This script generates x509 server certificate (with all IPs in SAN) signed by a self-signed CA
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Andrey Arapov 03517d8fbb
let a user specify his own DNS IP records
1 month ago
LICENSE update license 7 months ago let a user specify his own DNS IP records 1 month ago let a user specify his own DNS IP records 1 month ago add ability to specify RSA key instead of ECDSA 7 months ago


This script generates x509 server certificate (with DNS and IP in SAN) signed by a self-signed CA.


The whole idea is to run the script right before starting the service and then, making sure the reverse proxy updates its main CA bundle right before starting.

Some services require the certificate on their backend and would not be satisfied with the TLS termination elsewhere.

For example, one of such services is Minio. It requires its certificate in order to enable SSE-C (Server Side Encryption with Customer provided keys).

How does this script work

This script will always produce a self-signed x509 certificate with the DNS and IP addresses embedded to x509’s SAN.

It will also produce a CA certificate and can be used by other services which may need to authenticate against this self-signed certificate.

The authentication works in a way that a public CA certificate will be used by the client in order to validate the server’s certificate.

  • generate CA certificate if does not find any
  • always generate server certificate on startup to ensure all IP addresses are in x509 SAN
  • optionally, a user can specify his own IP or DNS SAN records (i.e. --san-dns localhost,
  • write CN to x509 SAN which is a must
  • warn if the CA certificate is about to expire (<30 days till expiration)
  • regenerate the CA certificate if it finds it has expired

The CA certificate will be valid for 3650 days (10 years) The server certifcate will be valid for 365 days (1 year) The x509 certs are ECDSA with prime256v1 curve and SHA256 signatures


Minio and Docker Registry services behind Traefik reverse proxy

  • docker-compose.yml

I intentionally left only the gencert-related lines.

If you are using Alpine based image, the correct CA certificates path is /usr/local/share/ca-certificates/, otherwise one of these

    image: minio/minio
      - /srv/data/minio/certs:/root/.minio/certs
      - /srv/services/gencert/
    entrypoint: sh -c "cd /root/.minio/certs &&
                       / --cn &&
                       minio server /data"
      - "MINIO_ACCESS_KEY=redacted"
      - "MINIO_SECRET_KEY=redacted"

    image: registry:2.6.2
      - /srv/services/gencert/
      - /srv/data/registry/certs:/certs
    entrypoint: sh -c "cd /certs &&
                       / --cn &&
                       registry serve /etc/docker/registry/config.yml"
      REGISTRY_HTTP_TLS_CERTIFICATE: '/certs/public.crt'
      REGISTRY_HTTP_TLS_KEY: '/certs/private.key'

    image: traefik:1.6-alpine
      - /srv/data/minio/certs/ca.crt:/usr/local/share/ca-certificates/minio_ca.crt:ro
      - /srv/data/registry/certs/ca.crt:/usr/local/share/ca-certificates/registry_ca.crt:ro
    command: sh -c "update-ca-certificates && traefik"
      - minio
      - registry

helloworld with socat

socat could be handy when you need to see the TLS flow between the reverse proxy and a backend.

It may also help you secure the traffic between the reverse proxy and a backend in case when the latter service does not support TLS on its own.

Minimum socat version should be so it will work with the ECDHE- OpenSSL ciphers.

    image: dockercloud/hello-world
      - /srv/services/gencert/
    entrypoint: sh -c "mkdir /certs && cd /certs &&
                       / --cn helloworld &&
                       ( nohup / & ) &&
                       echo '@edge' | tee -a /etc/apk/repositories &&
                       apk --update add socat@edge &&
                       socat -v -v -d -d OPENSSL-LISTEN:443,reuseaddr,verify=0,cafile=./ca.crt,cert=./public.crt,key=./private.key,fork TCP4-CONNECT:"
      traefik.enable: 'true'
      traefik.frontend.rule: 'Host:'
      traefik.frontend.entryPoints: 'http,https'
      traefik.backend.loadbalancer.stickiness: 'true'
      traefik.port: '443'
      traefik.protocol: 'https'

If you get sslv3 alert bad certificate error, then make sure you have either updated the CA bundle with your CA file which was used to sign your x509 certificates at the reverse proxy server or disable TLS verification between the reverse proxy and your backend (e.g. Traefik has a global option insecureSkipVerify = true)


I have added a simplistic script that helps to test this script in the following Linux distributions:

  • Alpine 3.4
  • Alpine 3.7
  • Ubuntu Bionic
  • Debian Stretch
  • CentOS 7

Alpine 3.4 - as it has old getent which misses ahostsv4