onevibe12/selfsign-ssl repository overview

아래 간단한 사용법

docker run -v /etc/certs:/certs \
  -e SSL_SUBJECT=nginx.example.com\
  -e SSL_DNS=nginx.example.com  \
  onevibe12/selfsign-ssl

Customize the certs using the following Environment Variables:

CA_KEY CA Key file, default ca-key.pem [1]
CA_CERT CA Certificate file, default ca.pem [1]
CA_SUBJECT CA Subject, default test-ca
CA_EXPIRE CA Expiry, default 60 days
SSL_CONFIG SSL Config, default openssl.cnf [1]
SSL_KEY SSL Key file, default key.pem
SSL_CSR SSL Cert Request file, default key.csr
SSL_CERT SSL Cert file, default cert.pem
SSL_SIZE SSL Cert size, default 2048 bits
SSL_EXPIRE SSL Cert expiry, default 60 days
SSL_SUBJECT SSL Subject default example.com
SSL_DNS comma seperate list of alternative hostnames, no default [2]
SSL_IP comma seperate list of alternative IPs, no default [2]
[1] If file already exists will re-use.

[2] If SSL_DNS or SSL_IP is set will add SSL_SUBJECT to alternative hostname list

⁠Credits to https://github.com/paulczar/omgwtfssl⁠ This is the same image with the addition to add CA:TRUE as in basicConstraints: https://github.com/superseb/omgwtfssl/commit/a7deb55bf36a7873341fa06451301e012a2c260e⁠

⁠고급 사용법

다음 환경 변수를 사용하여 인증서를 사용자 지정합니다.

CA_KEYCA 키 파일, 기본값 ca-key.pem [1] CA_CERTCA 인증서 파일, 기본값 ca.pem [1] CA_SUBJECTCA 제목, 기본값test-ca CA_EXPIRECA 만료, 기본 60날짜 SSL_CONFIGSSL 구성, 기본값 openssl.cnf [1] SSL_KEYSSL 키 파일, 기본값key.pem SSL_CSRSSL 인증서 요청 파일, 기본값key.csr SSL_CERTSSL 인증서 파일, 기본값cert.pem SSL_SIZESSL 인증서 크기, 기본 2048비트 SSL_EXPIRESSL 인증서 만료, 기본 60날짜 SSL_SUBJECTSSL 주제 기본값example.com SSL_DNS쉼표로 구분된 대체 호스트 이름 목록, 기본값 없음 [2] SSL_IP쉼표로 구분된 대체 IP 목록, 기본값 없음 [2]

[1] 파일이 이미 존재하면 다시 사용합니다. [2] SSL_DNS또는 SSL_IP가 설정되면 SSL_SUBJECT대체 호스트 이름 목록에 추가됩니다.

예 NGINX용 인증서 생성 SSL 테스트를 위한 웹 인증서 생성이 훨씬 쉬워졌습니다...

인증서 생성:

$ docker run -v /tmp/certs:/certs \
  -e SSL_SUBJECT=test.example.com   paulczar/omgwtfssl
SSL 활성화 /etc/nginx/sites-enabled/default:

server {
        listen 443 ssl;
        server_name test.example.com;
        root html;
        index index.html index.htm;

        ssl_certificate /tmp/certs/cert.pem;
        ssl_certificate_key /tmp/certs/key.pem;
        ssl_session_timeout 5m;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;
        location / {
                try_files $uri $uri/ =404;
        }
}

NGINX를 다시 시작하고 다음을 테스트합니다.

$ service nginx restart
$ echo '127.0.2.1       test.example.com' >> /etc/hosts
$ curl --cacert /tmp/certs/ca.pem https://test.example.com
<!DOCTYPE html>
<html>
<head>
...

⁠도커 레지스트리용 키 생성

paulczar/omgwtfsslDocker Registry 이미지에 대한 SSL 인증서를 빌드하고 호스팅하기 위해 볼륨 컨테이너로 사용하는 약간 더 흥미로운 예

다음에서 레지스트리에 대한 볼륨 컨테이너를 만듭니다 paulczar/omgwtfssl.

$ docker run \
  --name certs \
  -e SSL_SUBJECT=test.example.com \
  paulczar/omgwtfssl
----------------------------
| OMGWTFSSL Cert Generator |
----------------------------

--> Certificate Authority ====> Generating new CA key ca-key.pem Generating RSA private key, 2048 bit long modulus ..........+++ .......................................................+++ e is 65537 (0x10001) ====> Generating new CA Certificate ca.pem ====> Generating new config file openssl.cnf ====> Generating new SSL KEY key.pem Generating RSA private key, 2048 bit long modulus ........................................................................................................................................................+++ ...+++ e is 65537 (0x10001) ====> Generating new SSL CSR key.csr ====> Generating new SSL CERT cert.pem Signature ok subject=/CN=test.example.com Getting CA Private Key --volumes-from위에서 만든 볼륨 컨테이너를 사용하여 레지스트리를 실행합니다 .

$ docker run -d
--name registry
--volumes-from certs
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/cert.pem
-e REGISTRY_HTTP_TLS_KEY=/certs/key.pem
-p 5000:5000
registry:2 작동하는지 확인하십시오.

$ echo "127.0.2.1 test.example.com" >> /etc/hosts $ docker tag paulczar/omgwtfssl test.example.com:5000/omgwtfbbq $ docker push test.example.com:5000/omgwtfbbq The push refers to a repository [test.example.com:5000/omgwtfbbq] (len: 1) e34964fe7cfa: Pushed d52b82eb9ff3: Pushed 6b030e7d76a6: Pushed 8a648f689ddb: Pushed latest: digest: sha256:8a97202b0ad9b375ff478d84ed948ae7ddd298196fd3b341fc8391a0fe71345a size: 7617

⁠Ingress와 함께 사용할 Kubernetes 시크릿용 키 생성:

다음 환경 변수는 Kubernetes 비밀을 제어하는 ​​데 도움이 됩니다.

K8S_NAME(omgwtfssl) K8S_NAMESPACE(기본) K8S_SAVE_CA_KEY(거짓) K8S_SAVE_CA_CRT(거짓) SILENT(진실) 예시 매니페스트는 에서 찾을 수 있습니다 examples/minikube/omgwtfssl.yaml.

$ kubectl apply -f examples/minikube
configmap "omgwtfssl" created
job "omgwtfssl" created

$ kc get pods -a
NAME              READY     STATUS      RESTARTS   AGE
omgwtfssl-blz7m   0/1       Completed   0          2m

$ kubectl logs omgwtfssl-blz7m
secret "omgwtfssl" created
kubectl get secret omgwtfssl -o yaml
-----
apiVersion: v1
kind: Secret
metadata:
  name: omgwtfssl
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURHakNDQWdLZ0F3SUJBZ0lKQU5VWFdBaFJ4U0RqTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TXpBMU1qSXhOakF3V2hjTk1qZ3dNVEV5TWpJeE5qQXdXakFpTVNBdwpIZ1lEVlFRRERCY3FMakU1TWk0eE5qZ3VPVGt1TVRBd0xuaHBjQzVwYnpDQ0FTSXdEUVlKS29aSWh2Y05BUUVCCkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUtldG5qcWVXY1liWktvQ0JVWHp5NWxQRGszRFo3S0R2cDZWWFBQTGhPTy8Ka2w3NDAwd2JjcGQ5aXdHNFY5elV3RkRiTG83dkFEMVVIMVRDL2lzWUtCZ1dvK2s1UEQwVzVWTlFiRnlmRUtzYQpaUjNycHFsMC9vR2M2eXdvWi9rUlVaZlF2M0s1TUV1WHQ1enA1LzVycllVdHFpVUxadTVlYjc3UW1pWUpOemMyCjFEWVYvaWNYc2pxTmhNL05ZQmtGZWpjd0lvUWp0YmZTejl5YldXS2VESURLQVY4a0RsN2pFVlNHVFRGYllwSGkKMnVjS1BpOEZxTGNRZEVCSDB5NnR5Q3N6ZW01cnhWM2VBeFMrN2EvZ1JaWXpZN2RwdDlia1R3M1AyRytKOWFidgpIa0FHbHN0Z01nY2l0VThZb0c4dmRNM01rRy9ReGl0Sk5xVDNwQVJFN0JNQ0F3RUFBYU5qTUdFd0NRWURWUjBUCkJBSXdBREFMQmdOVkhROEVCQU1DQmVBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUIKTUNnR0ExVWRFUVFoTUIrQ0Z5b3VNVGt5TGpFMk9DNDVPUzR4TURBdWVHbHdMbWx2aHdUQXFHTmtNQTBHQ1NxRwpTSWIzRFFFQkN3VUFBNElCQVFCQ1BOeEpHNUIrQjFiaEZ4U09oTHNVdVhSb0s1QldHeS94OGw4dDdGU2VWYjhuCmJmd2VSSnZZV0U0WDZkRnZJV2dOdDRyYTFodHhGc2k1b0Nad1FBaXd0U0xSMzEydU11d0RxN09VY256LzNXSUwKQlRaeEJIaGZCZkNCMnlJZEp6a3YrQUsrSTFsQitxY1VFKzd2bVJOb3EzK1BOeXk2SUNBQUlpbTc5RW1BcVVodwp6YnQ1YnhqYmlteFJUMWQ5dWdnTC9lM3NqZFpRM1VJTEZzNkdNemNkWXQ5WHBTdWdsb1RKTHZOTThCampXOTl5CkFxWUdWYkltc3craFdUZFhIVGljZXgwOVFCa3p4RUxzYmszb0hLOWFoV3VDSmU2ZDB3emJiTldEUWlJcEgvN1EKSDB0V2kzNTBYOVZBV2lqQXdSZ3UybG1lcVp6bVlwNk1ibWQzcjFuMQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBcDYyZU9wNVp4aHRrcWdJRlJmUExtVThPVGNObnNv