1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# generate CA private key
openssl genrsa -out ca.key 2048

# Generate CSR
# c: 国家名，st：省份，L：城市，O：组织名，OU：组织单元名，CN：common name
# /C=CN/ST=HuBei/L=WuHan/O=BBFE/OU=ATS/CN=thisiaatest
openssl req -new -key ca.key -out ca.csr

# Add DNS and IP
echo "subjectAltName=DNS:superedge.io,IP:127.0.0.1" > ca_cert_extensions
# 某些特殊场景，需要这样弄：
echo -e "subjectKeyIdentifier=hash\nbasicConstraints=CA:true" > ca_cert_extensions

# Generate Self Signed certificate
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -extfile ca_cert_extensions -out ca.crt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# private key
openssl genrsa -des3 -out server.key 2048

# generate csr
openssl req -new -key server.key -subj "/CN=tunnel-cloud" -out server.csr

# Add DNS and IP, 必须填写 "DNS:tunnelcloud.io"
echo "subjectAltName=DNS:tunnelcloud.io,IP:127.0.0.1" > server_cert_extensions

# Generate Self Signed certificate
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -extfile server_cert_extensions -out server.crt

# 验证生成的证书：
openssl x509 -in "server.crt" -noout -text

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#生成lite-apiserver.key
$ openssl genrsa -out lite-apiserver.key 2048

#创建lite-apiserver.csr
$ cat << EOF >lite-apiserver.conf
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
[req_distinguished_name]
CN = lite-apiserver
[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
IP.1 = 127.0.0.1
IP.2 = 10.10.0.1 # 请改成对应kubernetes的ClusterIP
EOF

$ openssl req -new -key lite-apiserver.key -subj "/CN=lite-apiserver" -config lite-apiserver.conf -out lite-apiserver.csr

# 验证CSR的SAN
openssl req -in lite-apiserver.csr -noout -text

#生成lite-apiserver.crt
openssl x509 -req -in lite-apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 5000 -extensions v3_req -extfile lite-apiserver.conf -out lite-apiserver.crt

# 验证crt的SAN
openssl x509 -in lite-apiserver.crt -noout -text

1
2
3
4
5

$ openssl s_client -showcerts -connect sp.test.cloud-industry-delivery.site:443

# 阿里云盾并没有在TCP建立连接时就针对源目的IP做阻断，而是提取ClientHello中的SNI(Servername Indication)
# 域名信息判断是否备案而做阻断，返回TCP RESET。 见： https://zhuanlan.zhihu.com/p/72982104
# -servername host  - Set TLS extension servername in ClientHello，它会影响到网络报文的SNI字段

1
2
3
4

$ chmod u+w /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
或者
$ chmod u+w /etc/pki/tls/certs/ca-bundle.crt
然后把7中查询到的证书链放到上面chmod u+x的文件中