局域網(wǎng)自簽名https證書(shū)

server {
    listen 8080 ssl; #端口增加SSL支持
    server_name _;
        charset utf-8;
    # ssl on;
    ssl_certificate /data/app/nginx/nginx/cert/server.crt;# 證書(shū)文件
    ssl_certificate_key /data/app/nginx/nginx/cert/server.key; #私鑰文件
    # access_log ./logs/access_stream.log main;
    # error_log ./logs/error_stream.log;

    location / {
                root /home/nginx/knowledge2.0/;
                index index.html;
        }

        error_page 500 502 503 504  /50x.html;
        location = /50x.html {
                root html;
        }
}

extendedKeyUsage = serverAuth, clientAuth
basicConstraints = CA:FALSE
keyUsage = nonRepudiation,digitalSignature,keyEncipherment
subjectAltName = @alt_names


[alt_names]
IP.1=172.1.0.1
DNS.1=www.test.com

創(chuàng)建證書(shū)目錄：/root/cert，進(jìn)入/root/cert 創(chuàng)建 rootCA.key
$ openssl genrsa -des3 -out rootCA.key 2048
使用生成的密鑰(rootCA.key)來(lái)創(chuàng)建新的根SSL證書(shū)。并將其保存為rootCA.pem，證書(shū)有效期為10年
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem

Enter pass phrase for rootCA.key:
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Zhengzhou
Locality Name (eg, city) []:Zhengzhou
Organization Name (eg, company) [Internet Widgits Pty Ltd]:todocoderCA
Organizational Unit Name (eg, section) []:todocoderCA
Common Name (e.g. server FQDN or YOUR name) []:RootTodoCoder Cert
Email Address []:todocoder@github.com

$ openssl x509 -outform der -in rootCA.pem -out rootCA.crt
提示填寫的字段大多都可以直接回車過(guò)就行了，只要Common Name字段需要填寫內(nèi)容，這是生成跟證書(shū)后導(dǎo)入到系統(tǒng)的證書(shū)名稱，我填的是RootTodoCoder Cert

創(chuàng)建生成域名ssl證書(shū)的前置文件
在這里我生成一個(gè) td.todocoder.com 的域名證書(shū)。創(chuàng)建一個(gè)td.ext文件，以創(chuàng)建一個(gè)X509 v3證書(shū)。注意我們指定了subjectAltName選項(xiàng)。

cat >> td.ext <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage=digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=@alt_names

[alt_names]
DNS.1 = td.todocoder.com
EOF
這里的 [alt_names] 域中即為我們需要指定的 subjectAltName，可以配置多個(gè) IP，DNS 或其他值。

生成域名ssl證書(shū)秘鑰（tdtodocoder.csr、tdtodocoder.key）
$ openssl req -new -sha256 -nodes -out tdtodocoder.csr -newkey rsa:2048 -keyout tdtodocoder.key

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Zhengzhou
Locality Name (eg, city) []:Zhengzhou
Organization Name (eg, company) [Internet Widgits Pty Ltd]:todocoder
Organizational Unit Name (eg, section) []:todocoder
Common Name (e.g. server FQDN or YOUR name) []:td.todocoder.com
Email Address []:todocoder@github.com
A challenge password []:rootCA
An optional company name []:todocoder

$ openssl x509 -req -in tdtodocoder.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out tdtodocoder.crt -days 500 -sha256 -extfile td.ext
以上，我們把域名 td.todocoder.com的證書(shū)已經(jīng)創(chuàng)建好了，文件目錄如下：

.
├── rootCA.crt
├── rootCA.key
├── rootCA.pem
├── td.ext
├── tdtodocoder.crt
├── tdtodocoder.csr
└── tdtodocoder.key

server {
      listen 443 ssl;
      # 以td.todocoder.com域名訪問(wèn)
      server_name td.todocoder.com;

      # 配置ssl域名證書(shū)
      ssl_certificate     [ssl證書(shū)路徑]/tdtodocoder.crt;
      ssl_certificate_key [ssl證書(shū)路徑]/tdtodocoder.key;

      index index.html index.php;
      # 反向代理需要被訪問(wèn)的本地服務(wù)
      location / {
        proxy_pass http://localhost:8080;
      }
      ...
  }
自簽名的域名訪問(wèn)需要配置host
vi /etc/hosts
192.168.111.37 td.todocoder.com

$ kubectl -n todocoder create secret tls tdtodocoder-certs --key tdtodocoder.key --cert tdtodocoder.crt
# 重啟ingress controller
$ kubectl rollout restart daemonset.apps/nginx-ingress-controller -n ingress-nginx
配置ingress yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-todocoder
  namespace: todocoder
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
    - hosts:
        - "td.todocoder.com"
      secretName: tdtodocoder-certs
  ingressClassName: nginx
  rules:
    - host: "td.todocoder.com"
      http:
        paths:
          - backend:
              service:
                name: todocoder-front
                port:
                  number: 8080
            path: /?(.*)
            pathType: ImplementationSpecific

cat >> fanym.ext <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage=digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=@alt_names

[alt_names]
DNS.1 = *.todocoder.com
EOF

$ openssl req -new -sha256 -nodes -out fantodocoder.csr -newkey rsa:2048 -keyout fantodocoder.key

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Zhengzhou
Locality Name (eg, city) []:Zhengzhou
Organization Name (eg, company) [Internet Widgits Pty Ltd]:fantodocoder
Organizational Unit Name (eg, section) []:fantodocoder
Common Name (e.g. server FQDN or YOUR name) []:*.todocoder.com
Email Address []:todocoder@github.com
...
A challenge password []:rootCA
An optional company name []:fantodocoder

$ openssl x509 -req -in fantodocoder.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out fantodocoder.crt -days 500 -sha256 -extfile fanym.ext

Certificate request self-signature ok
subject=C = CN, ST = Zhengzhou, L = Zhengzhou, O = fantodocoder, OU = fantodocoder, CN = *.todocoder.com, emailAddress = todocoder@github.com
Enter pass phrase for rootCA.key:
當(dāng)前的目錄結(jié)構(gòu)：

.
├── fantodocoder.crt
├── fantodocoder.csr
├── fantodocoder.key
├── fanym.ext
├── rootCA.crt
├── rootCA.key
├── rootCA.pem
├── td.ext
├── tdtodocoder.crt
├── tdtodocoder.csr
└── tdtodocoder.key
Nginx 配置
server {
      listen 443 ssl;
      server_name *.todocoder.com;
      # 配置ssl域名證書(shū)
      ssl_certificate     [ssl證書(shū)路徑]/fantodocoder.crt;
      ssl_certificate_key [ssl證書(shū)路徑]/fantodocoder.key;

      index index.html index.php;
      # 反向代理需要被訪問(wèn)的本地服務(wù)
      location / {
        proxy_pass http://localhost:8080;
      }
      ...
  }

拷貝證書(shū)到ca證書(shū)的目錄
$ sudo cp tdtodocoder.crt /usr/share/ca-certificates/mozilla/tdtodocoder.crt
$ sudo cp fantodocoder.crt /usr/share/ca-certificates/mozilla/fantodocoder.crt
$ sudo cp rootCA.crt /usr/share/ca-certifi
cates/mozilla/rootCA.crt
執(zhí)行下面的命令按提示選中新添加的證書(shū)，確定(點(diǎn)回車) ，選中（點(diǎn)空格鍵）然后選 ”O(jiān)K” 就行了
$ sudo dpkg-reconfigure ca-certificates

Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
rehash: warning: skipping rootCA.pem,it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
正在處理用于 ca-certificates (20230311ubuntu0.22.04.1) 的觸發(fā)器 ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.