starlingx/docs
Code Issues Proposed changes
docs/doc/source/security/kubernetes/create-certificates-locally-using-openssl.rst
Juanita Balaraj cb0245cfab Added RSA Key length (dsr8) 
Modified the note to include <the certificate file>
Removed trailing spaces and fixed Patchset 7 comments
Updated Patchset 6 comments and removed the word platform
Fixed formatting issues
Updated Patchset 4 comments
Added additional notes in multiple topics listed in the review
Updated the Security / Upgrade Guide with a note
Change-Id: If0a88e88268b2a4540b6abf97bc7b5ca9049747c
Signed-off-by: Juanita Balaraj <juanita.balaraj@windriver.com>

Change-Id: I5686cda10f4ac9b184f5ac1e6ceec003b09155d2
2023-06-28 04:44:19 +00:00

2.2 KiB
Raw Blame History

Create Certificates Locally using openssl

You can use openssl to locally create certificates suitable for use in a lab environment.

Note

Ensure the certificates have RSA key length >= 2048 bits. The Release provides a new version of openssl which requires a minimum of 2048-bit keys for RSA for better security / encryption strength.

You can check the key length by running openssl x509 -in <the certificate file> -noout -text and looking for the "Public-Key" in the output.

  1. Create a Root Certificate and Key

    1. Create the Root CA private key.

      $ openssl genrsa -out my-root-ca-key.pem 2048

    2. Generate the Root CA x509 certificate.

      $ openssl req -x509 -new -nodes -key my-root-ca-key.pem \
-days 1024 -out my-root-ca-cert.pem -outform PEM
  2. Create and Sign a Server Certificate and Key.

    1. Create the Server private key.

      $ openssl genrsa -out my-server-key.pem 2048

    2. Create the Server certificate signing request (csr).

      Specify "CN=registry.local" and do not specify a challenge password.

      $ openssl req -new -key my-server-key.pem -out my-server.csr

    3. Create the list.

      $ echo subjectAltName = IP:<WRCP-OAM-Floating-IP>,IP:<WRCP-MGMT-Floating-IP>,DNS:registry.local,DNS:registry.central > extfile.cnf

    4. Use the my-root-ca to sign the server certificate.

      $ openssl x509 -req -in my-server.csr -CA my-root-ca-cert.pem \
-CAkey my-root-ca-key.pem -CAcreateserial -out my-server-cert.pem \
-days 365 -extfile extfile.cnf

    5. Put the server certificate and key into a single file.

      $ cat my-server-cert.pem my-server-key.pem > my-server.pem