Vault PKI
Материал из noname.com.ua
Версия от 10:14, 11 октября 2021; Sirmax (обсуждение | вклад) (→Генерация запроса на сертификат для промежуточного CA)
Vault PKI
Развертывание PKI на основе Vault
Установка Vault
Предполагается что Vault уже установлен и настроен
PKI
Включить PKI для корневого сертификата
vault secrets enable \
-path=pki_root_ca \
-description="PKI Root CA" \
-max-lease-ttl="262800h" \
pki
Создание корневого сертефиката (CA)
Конфигурация Vault
- ВАЖНО: Тип определяет будет ли показан ключ от сертификата. В случае internal ключ показа не будет и сертификат можно будет использовать только в Vault
TYPE="exported"
#TYPE="internal"
vault write -format=json pki_root_ca/root/generate/${TYPE} \
common_name="Root Certificate Authority for Home Network" \
country="Ukraine" \
locality="Kharkov" \
street_address="Lui Pastera St. 322, app. 131" \
postal_code="61172" \
organization="Home Network" \
ou="IT" \
ttl="262800h" > pki-root-ca.json
- ttl="262800h" - 30 лет
- В теории возможно использовать пре-созданный CA или даже цепочку - смотреть тут: https://groups.google.com/g/vault-tool/c/y4IcgiLBG4c
Просмотр результата
Результат работы команды (длинный вывод пропущен):
cat pki-root-ca.json
{
"request_id": "3d05280b-25db-6834-1472-abe11fb6c4ab",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"certificate": "-----BEGIN CERTIFICATE-----<SKIP>F72Cwqh1wTUNHHEJKMupiTIs2B\nsjCYRMVUw1A6MBY5kS8KrTizRMIZCLKjSQoVY4F8Y7lMjnw=\n-----END CERTIFICATE-----",
"expiration": 2579950707,
"issuing_ca": "-----BEGIN CERTIFICATE-----<SKIP>F72Cwqh1wTUNHHEJKMupiTIs2B\nsjCYRMVUw1A6MBY5kS8KrTizRMIZCLKjSQoVY4F8Y7lMjnw=\n-----END CERTIFICATE-----",
"private_key": "-----BEGIN RSA PRIVATE KEY-----<SKIP>hwmKMhs+HI2Hs\nflcrSqLT26ccUb5bMRtXJ1pYrnjwOJnV/4GAJ5QG4aGNGdK/jIF9XbE=\n-----END RSA PRIVATE KEY-----",
"private_key_type": "rsa",
"serial_number": "05:55:c5:9b:20:91:66:86:96:42:84:bd:66:9a:c1:70:28:8d:bf:82"
},
"warnings": null
}
Корневой сертефикат самоподписаный. Поля certificate и issuing_ca полностью совпадают.
Подготовка файлов с сертефикатом и ключем
cat pki-root-ca.json | jq -r .data.certificate > rootCA.pem
cat pki-root-ca.json | jq -r .data.issuing_ca > rootCA_issuing_ca.pem
cat pki-root-ca.json | jq -r .data.private_key > rootCA_private_key.pem
openssl x509 -in rootCA.pem -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
05:55:c5:9b:20:91:66:86:96:42:84:bd:66:9a:c1:70:28:8d:bf:82
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = Ukraine, L = Kharkov, street = app. 131 + street = Lui Pastera St. 322, postalCode = 61172, O = Home Network, OU = IT, CN = Root Certificate Authority for Home Network
Validity
Not Before: Oct 10 12:58:00 2021 GMT
Not After : Oct 3 12:58:27 2051 GMT
Subject: C = Ukraine, L = Kharkov, street = app. 131 + street = Lui Pastera St. 322, postalCode = 61172, O = Home Network, OU = IT, CN = Root Certificate Authority for Home Network
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:be:dc:02:4a:f5:32:38:b2:cf:10:4f:78:d0:de:
d0:82:0e:52:2b:7f:ab:d9:ee:5c:a0:81:4a:8c:2d:
ae:60:ac:27:6c:12:ef:a6:6f:6f:62:23:74:d0:c2:
d5:b8:83:80:66:a1:50:ea:58:ea:18:b3:17:49:a6:
6d:83:b9:d3:0b:a5:20:c1:5c:5a:54:d6:40:56:c1:
c4:60:59:b9:0b:fd:de:0c:d4:0b:03:7a:93:cd:f0:
1f:94:25:ee:11:07:86:74:f3:e8:31:e5:66:99:4e:
03:a0:89:ca:3e:8b:65:73:39:d8:69:91:c0:13:ba:
6e:35:2a:60:e7:d9:e6:5b:53:ee:bd:12:4a:ba:1a:
d0:70:60:e2:65:dc:52:9d:f8:cc:0c:ec:ff:db:d5:
e3:12:a7:a0:91:04:a2:40:01:f3:1c:e4:5a:93:74:
37:16:3c:e1:bf:22:fe:0a:a1:dd:ee:cd:37:2b:6f:
29:47:14:b5:1b:66:57:98:b5:7e:02:b5:4b:54:ee:
b4:e9:93:fa:c9:ed:4e:28:cc:dc:ab:68:42:fd:f7:
c0:ee:89:15:2e:46:76:64:f8:ac:be:86:1d:54:4a:
4a:29:d5:2d:71:59:34:f8:f0:0b:e5:fc:1c:14:11:
d8:08:8b:79:0a:a7:8f:6b:61:30:b3:69:9a:90:12:
c3:29
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
DB:3A:73:7A:03:25:2E:17:48:46:58:67:19:AD:86:2E:04:3D:EB:EC
X509v3 Authority Key Identifier:
keyid:DB:3A:73:7A:03:25:2E:17:48:46:58:67:19:AD:86:2E:04:3D:EB:EC
Signature Algorithm: sha256WithRSAEncryption
71:6f:56:d4:6a:b8:24:9d:fc:16:47:8c:1c:59:ac:c2:92:90:
36:5f:ef:73:43:c7:d7:2e:20:b4:4b:e9:3f:57:b4:a6:b4:82:
a2:28:bd:f2:98:07:a1:49:df:c7:1d:60:5a:56:fc:85:64:e7:
d8:97:75:f6:36:66:1a:04:ab:57:8a:43:d8:3c:aa:97:72:5e:
3d:85:59:d9:d3:b6:2b:d5:aa:d6:49:ad:35:04:2c:22:52:9c:
61:6a:6b:2f:dd:ba:78:cc:b7:ac:9c:fa:6d:1e:57:62:8f:b8:
94:f9:98:30:d5:c1:06:24:c0:17:58:46:fd:6e:55:92:6f:98:
11:d8:cd:28:6f:92:cb:90:5d:5e:91:b3:aa:bb:fd:d0:f5:32:
9a:ed:a4:80:5a:7e:e6:6b:5d:98:19:71:04:86:de:18:e2:38:
37:0f:e2:61:0a:d3:81:c0:06:1f:e7:f0:a0:c5:8f:f7:90:8f:
c9:74:d5:68:1d:33:b4:a5:45:fc:f7:8c:35:a6:3a:1d:a7:6a:
11:a5:1b:e1:7b:d8:2c:2a:87:5c:13:50:d1:c7:10:92:8c:ba:
98:93:22:cd:81:b2:30:98:44:c5:54:c3:50:3a:30:16:39:91:
2f:0a:ad:38:b3:44:c2:19:08:b2:a3:49:0a:15:63:81:7c:63:
b9:4c:8e:7c
URL для корневого CA
Публикуем URL’ы для корневого центра сертификации
vault write pki_root_ca/config/urls \ issuing_certificates="http://vault.home:8200/v1/pki_root_ca/ca" \ crl_distribution_points="http://vault.home:8200/v1/pki_root_ca/crl
Создание промежуточного СА
В целом можно использовать и корневой СА для создания конечных сертификатов но "лучшие собаководы" рекомендуют использовать промежуточный CA
Конфигурация Vault
vault secrets enable \
-path=pki_intermediate_ca \
-description="PKI Intermediate CA" \
-max-lease-ttl="175200h" \
pki
Success! Enabled the pki secrets engine at: pki_intermediate_ca/
Генерация запроса на сертификат для промежуточного CA
vault write -format=json pki_intermediate_ca/intermediate/generate/internal \ common_name="Intermediate CA" \ country="Ukraine" \ locality="Kharkov" \ street_address="Lui Pastera st. 322 app. 131" \ postal_code="101000" \ organization="Horns and Hooves LLC" \ ou="IT" \ ttl="175200h" > pki_intermediate_ca.csr.json
{
"request_id": "2e544789-ed06-1d6f-97cf-928c1fb54e77",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIC6DCCAdACAQAwgaIxEDAOBgNVBAYTB1VrcmFpbmUxEDAOBgNVBAcTB0toYXJr\nb3YxJTAjBgNVBAkTHEx1aSBQYXN0ZXJhIHN0LiAzMjIgYXBwLiAxMzExDzANBgNV\nBBETBjEwMTAwMDEdMBsGA1UEChMUSG9ybnMgYW5kIEhvb3ZlcyBMTEMxCzAJBgNV\nBAsTAklUMRgwFgYDVQQDEw9JbnRlcm1lZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDIJlmWRZBXLgMymWtlUCn9+3I1BS1W+Kyya2Tguc9R\nblhcyjzb1DshtkJAdohm3bwPnECCPyC3ARKOyN8xrepYOlphsn3+L3tpjOfvq7TS\nJXl194gjkURG7Ahz2FB/oPq0+d9YLYB/TTCh2H2r+3kXMX+ByJTcIHQ+03+6Er73\n+f0qOmYyy/U61lmjYGQTzlhLxzBWZ1xvLNJKaMGoZHgDyJ15bLyCcuSp0GYFnBht\nwvS3BL6wvuhon5NBTjLdnPRzYA8sbPq0SVppUQydaVY3vdBG3HsoWq2d9hQs6c56\nUyspaxpskKjpEdpSp///jfQ2cHAup4AeQBQaine+EfzFAgMBAAGgADANBgkqhkiG\n9w0BAQsFAAOCAQEAmhSXiyvK9J1ZarDQOx5XpPRZ+IfjvYhwcxJ5eBgVcJCljcpr\nAPSvc6dt9di9vHoT/YQ43t47bV0hxVxKERNfOHCjX9VuruOdJ5WE3ptRx0oQsMdC\nbuIxQv/j4F4+kZmLDiUfTsOVTGuOKVqPJ3nyMibeE0JhQHu58hprAosDc2kzFf31\n3KOrQHhpITVgGGPqM4VI/w7ghIzxL/qvPCMX3Qshe5lkHY1jTNt6zHeofC0QRIdo\n2P0Iteb0rR59+B1Bq+jBoKTFmyv1AKifeSY6syTpbp/rKyzeY8pe/txx3JOfF29K\nwMjCLShOPDmOmPPUCbq/vRTUl9zMBsC7tKYRbA==\n-----END CERTIFICATE REQUEST-----"
},
"warnings": null
}
cat pki_intermediate_ca.csr.json | jq -r .data.csr
-----BEGIN CERTIFICATE REQUEST----- MIIC6DCCAdACAQAwgaIxEDAOBgNVBAYTB1VrcmFpbmUxEDAOBgNVBAcTB0toYXJr b3YxJTAjBgNVBAkTHEx1aSBQYXN0ZXJhIHN0LiAzMjIgYXBwLiAxMzExDzANBgNV BBETBjEwMTAwMDEdMBsGA1UEChMUSG9ybnMgYW5kIEhvb3ZlcyBMTEMxCzAJBgNV BAsTAklUMRgwFgYDVQQDEw9JbnRlcm1lZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDIJlmWRZBXLgMymWtlUCn9+3I1BS1W+Kyya2Tguc9R blhcyjzb1DshtkJAdohm3bwPnECCPyC3ARKOyN8xrepYOlphsn3+L3tpjOfvq7TS JXl194gjkURG7Ahz2FB/oPq0+d9YLYB/TTCh2H2r+3kXMX+ByJTcIHQ+03+6Er73 +f0qOmYyy/U61lmjYGQTzlhLxzBWZ1xvLNJKaMGoZHgDyJ15bLyCcuSp0GYFnBht wvS3BL6wvuhon5NBTjLdnPRzYA8sbPq0SVppUQydaVY3vdBG3HsoWq2d9hQs6c56 UyspaxpskKjpEdpSp///jfQ2cHAup4AeQBQaine+EfzFAgMBAAGgADANBgkqhkiG 9w0BAQsFAAOCAQEAmhSXiyvK9J1ZarDQOx5XpPRZ+IfjvYhwcxJ5eBgVcJCljcpr APSvc6dt9di9vHoT/YQ43t47bV0hxVxKERNfOHCjX9VuruOdJ5WE3ptRx0oQsMdC buIxQv/j4F4+kZmLDiUfTsOVTGuOKVqPJ3nyMibeE0JhQHu58hprAosDc2kzFf31 3KOrQHhpITVgGGPqM4VI/w7ghIzxL/qvPCMX3Qshe5lkHY1jTNt6zHeofC0QRIdo 2P0Iteb0rR59+B1Bq+jBoKTFmyv1AKifeSY6syTpbp/rKyzeY8pe/txx3JOfF29K wMjCLShOPDmOmPPUCbq/vRTUl9zMBsC7tKYRbA== -----END CERTIFICATE REQUEST-----
openssl req -in pki_intermediate_ca.csr -text -noout
Certificate Request:
Data:
Version: 1 (0x0)
Subject: C = Ukraine, L = Kharkov, street = Lui Pastera st. 322 app. 131, postalCode = 101000, O = Horns and Hooves LLC, OU = IT, CN = Intermediate CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:c8:26:59:96:45:90:57:2e:03:32:99:6b:65:50:
29:fd:fb:72:35:05:2d:56:f8:ac:b2:6b:64:e0:b9:
cf:51:6e:58:5c:ca:3c:db:d4:3b:21:b6:42:40:76:
88:66:dd:bc:0f:9c:40:82:3f:20:b7:01:12:8e:c8:
df:31:ad:ea:58:3a:5a:61:b2:7d:fe:2f:7b:69:8c:
e7:ef:ab:b4:d2:25:79:75:f7:88:23:91:44:46:ec:
08:73:d8:50:7f:a0:fa:b4:f9:df:58:2d:80:7f:4d:
30:a1:d8:7d:ab:fb:79:17:31:7f:81:c8:94:dc:20:
74:3e:d3:7f:ba:12:be:f7:f9:fd:2a:3a:66:32:cb:
f5:3a:d6:59:a3:60:64:13:ce:58:4b:c7:30:56:67:
5c:6f:2c:d2:4a:68:c1:a8:64:78:03:c8:9d:79:6c:
bc:82:72:e4:a9:d0:66:05:9c:18:6d:c2:f4:b7:04:
be:b0:be:e8:68:9f:93:41:4e:32:dd:9c:f4:73:60:
0f:2c:6c:fa:b4:49:5a:69:51:0c:9d:69:56:37:bd:
d0:46:dc:7b:28:5a:ad:9d:f6:14:2c:e9:ce:7a:53:
2b:29:6b:1a:6c:90:a8:e9:11:da:52:a7:ff:ff:8d:
f4:36:70:70:2e:a7:80:1e:40:14:1a:8a:77:be:11:
fc:c5
Exponent: 65537 (0x10001)
Attributes:
a0:00
Signature Algorithm: sha256WithRSAEncryption
9a:14:97:8b:2b:ca:f4:9d:59:6a:b0:d0:3b:1e:57:a4:f4:59:
f8:87:e3:bd:88:70:73:12:79:78:18:15:70:90:a5:8d:ca:6b:
00:f4:af:73:a7:6d:f5:d8:bd:bc:7a:13:fd:84:38:de:de:3b:
6d:5d:21:c5:5c:4a:11:13:5f:38:70:a3:5f:d5:6e:ae:e3:9d:
27:95:84:de:9b:51:c7:4a:10:b0:c7:42:6e:e2:31:42:ff:e3:
e0:5e:3e:91:99:8b:0e:25:1f:4e:c3:95:4c:6b:8e:29:5a:8f:
27:79:f2:32:26:de:13:42:61:40:7b:b9:f2:1a:6b:02:8b:03:
73:69:33:15:fd:f5:dc:a3:ab:40:78:69:21:35:60:18:63:ea:
33:85:48:ff:0e:e0:84:8c:f1:2f:fa:af:3c:23:17:dd:0b:21:
7b:99:64:1d:8d:63:4c:db:7a:cc:77:a8:7c:2d:10:44:87:68:
d8:fd:08:b5:e6:f4:ad:1e:7d:f8:1d:41:ab:e8:c1:a0:a4:c5:
9b:2b:f5:00:a8:9f:79:26:3a:b3:24:e9:6e:9f:eb:2b:2c:de:
63:ca:5e:fe:dc:71:dc:93:9f:17:6f:4a:c0:c8:c2:2d:28:4e:
3c:39:8e:98:f3:d4:09:ba:bf:bd:14:d4:97:dc:cc:06:c0:bb:
b4:a6:11:6c
root@raspberrypi4:~/k8s/k8s-in-a-hard-way/PKI/vault/configure_vault_pki_scripts#
