ip=
port=
openssl s_client -connect ${ip}:${port} -showcerts

#sub-command
openssl genrsa # rsa 개인키 생성
openssl genpkey # 개인키 생성
openssl rsa # rsa 개인키 작업
openssl req # CSR 작업
openssl x509 # 인증서 작업

#flags
-in ${file} # 파일 입력
-out ${file} # 파일 출력
-outform ${type} # 출력 타입 지정
-noout # 파일 출력 하지 않음
-text # 표준출력?
-aes256 # 개인키 암호화하여 보안계층 추가
-nodes # No DES : (Enter PEM pass phrase: 입력란)암호 없이 실행

# 인증기간 확인
sudo openssl x509 -in ${crt} -noout -text

# csr 내용 조회
sudo openssl req -in ${csr} -noout -text

# 유효성 체크
sudo openssl verify -CAfile ${ca.crt} ${target.crt}

# crt to pem
sudo openssl x509 -inform PEM -in ca.crt > public.pem

# key to pem
sudo openssl rsa -in ca.key -text > private.pem

#루트인증서
openssl ecparam -out rootca.key -name prime256v1 -genkey
openssl req -new -sha256 -key rootca.key -out rootca.csr -subj "/C=KR/L=Seoul/O=fredric/CN=fredrics.playground"
openssl x509 -req -sha256 -days 3650 -in rootca.csr -signkey rootca.key -out rootca.crt

#서버인증서
openssl ecparam -out server.key -name prime256v1 -genkey
openssl req -new -sha256 -key server.key -out server.csr -subj "/C=KR/L=Seoul/O=fredric/CN=*.fredric.playground.cld"
openssl x509 -req -sha256 -days 3650 -in server.csr -CA rootca.crt -CAkey rootca.key -CAcreateserial -out server.crt

#서버인증서 정보 출력
openssl x509 -in server.crt -text -noout

#루트인증서와 서버인증서를 모두 포함하는 pem파일 제작
cat server.crt rootac.crt > server.pem

#루트인증서
openssl genpkey -algorithm RSA -out rootca.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -sha256 -key rootca.key -out rootca.csr -subj "/C=KR/L=Seoul/O=fredric/CN=fredrics.playground"
openssl x509 -req -sha256 -days 3650 -in rootca.csr -signkey rootca.key -out rootca.crt

#서버인증서
openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -sha256 -key server.key -out server.csr -subj "/C=KR/L=Seoul/O=fredric/CN=*.fredric.playground.cld"
openssl x509 -req -sha256 -days 3650 -in server.csr -CA rootca.crt -CAkey rootca.key -CAcreateserial -out server.crt

#서버인증서 정보 출력
openssl x509 -in server.crt -text -noout

#루트인증서와 서버인증서를 모두 포함하는 pem파일 제작
cat server.crt rootac.crt > server.pem

openssl req -x509 \
  -newkey rsa:2048 \
  -keyout example.key \
  -out example.crt \
  -days 3650 \
  -nodes \
  -subj "/C=KR/L=Seoul/O=fredric/CN=*.fredric.playground.cld"

#개인키 생성
openssl genrsa -aes256 -out private.key 2048
openssl rsa -in private.key -pubout -out public.key
openssl req -new -key private.key -out private.csr

#CA key 생성
openssl genrsa -aes256 -out root.ca.key 2048
#CA 10년 서명요청
openssl req -x509 -new -nodes -key root.ca.key -days 3650 -out root.ca.pem
#기관서명된 10년 인증서 생성
openssl x509 -req -in private.csr -CA root.ca.pem -CAkey root.ca.key -CAcreateserial -out private.crt -days 3650

mkdir /root/certificates
cd /root/certificates

openssl genrsa -out ca.key 2048
openssl req -new -key ca.key -subj "/CN=KUBERNETES-CA" -out ca.csr

openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt -days 1000

rm -f ca.csr

openssl x509 -in ca.crt -text -noout

# 임의의 16바이트 16진수 문자열 생성 (ENCRYPTION_KEY)
openssl rand -hex 16

# 임의의 32바이트 base64 문자열 생성 (AUTH_SECRET)
openssl rand -base64 32

#- Private Key 생성 명령어
openssl genrsa -out [파일명] [bit길이]
    #예시) openssl genrsa -out test.key 2048
#- Public Key 생성 명령어
openssl rsa -in [privateKey 파일명] -pubout -out [파일명]
    #예시) openssl rsa -in test.key -pubout -out test_pub.key

#- CSR생성 명령어
openssl req -new -key [privateKey 파일명] -out [파일명]
#    예시) openssl req -new -key test.key -out test.csr
#- 생성 옵션 입력
   # // 이 부분은 임시로 작성한 내용입니다.
   # // 외부로 서비스 할 때는 공인 사이트에서 인증서를 발급 받아서 사용해야합니다.
   # // 직접 작성해서 사용하는 것은 사설 서버에서 사용합니다.
    Country Name (2 letter code) [AU]: KR
    State or Province Name (full name) [Some-State]: Seoul
    Locality Name (eg, city) []: Seoul
    Organization Name (eg, company) [Internet Widgits Pty Ltd]: example
    Organization Unit Name (eg, section) []: example
    Common Name (eg, YOUR name) []: test
    Email Address []: [email protected]
    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []: test

openssl req -x509 -days [유효기간] -key [privateKey 파일명] -in [csr파일명] -out [파일명] -days [유효기간]
# 예시) openssl req -x509 -days 365 -key test.key -in test.csr -out test.crt -days 365

openssl x509 -in [crt파일명] -out [파일명] -outform PEM
# 예시) openssl x509 -in test.crt -out test.pem -outform PEM

# 이미 동일한 이름의 secret이 존재한다면 아래의 명령어로 삭제합니다.
# kubectl delete secret [secret명] -n [namespace명]
kubectl create secret tls [secret명] --key [privateKey 파일명] --cert [crt 파일명] -n [kubernetes namespace명]
예시) kubectl create secret tls test-secret --key test.key --cert test.crt -n dev

mkdir ~/crtTestPath-20230825
export CRT_TEST_PATH=$HOME/crtTestPath-20230825

vi $CRT_TEST_PATH/openssl.cnf
---
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
CN = kube-apiserver

[v3_req]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster.local

#> master 1
DNS.5 = platform-k8s-master-1

IP.1 = 10.96.0.1
IP.2 = 192.168.50.10

#> master 2
DNS.5 = platform-k8s-master-2

IP.1 = 10.96.0.1
IP.2 = 192.168.50.11
IP.2 = 192.168.50.10

#> master 3
DNS.5 = platform-k8s-master-3

IP.1 = 10.96.0.1
IP.2 = 192.168.50.12
IP.2 = 192.168.50.10

openssl req -new \
    -key /etc/kubernetes/pki/apiserver.key \
    -out $CRT_TEST_PATH/apiserver.csr \
    -subj "/CN=kube-apiserver" \
    -config $CRT_TEST_PATH/openssl.cnf

openssl x509 -req \
    -in $CRT_TEST_PATH/apiserver.csr \
    -CA /etc/kubernetes/pki/ca.crt \
    -CAkey /etc/kubernetes/pki/ca.key \
    -CAcreateserial \
    -out $CRT_TEST_PATH/apiserver.crt \
    -days 3650 \
    -extensions v3_req \
    -extfile $CRT_TEST_PATH/openssl.cnf

# 1.개인키 생성
sudo openssl genrsa -out ${keyfile} 2048
#sudo openssl genpkey -algorithm RSA -out ${keyfile} -outform PEM -aes256

# 2.서명요청(csr) 생성: ca.cert 파일과 일치하는 정보 입력: 일반 이름(CN), 조직(O) 등
sudo openssl req -new -key ${keyfile} -out ${csrfile}

# 1. 새로운 키로 csr 생성
#sudo openssl req -new -newkey rsa:2048 -keyout ${keyfile} -out ${csrfile} -subj "/CN=192.168.50.10" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=IP:192.168.50.10")) -nodes
#sudo openssl req -new -newkey rsa:2048 -keyout ${keyfile} -out ${csrfile} -subj "/CN=192.168.50.10" -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=IP:192.168.50.10")) -reqexts SAN -nodes
#sudo openssl req -new -newkey rsa:2048 -keyout ${keyfile} -out ${csrfile} -subj "/CN=192.168.50.10" -config <(printf "[req]\ndistinguished_name=req\n[ SAN]\nsubjectAltName=IP:192.168.50.10\n") -reqexts SAN -nodes

# CA 없이 인증서 생성
sudo openssl x509 -req -in ${csrfile} -signkey ${keyfile} -out ${crtfile} -days 3650

# CA인증서로 인증서 생성
# 1.CA 인증서용 시리얼넘버 생성
echo 'B4A3E792F8D1C6A9' > ca.srl 

# 2.CA 인증서를 사용하여 인증서 생성
sudo openssl x509 -req -in ${csrfile} -CA ca.crt -CAkey ca.key -out ${crtfile} -days 3650 -sha256

# 1.서명요청(csr) 생성: ca.cert 파일과 일치하는 정보 입력: 일반 이름(CN), 조직(O) 등
sudo openssl req -new -key ${keyfile} -out ${csrfile}

# 2.CA 인증서용 시리얼넘버 생성
echo 'B4A3E792F8D1C6A9' > ca.srl 

# 3.CA 인증서를 사용하여 인증서 생성
sudo openssl x509 -req -in ${csrfile} -CA ca.crt -CAkey ca.key -out ${crtfile} -days 3650 -sha256

# openssl.conf
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
CN = kube-apiserver

[v3_req]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
X509v3 extensions:
keyUsage = critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
basicConstraints = critical CA:FALSE
            X509v3 Authority Key Identifier:
                keyid:40:67:1D:8C:A5:70:E4:39:8D:8C:FD:49:B9:DC:9E:AE:7D:E3:5F:38

            X509v3 Subject Alternative Name:
                DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:lb-apiserver.kubernetes.local, DNS:localhost, DNS:platform-k8s-master-1, DNS:platform-k8s-master-1.cluster.local, DNS:platform-k8s-master-2, DNS:platform-k8s-master-2.cluster.local, DNS:platform-k8s-master-3, DNS:platform-k8s-master-3.cluster.local, IP Address:10.233.0.1, IP Address:172.16.0.189, IP Address:172.16.0.162, IP Address:127.0.0.1, IP Address:172.16.0.137


[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster.local
DNS.5 = lb-apiserver.kubernetes.local
DNS.6 = localhost
DNS.7 = platform-k8s-master-1
DNS.8 = platform-k8s-master-1.cluster.local
DNS.9 = platform-k8s-master-2
DNS.10 = platform-k8s-master-2.cluster.local
DNS.11 = platform-k8s-master-3
DNS.12 = platform-k8s-master-3.cluster.local
IP.1 = 10.233.0.1
IP.2 = 172.16.0.189
IP.3 = 172.16.0.162
IP.4 = 127.0.0.1
IP.5 = 172.16.0.137

openssl req -new -key apiserver.key -out apiserver.csr -config openssl.conf
openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out aiserver.crt -days 3650 -extensions v3_req -extfile openssl.conf

openssl req -new \
    -key apiserver.key \
    -out apiserver.csr \
    -subj "/CN=kube-apiserver" \
    -config <(cat /etc/kubernetes/openssl.conf <(printf "[alt_names]\nDNS=kubernetes\nDNS=kubernetes.default\nDNS=kubernetes.default.svc\nDNS=kubernetes.default.svc.cluster.local\nDNS=platform-k8s-master-3\nIP.1=10.96.0.1\nIP.2=192.168.50.12\nIP.3=192.168.50.10"))

#!/bin/bash

cd /etc/kubernetes/pki/

subj="CN = kube-apiserver"

cert_days=3650
ca_cert="ca.crt"
ca_key="ca.key"
key="apiserver.key"
csr="apiserver.csr"
cert="apiserver.crt"

common_csr_conf='distinguished_name = dn\n[dn]\n[v3_ext]\nkeyUsage = critical, digitalSignature, keyEncipherment\n'
cert_type="server"
case "${cert_type}" in
client)
  csr_conf=$(printf "%bextendedKeyUsage = clientAuth\n" "${common_csr_conf}")
  ;;
server)
  csr_conf=$(printf "%bextendedKeyUsage = serverAuth\nsubjectAltName = %b\n" "${common_csr_conf}" "${alt_name}")
  ;;
peer)
  csr_conf=$(printf "%bextendedKeyUsage = serverAuth, clientAuth\nsubjectAltName = %b\n" "${common_csr_conf}" "${alt_name}")
  ;;
*)
  log::err "unknow, unsupported certs type: ${YELLOW}${cert_type}${NC}, supported type: client, server, peer"
  exit 1
  ;;
esac

rm ${cert}

  # gen csr
  openssl req -new -key "${key}" -subj "${subj}" -reqexts v3_ext \
    -config <(printf "%b" "${csr_conf}") \
    -out "${csr}" >/dev/null 2>&1

  # gen cert
  openssl x509 -in "${csr}" -req -CA "${ca_cert}" -CAkey "${ca_key}" -CAcreateserial -extensions v3_ext \
    -extfile <(printf "%b" "${csr_conf}") \
    -days "${cert_days}" -out "${cert}" >/dev/null 2>&1