书可用于签名其它证书；生成的 ca.pem 证书中 CA=TRUE
• usages.server auth：表示 client 可以用该 CA 对 server 提供的证书进行验证
• usages.client auth：表示 server 可以用该 CA 对 client 提供的证书进行验证

证书格式转换

# pem > crt
$ openssl x509 -in ca.pem -out ca.crt

# pem > key
$ openssl rsa -in ca.pem -out ca.key