arno/gencert
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

update

Browse Source
This commit is contained in:
Andy 2018-06-30 20:36:28 +02:00
parent 5fd26378ef
commit 734c1b3938
Signed by: arno
GPG Key ID: 9076D5E6B31AE99C
2 changed files with 50 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
README.md
View File

@ -1,3 +1,50 @@
# gencert
generates self-signed x509 with CA and IPs in SAN
## Purpose
- This script will always produce a self-signed x509 certificate in the
current path with the IP addresses embedded to x509's SAN.
It will also produce a CA certificate and can be used by other services
which may need to authenticate against this self-signed certificate.
The authentication works in a way that a public CA certificate will be
used by the client in order to validate the server's certificate.
## Application
Backend requiring x509 running behind reverse proxy
- This script has been created in order to ease the Minio's SSE-C
(Server Side Encryption - Customer provided keys) enablement when
Minio server is running as a backend behind a reverse proxy like Traefik.
Minio server enables SSE-C only when it detects the x509 certificates.
Traefik running with docker service provider talks to the backend using
the IP. The IP usually is not static, hence this script comes handy.
## Example usage
### Minio server with Traefik example
1. Replace "minio server" command with the following one:
- "cd /root/.minio/certs && ./gencert.sh --cn minio.example.com && minio server"
2. Copy the CA certificate "ca.crt" file to "/usr/local/share/ca-certificates/" and
run "update-ca-certificates" command which will update
"/etc/ssl/certs/ca-certificates.crt" file.
3. Restart Traefik.
> NOTE: Steps 2. and 3. will need to be repeated each time you get a new CA
> certificate. Then they can be automated this way:
> - Start Traefik with this command:
> sh -c "update-ca-certificates && traefik"
> while "/usr/local/share/ca-certificates" path is a host mounted
> path with the CA certificate produced by this script.
> NOTE: I am using Alpine Traefik image, the correct ca certificates path is
> "/usr/local/share/ca-certificates/", otherwise one of these
> https://golang.org/src/crypto/x509/root_linux.go
## Script logic
- generate CA cert if does not find any.
- always generate server cert on startup to ensure all IP addresses are in
x509 SAN.
- warn if the CA cert about to expire (<30 days till expiration).
- regenerate the CA cert if it finds it has expired.
## Notes
- The CA cert will be valid for 3650 days (10 years).
- The server cert will be valid for 365 days (1 year).
- The x509 certs are ECDSA with prime256v1 curve and SHA256 signatures.

51
gencert.sh
View File

@ -1,57 +1,10 @@
#!/bin/sh
# Filename: gencert.sh
# Description: generates self-signed x509 with CA and IPs in SAN
# Description: This script generates x509 server certificate (with all IPs in
# SAN) signed by a self-signed CA.
# Version: 0.1 - 30 June 2018
# Author: Andrey Arapov <andrey.arapov@nixaid.com>
# License: GPLv3
#
# Purpose
# - This script will always produce a self-signed x509 certificate in the
# current path with the IP addresses embedded to x509's SAN.
# It will also produce a CA certificate and can be used by other services
# which may need to authenticate against this self-signed certificate.
# The authentication works in a way that a public CA certificate will be
# used by the client in order to validate the server's certificate.
#
# Application
# Backend requiring x509 running behind reverse proxy
# - This script has been created in order to ease the Minio's SSE-C
# (Server Side Encryption - Customer provided keys) enablement when
# Minio server is running as a backend behind a reverse proxy like Traefik.
# Minio server enables SSE-C only when it detects the x509 certificates.
# Traefik running with docker service provider talks to the backend using
# the IP. The IP usually is not static, hence this script comes handy.
#
# Example usage
# Minio server with Traefik example
# 1. Replace "minio server" command with the following one:
# - "cd /root/.minio/certs && ./gencert.sh --cn minio.example.com && minio server"
# 2. Copy the CA certificate "ca.crt" file to "/usr/local/share/ca-certificates/" and
# run "update-ca-certificates" command which will update
# "/etc/ssl/certs/ca-certificates.crt" file.
# 3. Restart Traefik.
#
# NOTE: Steps 2. and 3. will need to be repeated each time you get a new CA
# certificate. Then they can be automated this way:
# - Start Traefik with this command:
# sh -c "update-ca-certificates && traefik"
# while "/usr/local/share/ca-certificates" path is a host mounted
# path with the CA certificate produced by this script.
# NOTE: I am using Alpine Traefik image, the correct ca certificates path is
# "/usr/local/share/ca-certificates/", otherwise one of these
# https://golang.org/src/crypto/x509/root_linux.go
#
# Script logic
# - generate CA cert if does not find any.
# - always generate server cert on startup to ensure all IP addresses are in
# x509 SAN.
# - warn if the CA cert about to expire (<30 days till expiration).
# - regenerate the CA cert if it finds it has expired.
#
# Notes
# - The CA cert will be valid for 3650 days (10 years).
# - The server cert will be valid for 365 days (1 year).
# - The x509 certs are ECDSA with prime256v1 curve and SHA256 signatures.
ME=$(printf '%s\n' "${0##*/}")