03_一键生成ssl自签名证书
<h1>1.一键生成 ssl 自签名证书脚本</h1>
<p>说明：脚本中替换域名www.rancher.local 为 rancher.hzsun.com</p>
<pre><code class="language-bash">#!/bin/bash -e
help ()
{
echo ' ================================================================ '
echo ' --ssl-domain: 生成ssl证书需要的主域名，如不指定则默认为www.rancher.local，如果是ip访问服务，则可忽略；'
echo ' --ssl-trusted-ip: 一般ssl证书只信任域名的访问请求，有时候需要使用ip去访问server，那么需要给ssl证书添加扩展IP，多个IP用逗号隔开；'
echo ' --ssl-trusted-domain: 如果想多个域名访问，则添加扩展域名（SSL_TRUSTED_DOMAIN）,多个扩展域名用逗号隔开；'
echo ' --ssl-size: ssl加密位数，默认2048；'
echo ' --ssl-cn: 国家代码(2个字母的代号),默认CN;'
echo ' 使用示例:'
echo ' ./create_self-signed-cert.sh --ssl-domain=www.test.com --ssl-trusted-domain=www.test2.com \ '
echo ' --ssl-trusted-ip=1.1.1.1,2.2.2.2,3.3.3.3 --ssl-size=2048 --ssl-date=3650'
echo ' ================================================================'
}
case "$1" in
-h|--help) help; exit;;
esac
if [[ $1 == '' ]];then
help;
exit;
fi
CMDOPTS="$*"
for OPTS in $CMDOPTS;
do
key=$(echo ${OPTS} | awk -F"=" '{print $1}' )
value=$(echo ${OPTS} | awk -F"=" '{print $2}' )
case "$key" in
--ssl-domain) SSL_DOMAIN=$value ;;
--ssl-trusted-ip) SSL_TRUSTED_IP=$value ;;
--ssl-trusted-domain) SSL_TRUSTED_DOMAIN=$value ;;
--ssl-size) SSL_SIZE=$value ;;
--ssl-date) SSL_DATE=$value ;;
--ca-date) CA_DATE=$value ;;
--ssl-cn) CN=$value ;;
esac
done
# CA相关配置
CA_DATE=${CA_DATE:-3650}
CA_KEY=${CA_KEY:-cakey.pem}
CA_CERT=${CA_CERT:-cacerts.pem}
CA_DOMAIN=cattle-ca
# ssl相关配置
SSL_CONFIG=${SSL_CONFIG:-$PWD/openssl.cnf}
SSL_DOMAIN=${SSL_DOMAIN:-'www.rancher.local'}
SSL_DATE=${SSL_DATE:-3650}
SSL_SIZE=${SSL_SIZE:-2048}
## 国家代码(2个字母的代号),默认CN;
CN=${CN:-CN}
SSL_KEY=$SSL_DOMAIN.key
SSL_CSR=$SSL_DOMAIN.csr
SSL_CERT=$SSL_DOMAIN.crt
echo -e "\033[32m ---------------------------- \033[0m"
echo -e "\033[32m | 生成 SSL Cert | \033[0m"
echo -e "\033[32m ---------------------------- \033[0m"
if [[ -e ./${CA_KEY} ]]; then
echo -e "\033[32m ====> 1. 发现已存在CA私钥，备份"${CA_KEY}"为"${CA_KEY}"-bak，然后重新创建 \033[0m"
mv ${CA_KEY} "${CA_KEY}"-bak
openssl genrsa -out ${CA_KEY} ${SSL_SIZE}
else
echo -e "\033[32m ====> 1. 生成新的CA私钥 ${CA_KEY} \033[0m"
openssl genrsa -out ${CA_KEY} ${SSL_SIZE}
fi
if [[ -e ./${CA_CERT} ]]; then
echo -e "\033[32m ====> 2. 发现已存在CA证书，先备份"${CA_CERT}"为"${CA_CERT}"-bak，然后重新创建 \033[0m"
mv ${CA_CERT} "${CA_CERT}"-bak
openssl req -x509 -sha256 -new -nodes -key ${CA_KEY} -days ${CA_DATE} -out ${CA_CERT} -subj "/C=${CN}/CN=${CA_DOMAIN}"
else
echo -e "\033[32m ====> 2. 生成新的CA证书 ${CA_CERT} \033[0m"
openssl req -x509 -sha256 -new -nodes -key ${CA_KEY} -days ${CA_DATE} -out ${CA_CERT} -subj "/C=${CN}/CN=${CA_DOMAIN}"
fi
echo -e "\033[32m ====> 3. 生成Openssl配置文件 ${SSL_CONFIG} \033[0m"
cat > ${SSL_CONFIG} <<EOM
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
EOM
if [[ -n ${SSL_TRUSTED_IP} || -n ${SSL_TRUSTED_DOMAIN} ]]; then
cat >> ${SSL_CONFIG} <<EOM
subjectAltName = @alt_names
[alt_names]
EOM
IFS=","
dns=(${SSL_TRUSTED_DOMAIN})
dns+=(${SSL_DOMAIN})
for i in "${!dns[@]}"; do
echo DNS.$((i+1)) = ${dns[$i]} >> ${SSL_CONFIG}
done
if [[ -n ${SSL_TRUSTED_IP} ]]; then
ip=(${SSL_TRUSTED_IP})
for i in "${!ip[@]}"; do
echo IP.$((i+1)) = ${ip[$i]} >> ${SSL_CONFIG}
done
fi
fi
echo -e "\033[32m ====> 4. 生成服务SSL KEY ${SSL_KEY} \033[0m"
openssl genrsa -out ${SSL_KEY} ${SSL_SIZE}
echo -e "\033[32m ====> 5. 生成服务SSL CSR ${SSL_CSR} \033[0m"
openssl req -sha256 -new -key ${SSL_KEY} -out ${SSL_CSR} -subj "/C=${CN}/CN=${SSL_DOMAIN}" -config ${SSL_CONFIG}
echo -e "\033[32m ====> 6. 生成服务SSL CERT ${SSL_CERT} \033[0m"
openssl x509 -sha256 -req -in ${SSL_CSR} -CA ${CA_CERT} \
-CAkey ${CA_KEY} -CAcreateserial -out ${SSL_CERT} \
-days ${SSL_DATE} -extensions v3_req \
-extfile ${SSL_CONFIG}
echo -e "\033[32m ====> 7. 证书制作完成 \033[0m"
echo
echo -e "\033[32m ====> 8. 以YAML格式输出结果 \033[0m"
echo "----------------------------------------------------------"
echo "ca_key: |"
cat $CA_KEY | sed 's/^/ /'
echo
echo "ca_cert: |"
cat $CA_CERT | sed 's/^/ /'
echo
echo "ssl_key: |"
cat $SSL_KEY | sed 's/^/ /'
echo
echo "ssl_csr: |"
cat $SSL_CSR | sed 's/^/ /'
echo
echo "ssl_cert: |"
cat $SSL_CERT | sed 's/^/ /'
echo
echo -e "\033[32m ====> 9. 附加CA证书到Cert文件 \033[0m"
cat ${CA_CERT} >> ${SSL_CERT}
echo "ssl_cert: |"
cat $SSL_CERT | sed 's/^/ /'
echo
echo -e "\033[32m ====> 10. 重命名服务证书 \033[0m"
echo "cp ${SSL_DOMAIN}.key tls.key"
cp ${SSL_DOMAIN}.key tls.key
echo "cp ${SSL_DOMAIN}.crt tls.crt"
cp ${SSL_DOMAIN}.crt tls.crt</code></pre>
<h1>2.脚本说明</h1>
<ul>
<li>复制以上代码另存为create_self-signed-cert.sh或者其他您喜欢的文件名。</li>
<li>脚本参数
<code>--ssl-domain</code>: 生成ssl证书需要的主域名，如不指定则默认为www.rancher.local，如果是ip访问服务，则可忽略；
<code>--ssl-trusted-ip</code>: 一般ssl证书只信任域名的访问请求，有时候需要使用ip去访问server，那么需要给ssl证书添加扩展IP，多个IP用逗号隔开；
<code>--ssl-trusted-domain</code>: 如果想多个域名访问，则添加扩展域名（TRUSTED_DOMAIN）,多个TRUSTED_DOMAIN用逗号隔开；
<code>--ssl-size</code>: ssl加密位数，默认2048；
<code>--ssl-cn</code>: 国家代码(2个字母的代号),默认CN；
使用示例:
./create_self-signed-cert.sh --ssl-domain=www.test.com --ssl-trusted-domain=www.test2.com \
--ssl-trusted-ip=1.1.1.1,2.2.2.2,3.3.3.3 --ssl-size=2048 --ssl-date=3650</li>
</ul>
<p>我的示例：</p>
<pre><code class="language-bash">./create_self-signed-cert.sh --ssl-domain=rancher.hzsun.com \
--ssl-trusted-ip=172.16.7.200,172.16.7.201 --ssl-size=2048 --ssl-date=3650</code></pre>
<hr />
<h1>3. 验证证书</h1>
<p>以下验证已操作，验证上面脚本生成可用。下次可不再验证。</p>
<ul>
<li>注意: 因为使用的是自签名证书，浏览器会提示证书的颁发机构是未知的。
如果在生成私钥时使用了密码，还要去除私钥的密码，去除私钥密码操作：
<pre><code class="language-bash">openssl rsa -in rancher.hzsun.com.key -out newrancher.hzsun.com.key</code></pre>
<p>把生成的 ca 证书和去除密码的私钥文件部署到 web 服务器</p></li>
</ul>
<pre><code class="language-bash">[root@rancher-slb ssl-self]# cat /etc/nginx/conf.d/default.conf
server {
listen 80;
listen 443 ssl;
server_name rancher.techzsun.com;
ssl_certificate /opt/ssl-self/rancher.hzsun.com.crt;
ssl_certificate_key /opt/ssl-self/newrancher.hzsun.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# 自动跳转到HTTPS
if ($server_port = 80) {
rewrite ^(.*)$ https://$host$1 permanent;
}
#charset koi8-r;
#access_log /var/log/nginx/host.access.log main;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}</code></pre>
<p>/etc/nginx/nginx.conf采用默认值。</p>
<p>把生成的 ca 证书和去除密码的私钥文件部署到 web 服务器后，执行以下命令验证:</p>
<ul>
<li>通过 openssl 本地校验</li>
</ul>
<pre><code class="language-bash">openssl verify -CAfile cacerts.pem tls.crt # 应该返回状态为 ok</code></pre>
<p><img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/918dabad35e4b34a779a57a23f85eb2a?showdoc=.jpg" alt="" />
执行后查看对应的域名和扩展 iP 是否正确</p>
<pre><code class="language-bash">openssl x509 -in tls.crt -noout -text</code></pre>
<p><img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/f51f1be22dd6c9f7d2cc0ab2ba4b16e6?showdoc=.jpg" alt="" />
<img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/1bd2c64fce2251eb98f49f53e7106245?showdoc=.jpg" alt="" />
<img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/4050b66bca481f3a8a0010f80c977dfe?showdoc=.jpg" alt="" />
<img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/ad5115daa97423e81380f7460f0ccca8?showdoc=.jpg" alt="" /></p>
<ul>
<li>不加 CA 证书验证</li>
</ul>
<pre><code class="language-bash">openssl s_client -connect demo.rancher.com:443 -servername demo.rancher.com</code></pre>
<p><img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/2a6f34f7c7f3577a2b2e123bffcf5e60?showdoc=.jpg" alt="" />
<img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/8ea0fdf8135b158d740fabae210fb003?showdoc=.jpg" alt="" /></p>
<ul>
<li>添加 CA 证书验证</li>
</ul>
<pre><code class="language-bash">openssl s_client -connect demo.rancher.com:443 -servername demo.rancher.com -CAfile server-ca.crt</code></pre>
<p><img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/5e9d4cc17ec846189fa3910400018cdb?showdoc=.jpg" alt="" />
<img src="https://www.showdoc.com.cn/server/api/attachment/visitfile/sign/920e9e6821ea2a4da5fa967d5f13d625?showdoc=.jpg" alt="" /></p>
<p>来源：
1.官网文档
<a href="https://docs.rancher.cn/docs/rancher2/installation/options/self-signed-ssl/_index/#4-%E5%A6%82%E4%BD%95%E7%94%9F%E6%88%90%E8%87%AA%E7%AD%BE%E5%90%8D%E8%AF%81%E4%B9%A6">https://docs.rancher.cn/docs/rancher2/installation/options/self-signed-ssl/_index/#4-%E5%A6%82%E4%BD%95%E7%94%9F%E6%88%90%E8%87%AA%E7%AD%BE%E5%90%8D%E8%AF%81%E4%B9%A6</a></p>
<p>2.去除私钥密码
<a href="https://www.jianshu.com/p/6c365dd2c473">https://www.jianshu.com/p/6c365dd2c473</a></p>
<p>3.Nginx配置SSL自签名证书的方法
<a href="https://www.jb51.net/article/140586.htm">https://www.jb51.net/article/140586.htm</a>
<a href="https://www.cnblogs.com/chnmig/p/10343890.html">https://www.cnblogs.com/chnmig/p/10343890.html</a></p>