arno/gencert
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
734c1b3938
gencert/README.md
Andrey Arapov 734c1b3938
update
2018-06-30 20:36:28 +02:00

2.4 KiB
Raw Blame History

gencert

Purpose

  • This script will always produce a self-signed x509 certificate in the current path with the IP addresses embedded to x509's SAN. It will also produce a CA certificate and can be used by other services which may need to authenticate against this self-signed certificate. The authentication works in a way that a public CA certificate will be used by the client in order to validate the server's certificate.

Application

Backend requiring x509 running behind reverse proxy

  • This script has been created in order to ease the Minio's SSE-C (Server Side Encryption - Customer provided keys) enablement when Minio server is running as a backend behind a reverse proxy like Traefik. Minio server enables SSE-C only when it detects the x509 certificates. Traefik running with docker service provider talks to the backend using the IP. The IP usually is not static, hence this script comes handy.

Example usage

Minio server with Traefik example

  1. Replace "minio server" command with the following one:
    • "cd /root/.minio/certs && ./gencert.sh --cn minio.example.com && minio server"
  2. Copy the CA certificate "ca.crt" file to "/usr/local/share/ca-certificates/" and run "update-ca-certificates" command which will update "/etc/ssl/certs/ca-certificates.crt" file.
  3. Restart Traefik.

NOTE: Steps 2. and 3. will need to be repeated each time you get a new CA certificate. Then they can be automated this way: - Start Traefik with this command: sh -c "update-ca-certificates && traefik" while "/usr/local/share/ca-certificates" path is a host mounted path with the CA certificate produced by this script. NOTE: I am using Alpine Traefik image, the correct ca certificates path is "/usr/local/share/ca-certificates/", otherwise one of these https://golang.org/src/crypto/x509/root_linux.go

Script logic

  • generate CA cert if does not find any.
  • always generate server cert on startup to ensure all IP addresses are in x509 SAN.
  • warn if the CA cert about to expire (<30 days till expiration).
  • regenerate the CA cert if it finds it has expired.

Notes

  • The CA cert will be valid for 3650 days (10 years).
  • The server cert will be valid for 365 days (1 year).
  • The x509 certs are ECDSA with prime256v1 curve and SHA256 signatures.