Comments (7)
I had to figure out the openssl commands for doing this recently. Might as well copy them here for posterity.
rm -f ca.{key,crt} test.{key,csr,crt}
rm -f index.txt* serial* *.pem
# Generate a self-signed CA.
openssl req -x509 -config openssl.cnf -nodes -days 365 \
-newkey rsa:1024 -subj "/C=US/ST=New York/L=New York/O=Cockroach/CN=Test CA" \
-extensions v3_ca -keyout ca.key -out ca.crt
# Create the certificate signing requests.
openssl req -config openssl.cnf -nodes -days 365 \
-newkey rsa:1024 -subj "/C=US/ST=New York/L=env:development/O=Cockroach/OU=test/CN=localhost" \
-keyout test.key -out test.csr
# Setup the files needed by the CA.
touch index.txt index.txt.attr
echo "01" > serial
# Generate the client and server certificates from the signing
# requests.
openssl ca -batch -config openssl.cnf -cert ca.crt -keyfile ca.key \
-extensions good_usr_crt -in test.csr -out test.crt
# Remove the files needed by the CA. These don't need to be checked in
# because we'll just recreate them if this script needs to be re-run.
rm -f index.txt* serial* *.pem *.csr ca.key
from cockroach.
Awesome.
On Tue, Jun 3, 2014 at 4:22 PM, Peter Mattis [email protected]
wrote:
I had to figure out the openssl commands for doing this recently. Might as
well copy them here for posterity.rm -f ca.{key,crt} test.{key,csr,crt}
rm -f index.txt* serial* *.pem
Generate a self-signed CA.openssl req -x509 -config openssl.cnf -nodes -days 365
-newkey rsa:1024 -subj "/C=US/ST=New York/L=New York/O=Cockroach/CN=Test
CA"
-extensions v3_ca -keyout ca.key -out ca.crt
Create the certificate signing requests.openssl req -config openssl.cnf -nodes -days 365
-newkey rsa:1024 -subj "/C=US/ST=New
York/L=env:development/O=Cockroach/OU=test/CN=localhost"
-keyout test.key -out test.csr
Setup the files needed by the CA.touch index.txt index.txt.attr
echo "01" > serial
Generate the client and server certificates from the signing requests.openssl ca -batch -config openssl.cnf -cert ca.crt -keyfile ca.key
-extensions good_usr_crt -in test.csr -out test.crt
Remove the files needed by the CA. These don't need to be checked in because
we'll just recreate them if this script needs to be re-run.rm -f index.txt* serial* *.pem *.csr ca.key
—
Reply to this email directly or view it on GitHub
#21 (comment)
.
from cockroach.
FYI go's crypto libraries include key generation stuff as well, so we might be able to do this without shelling out to openssl. I'm not sure which will turn out to be easier.
from cockroach.
We have a Go based client certificate authority here: https://github.com/coreos/etcd-ca and there is this too: https://github.com/cloudflare/cfssl
from cockroach.
Great. Thanks, @philips!
from cockroach.
@mberhault is this still under development or ready to be crossed off the list? (I know there's still endless work associated with this, but perhaps that follow on stuff should get new issues).
from cockroach.
the inter-node part is done. I'll file different issues for client certs (the main chunk of the work left) and key management for nodes.
from cockroach.
Related Issues (20)
- roachtest: costfuzz/rand-multi-region failed
- Sentry: builder_state.go:1785: building declarative schema change targets for CREATE SCHEMA: schema name empty when resolving database prefix for a schema name (1) attached stack trace -- stack trac...
- roachtest: costfuzz/rand-multi-region failed
- roachtest: unoptimized-query-oracle/disable-rules=all/rand-tables failed
- Freshly created cluster stops working after w few hours HOT 3
- pkg/ccl/testccl/workload/schemachange/schemachange_test: TestWorkload failed [enum type does not exist during ALTER COLUMN SET DEFAULT] HOT 2
- ccl/jwtauthccl: TestJWTAuthWithCustomCACert failed HOT 1
- roachtest: perturbation/metamorphic/decommission failed
- roachtest: unoptimized-query-oracle/disable-rules=all/seed-multi-region failed
- admission: add roachtest for disk-bound overload for snapshots
- security/ldap: clarify that cert verification error is due to missing LDAP CA cert
- security/LDAP: SHOW CLUSTER SETTING needs to redact LDAP bind password
- kvserver: wiring to initialize and use replica_rac2.Processor
- OSS-Fuzz issue 71224 HOT 1
- pkg/sql/schemachanger/schemachanger_test: TestConcurrentSchemaChanges failed
- kv/kvserver: TestPromoteNonVoterInAddVoter failed
- sql, kv: FOR UPDATE NOWAIT can starve or block under serializable HOT 3
- ccl/sqlproxyccl: TestDirectoryConnect failed
- Sentry: error.go:25: unexpected error: forecasted histogram had first bucket with non-zero NumRange or DistinctRange: (1) × Wraps: (2) issue #93892 Wraps: (3) attached stack trace -- stack trace: ...
- sql: 'infinity'::time should be greater than any other time HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cockroach.