在Ubuntu16.10上开启docker17.03.0-ce的https认证

来源：互联网发布：yy挂机喊话软件编辑：程序博客网时间：2024/05/17 03:58

1、生成CA私钥和公钥：

$ openssl genrsa -aes256 -out ca-key.pem 4096

效果如下：Generating RSA private key,4096bit long modulus............................................................................................................................................................................................++........++e is65537(0x10001)Enter pass phraseforca-key.pem: cloudVerifying - Enter pass phraseforca-key.pem: cloud

需要记住设置的key，下面要用

2、进行证书生成

$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem

Enter pass phrase for ca-key.pem:You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:cnState or Province Name (full name) [Some-State]:shandongLocality Name (eg, city) []:jinanOrganization Name (eg, company) [Internet Widgits Pty Ltd]:cloudtopOrganizational Unit Name (eg, section) []:cloudtopCommon Name (e.g. server FQDN or YOUR name) []:cloudtopEmail Address []:zhangyc@toplion.com.cn

3、本地证书生成和客户端证书生成

$ openssl genrsa -out server-key.pem 4096

$ openssl req -subj "/CN=cloudtop" -sha256 -new -key server-key.pem -out server.csr

$ echo subjectAltName = DNS:cloudtop,IP:172.31.142.210,IP:127.0.0.1 > extfile.cnf

$ openssl x509 -req -days365-sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf

$ openssl genrsa -out key.pem 4096

$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr

$ echo extendedKeyUsage = clientAuth > extfile.cnf

$ openssl x509 -req -days365-sha256 -inclient.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf

$ rm -v client.csr server.csr

$ chmod -v 0400 ca-key.pem key.pem server-key.pem

$ chmod -v 0444 ca.pem server-cert.pem cert.pem

$ sudo vim /etc/systemd/system/docker.service.d/http-proxy.conf

具体描述待补充，草稿貌似只能保存一篇，先发出来占着坑，后续补充

0 0