Skip to content

Commit f71fc5e

Browse files
yikekesre-bot
yikeke
authored and
sre-bot
committed
cherry pick pingcap#2703 to release-4.0
Signed-off-by: sre-bot <sre-bot@pingcap.com>
1 parent c7da8aa commit f71fc5e

File tree

1 file changed

+155
-133
lines changed

1 file changed

+155
-133
lines changed

‎generate-self-signed-certificates.md‎

Lines changed: 155 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -1,156 +1,178 @@
11
---
22
title: Generate Self-signed Certificates
3-
summary: Use `cfssl` to generate self-signed certificates.
3+
summary: Use `openssl` to generate self-signed certificates.
44
category: how-to
55
aliases: ['/docs/stable/how-to/secure/generate-self-signed-certificates/']
66
---
77

88
# Generate Self-signed Certificates
99

10-
## Overview
11-
12-
This document describes how to generate self-signed certificates using `cfssl`.
10+
This document provides an example of using `openssl` to generate a self-signed certificate. You can also generate certificates and keys that meet requirements according to your demands.
1311

1412
Assume that the topology of the instance cluster is as follows:
1513

16-
| Name | Host IP | Services |
17-
| ----- | ----------- | ---------- |
18-
| node1 | 172.16.10.1 | PD1, TiDB1 |
19-
| node2 | 172.16.10.2 | PD2, TiDB2 |
20-
| node3 | 172.16.10.3 | PD3 |
21-
| node4 | 172.16.10.4 | TiKV1 |
22-
| node5 | 172.16.10.5 | TiKV2 |
23-
| node6 | 172.16.10.6 | TiKV3 |
14+
| Name | Host IP | Services |
15+
| ----- | ----------- | ---------- |
16+
| node1 | 172.16.10.11 | PD1, TiDB1 |
17+
| node2 | 172.16.10.12 | PD2 |
18+
| node3 | 172.16.10.13 | PD3 |
19+
| node4 | 172.16.10.14 | TiKV1 |
20+
| node5 | 172.16.10.15 | TiKV2 |
21+
| node6 | 172.16.10.16 | TiKV3 |
22+
23+
## Install OpenSSL
24+
25+
- For Debian or Ubuntu OS:
26+
27+
{{< copyable "shell-regular" >}}
28+
29+
```bash
30+
apt install openssl
31+
```
32+
33+
- For RedHat or CentOS OS:
34+
35+
{{< copyable "shell-regular" >}}
36+
37+
```bash
38+
yum install openssl
39+
```
40+
41+
You can also refer to OpenSSL's official [download document](https://www.openssl.org/source/) for installation.
42+
43+
## Generate the CA certificate
44+
45+
A certificate authority (CA) is a trusted entity that issues digital certificates. In practice, contact your administrator to issue the certificate or use a trusted CA. CA manages multiple certificate pairs. Here you only need to generate an original pair of certificates as follows.
46+
47+
1. Generate the root key:
48+
49+
{{< copyable "shell-regular" >}}
2450
25-
## Download `cfssl`
51+
```bash
52+
openssl genrsa -out root.key 4096
53+
```
2654
27-
Assume that the host is x86_64 Linux:
55+
2. Generate root certificates:
2856
29-
```bash
30-
mkdir ~/bin
31-
curl -s -L -o ~/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
32-
curl -s -L -o ~/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
33-
chmod +x ~/bin/{cfssl,cfssljson}
34-
export PATH=$PATH:~/bin
35-
```
57+
{{< copyable "shell-regular" >}}
3658
37-
## Initialize the certificate authority
59+
```bash
60+
openssl req -new -x509 -days 1000 -key root.key -out root.crt
61+
```
3862
39-
To make it easy for modification later, generate the default configuration of `cfssl`:
63+
3. Validate root certificates:
4064
41-
```bash
42-
mkdir ~/cfssl
43-
cd ~/cfssl
44-
cfssl print-defaults config > ca-config.json
45-
cfssl print-defaults csr > ca-csr.json
46-
```
65+
{{< copyable "shell-regular" >}}
4766
48-
## Generate certificates
67+
```bash
68+
openssl x509 -text -in root.crt -noout
69+
```
4970
50-
### Certificates description
71+
## Issue certificates for individual components
72+
73+
This section describes how to issue certificates for individual components.
74+
75+
### Certificates that might be used in the cluster
5176
5277
- tidb-server certificate: used by TiDB to authenticate TiDB for other components and clients
5378
- tikv-server certificate: used by TiKV to authenticate TiKV for other components and clients
5479
- pd-server certificate: used by PD to authenticate PD for other components and clients
55-
- client certificate: used to authenticate the clients from PD, TiKV and TiDB, such as `pd-ctl`, `tikv-ctl` and `pd-recover`
56-
57-
### Configure the CA option
58-
59-
Edit `ca-config.json` according to your need:
60-
61-
```json
62-
{
63-
"signing": {
64-
"default": {
65-
"expiry": "43800h"
66-
},
67-
"profiles": {
68-
"server": {
69-
"expiry": "43800h",
70-
"usages": [
71-
"signing",
72-
"key encipherment",
73-
"server auth",
74-
"client auth"
75-
]
76-
},
77-
"client": {
78-
"expiry": "43800h",
79-
"usages": [
80-
"signing",
81-
"key encipherment",
82-
"client auth"
83-
]
84-
}
85-
}
86-
}
87-
}
88-
```
89-
90-
Edit `ca-csr.json` according to your need:
91-
92-
```json
93-
{
94-
"CN": "My own CA",
95-
"key": {
96-
"algo": "rsa",
97-
"size": 2048
98-
},
99-
"names": [
100-
{
101-
"C": "CN",
102-
"L": "Beijing",
103-
"O": "PingCAP",
104-
"ST": "Beijing"
105-
}
106-
]
107-
}
108-
```
109-
110-
### Generate the CA certificate
111-
112-
```bash
113-
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
114-
```
115-
116-
The command above generates the following files:
117-
118-
```bash
119-
ca-key.pem
120-
ca.csr
121-
ca.pem
122-
```
123-
124-
### Generate the server certificate
125-
126-
The IP address of all components and `127.0.0.1` are included in `hostname`.
127-
128-
```bash
129-
echo '{"CN":"tidb-server","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server -hostname="172.16.10.1,172.16.10.2,127.0.0.1" - | cfssljson -bare tidb-server
130-
131-
echo '{"CN":"tikv-server","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server -hostname="172.16.10.4,172.16.10.5,172.16.10.6,127.0.0.1" - | cfssljson -bare tikv-server
132-
133-
echo '{"CN":"pd-server","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server -hostname="172.16.10.1,172.16.10.2,172.16.10.3,127.0.0.1" - | cfssljson -bare pd-server
134-
```
135-
136-
The command above generates the following files:
137-
138-
```Bash
139-
tidb-server-key.pem tikv-server-key.pem pd-server-key.pem
140-
tidb-server.csr tikv-server.csr pd-server.csr
141-
tidb-server.pem tikv-server.pem pd-server.pem
142-
```
143-
144-
### Generate the client certificate
145-
146-
```bash
147-
echo '{"CN":"client","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client -hostname="" - | cfssljson -bare client
148-
```
149-
150-
The command above generates the following files:
151-
152-
```bash
153-
client-key.pem
154-
client.csr
155-
client.pem
156-
```
80+
- client certificate: used to authenticate the clients from PD, TiKV and TiDB, such as `pd-ctl`, `tikv-ctl`
81+
82+
### Issue certificates to TiKV instances
83+
84+
To issue a certificate to a TiKV instance, perform the following steps:
85+
86+
1. Generate the private key corresponding to the certificate:
87+
88+
{{< copyable "shell-regular" >}}
89+
90+
```bash
91+
openssl genrsa -out tikv.key 2048
92+
```
93+
94+
2. Make a copy of the OpenSSL configuration template file (Refer to the actual location of your template file because it might have more than one location):
95+
96+
{{< copyable "shell-regular" >}}
97+
98+
```bash
99+
cp /usr/lib/ssl/openssl.cnf .
100+
```
101+
102+
If you do not know the actual location, look for it in the root directory:
103+
104+
```bash
105+
find / -name openssl.cnf
106+
```
107+
108+
3. Edit `openssl.cnf`, add `req_extensions = v3_req` under the `[ req ]` field, and add `subjectAltName = @alt_names` under the `[ v3_req ]` field. Finally, create a new field and edit the information of SAN.
109+
110+
```
111+
[ alt_names ]
112+
IP.1 = 127.0.0.1
113+
IP.2 = 172.16.10.14
114+
IP.3 = 172.16.10.15
115+
IP.4 = 172.16.10.16
116+
```
117+
118+
4. Save the `openssl.cnf` file, and generate the certificate request file (in this step, you can also assign a Common Name to the certificate, which is used to allow the server to validate the identity of the client. Each component does not enable the validation by default, and you can enable it in the configuration file):
119+
120+
{{< copyable "shell-regular" >}}
121+
122+
```bash
123+
openssl req -new -key tikv.key -out tikv.csr -config openssl.cnf
124+
```
125+
126+
5. Issue and generate the certificate:
127+
128+
{{< copyable "shell-regular" >}}
129+
130+
```bash
131+
openssl x509 -req -days 365 -CA root.crt -CAkey root.key -CAcreateserial -in tikv.csr -out tikv.crt -extensions v3_req -extfile openssl.cnf
132+
```
133+
134+
6. Verify that the certificate includes the SAN field (optional):
135+
136+
{{< copyable "shell-regular" >}}
137+
138+
```bash
139+
openssl x509 -text -in tikv.crt -noout
140+
```
141+
142+
7. Confirm that the following files exist in your current directory:
143+
144+
```
145+
root.crt
146+
tikv.crt
147+
tikv.key
148+
```
149+
150+
The process of issuing certificates for other TiDB components is similar and will not be repeated in this document.
151+
152+
### Issue certificates for clients
153+
154+
To issue a certificate to a client, perform the following steps:
155+
156+
1. Generate the private key corresponding to the certificate:
157+
158+
{{< copyable "shell-regular" >}}
159+
160+
```bash
161+
openssl genrsa -out client.key 2048
162+
```
163+
164+
2. Generate the certificate request file (in this step, you can also assign a Common Name to the certificate, which is used to allow the server to validate the identity of the client. Each component does not enable the validation by default, and you can enable it in the configuration file):
165+
166+
{{< copyable "shell-regular" >}}
167+
168+
```bash
169+
openssl req -new -key client.key -out client.csr
170+
```
171+
172+
3. Issue and generate the certificate:
173+
174+
{{< copyable "shell-regular" >}}
175+
176+
```bash
177+
openssl x509 -req -days 365 -CA root.crt -CAkey root.key -CAcreateserial -in client.csr -out client.crt
178+
```

0 commit comments

Comments
 (0)