51 lines
2.4 KiB
Markdown
51 lines
2.4 KiB
Markdown
# gencert
|
|
|
|
## Purpose
|
|
- This script will always produce a self-signed x509 certificate in the
|
|
current path with the IP addresses embedded to x509's SAN.
|
|
It will also produce a CA certificate and can be used by other services
|
|
which may need to authenticate against this self-signed certificate.
|
|
The authentication works in a way that a public CA certificate will be
|
|
used by the client in order to validate the server's certificate.
|
|
|
|
## Application
|
|
Backend requiring x509 running behind reverse proxy
|
|
- This script has been created in order to ease the Minio's SSE-C
|
|
(Server Side Encryption - Customer provided keys) enablement when
|
|
Minio server is running as a backend behind a reverse proxy like Traefik.
|
|
Minio server enables SSE-C only when it detects the x509 certificates.
|
|
Traefik running with docker service provider talks to the backend using
|
|
the IP. The IP usually is not static, hence this script comes handy.
|
|
|
|
## Example usage
|
|
### Minio server with Traefik example
|
|
|
|
1. Replace "minio server" command with the following one:
|
|
- "cd /root/.minio/certs && ./gencert.sh --cn minio.example.com && minio server"
|
|
2. Copy the CA certificate "ca.crt" file to "/usr/local/share/ca-certificates/" and
|
|
run "update-ca-certificates" command which will update
|
|
"/etc/ssl/certs/ca-certificates.crt" file.
|
|
3. Restart Traefik.
|
|
|
|
> NOTE: Steps 2. and 3. will need to be repeated each time you get a new CA
|
|
> certificate. Then they can be automated this way:
|
|
> - Start Traefik with this command:
|
|
> sh -c "update-ca-certificates && traefik"
|
|
> while "/usr/local/share/ca-certificates" path is a host mounted
|
|
> path with the CA certificate produced by this script.
|
|
> NOTE: I am using Alpine Traefik image, the correct ca certificates path is
|
|
> "/usr/local/share/ca-certificates/", otherwise one of these
|
|
> https://golang.org/src/crypto/x509/root_linux.go
|
|
|
|
## Script logic
|
|
- generate CA cert if does not find any.
|
|
- always generate server cert on startup to ensure all IP addresses are in
|
|
x509 SAN.
|
|
- warn if the CA cert about to expire (<30 days till expiration).
|
|
- regenerate the CA cert if it finds it has expired.
|
|
|
|
## Notes
|
|
- The CA cert will be valid for 3650 days (10 years).
|
|
- The server cert will be valid for 365 days (1 year).
|
|
- The x509 certs are ECDSA with prime256v1 curve and SHA256 signatures.
|