#!/bin/bash
mkdir -p /root/tls/pem
#DOMAIN_HOST=`ifconfig eth0 | grep "inet" | awk '{ print $2}' | sed -n '1p;1q'`
DOMAIN_HOST=`hostname`
HOST=$DOMAIN_HOST
# 自定義信息
PASSWORD="HeDongHudj"
COUNTRY=CN
PROVINCE=gd
CITY=gz
ORGANIZATION=dounine
GROUP=dg
NAME=lake
SUBJ="/C=$COUNTRY/ST=$PROVINCE/L=$CITY/O=$ORGANIZATION/OU=$GROUP/CN=$HOST"
# 自定義信息
#============================================================================================
#此形式是自己給自己簽發(fā)證書,自己就是CA機構(gòu),也可以交給第三方機構(gòu)去簽發(fā)
openssl genrsa -passout pass:$PASSWORD -aes256 -out /root/tls/pem/ca-key.pem 4096
# 2.用根證書RSA私鑰生成自簽名的根證書(營業(yè)執(zhí)照)
openssl req -new -x509 -days 365 -passin pass:$PASSWORD -key /root/tls/pem/ca-key.pem -sha256 -subj $SUBJ -out /root/tls/pem/ca.pem
#============================================================================================
#給服務(wù)器簽發(fā)證書
# 1.服務(wù)端生成自己的私鑰
openssl genrsa -out /root/tls/pem/server-key.pem 4096
# 2.服務(wù)端生成證書(里面包含公鑰與服務(wù)端信息)
openssl req -new -sha256 -key /root/tls/pem/server-key.pem -out /root/tls/pem/server.csr -subj "/CN=$DOMAIN_HOST"
# 3.通過什么形式與我進(jìn)行連接,可設(shè)置多個IP地扯用逗號分隔
echo subjectAltName=IP:x.x.x.x,IP:0.0.0.0 > /tmp/extfile.cnf
# 4.權(quán)威機構(gòu)對證書進(jìn)行進(jìn)行蓋章生效
openssl x509 -passin pass:$PASSWORD -req -days 365 -sha256 -in /root/tls/pem/server.csr -CA /root/tls/pem/ca.pem -CAkey /root/tls/pem/ca-key.pem -CAcreateserial -out /root/tls/pem/server-cert.pem -extfile /tmp/extfile.cnf
#============================================================================================
#給客戶端簽發(fā)證書
openssl genrsa -out /root/tls/pem/client-key.pem 4096
openssl req -subj '/CN=client' -new -key /root/tls/pem/client-key.pem -out /root/tls/pem/client.csr
echo extendedKeyUsage = clientAuth > /tmp/extfile.cnf
openssl x509 -passin pass:$PASSWORD -req -days 365 -sha256 -in /root/tls/pem/client.csr -CA /root/tls/pem/ca.pem -CAkey /root/tls/pem/ca-key.pem -CAcreateserial -out /root/tls/pem/client-cert.pem -extfile /tmp/extfile.cnf
#============================================================================================
# 清理文件
rm -rf /root/tls/pem/ca-key.pem
rm -rf /root/tls/pem/{server,client}.csr
rm -rf /root/tls/pem/ca.srl
# 最終文件
# ca.pem  ==  CA機構(gòu)證書
# client-cert.pem  ==  客戶端證書
# client-key.pem  ==  客戶私鑰
# server-cert.pem  == 服務(wù)端證書
# server-key.pem  ==  服務(wù)端私鑰

$ vi /usr/lib/systemd/system/docker.service

$ systemctl daemon-reload
$ systemctl restart docker