Vault PKI Intermediate ca etcd Kubernetes the hard way v2: различия между версиями

Материал из noname.com.ua
Перейти к навигацииПерейти к поиску
Строка 238: Строка 238:
 
</PRE>
  
</PRE>
   
−
====Детали сертефиката====
 +
=Детали сертефиката=
 
<PRE>
  
<PRE>
 
openssl x509 -in intermediateCA.cert.pem -noout -text
  
openssl x509 -in intermediateCA.cert.pem -noout -text
Строка 302: Строка 302:
 
1d:3e:f4:07
  
1d:3e:f4:07
 
</PRE>
  
</PRE>
−  
   
 
====Валидация с помошью корневого CA====
  
====Валидация с помошью корневого CA====

Версия 19:28, 2 октября 2022


Создание СА для работы кластера etcd

Эта страница - часть большой статьи про CA используемые в k8s: Vault_PKI_Kubernetes_the_hard_way_v2
Задача - настроить промежуточный СА для работы сервиса etcd

Конфигурация Vault

  • Стараюсь именовать path более-менее осмысленно (k8s_pki_intermediate_ca_for_service_etcd)
  • PKI (последняя строка) здесь - это тип секрета
vault \
  secrets \
    enable \
      -path=k8s_pki_intermediate_ca_for_service_etcd \
      -description="PKI Intermediate CA for ETCd service" \
      -max-lease-ttl="175200h" \
    pki

Success! Enabled the pki secrets engine at: k8s_pki_intermediate_ca_for_service_etcd/

Генерация запроса на сертификат для промежуточного CA

vault \
  write \
    -format=json pki_intermediate_ca/intermediate/generate/internal \
     common_name="Intermediate CA for service ETCd" \
     country="Ukraine" \
     locality="Kharkov" \
     street_address="Lui Pastera st. 322 app. 131" \
     postal_code="61172" \
     organization="K8s The Hardest Way Labs" \
     ou="IT" \
     ttl="175200h" > k8s_pki_intermediate_ca_for_service_etcd_csr.json

Просмотр результатов

Сырой вывод

cat k8s_pki_intermediate_ca_for_service_etcd_csr.json

Сохранить запрос в файл

  • Проверить что вышло в более-менее читаемом формате (на первый взгляд выглядит корректно)
cat k8s_pki_intermediate_ca_for_service_etcd_csr.json | jq -r .data.csr

-----BEGIN CERTIFICATE REQUEST-----
MIIC/DCCAeQCAQAwgbYxEDAOBgNVBAYTB1VrcmFpbmUxEDAOBgNVBAcTB0toYXJr
b3YxJTAjBgNVBAkTHEx1aSBQYXN0ZXJhIHN0LiAzMjIgYXBwLiAxMzExDjAMBgNV
BBETBTYxMTcyMSEwHwYDVQQKExhLOHMgVGhlIEhhcmRlc3QgV2F5IExhYnMxCzAJ
BgNVBAsTAklUMSkwJwYDVQQDEyBJbnRlcm1lZGlhdGUgQ0EgZm9yIHNlcnZpY2Ug
RVRDZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPgSl8BYUCkDzdq
MnJx89TlWirdsDv40sJcCIC/FKobMpdWlbBMDhmZeFkoPvDulmWIzMzpPF7+Q1Tb
pRxHnNkW83wsnnoxPTeR0ym+ixDeUl//NVsjOmH40W2fuQZ6j3S/DLfGGxdOFc5T
s+akRHTTyD5nfIsMwgxDtMDSaf9oN9ugx8EqnQtBn5pQzap1E1b58R5JPhrJ+2ce
oH4NqXKbu4ZaWpzVH7RjTrf1AOpknCBjR9Zpxl+DjBch2qgJY0lnD373qaFKntGT
DoZKRJeqCNBIYoB8o8KczFC46dSYTzBokwQQU4R9woAk+yMZI2v8I0EJCnFtsYF7
nrkNuxcCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAciGGKja/BVKEfe0qwvl7u
itik2Evmp0pOFbxaajgEOztIms/a9GEanFM1HOLVlvehZWBjYUv/D5E1SNNfyIrV
YCVvq0PViXB92el98sI9CYI7BkHQT8l7EMepehVgZbJ6pHzic7S4fxNB9Gcza10O
FsuallqiCYndR2Ps/fOXbm40OAP+BndIuvjVcIRlXSIWTl910DORxysyP9otf3PG
cW8kWMbAcHeMtlgPdS/ebG65WNzjSOws+ty9t4+wWMO6xI5rDTEhCdObsIJdhGaZ
NPi9bcG017rJUwrNz7dHvpAFv0k+tsbJLmUaRwut+Gpk5Wr4pu4YAXhwuwwpdf64
-----END CERTIFICATE REQUEST-----

Сохранить в файл только нужную часть: 

cat k8s_pki_intermediate_ca_for_service_etcd_csr.json | jq -r .data.csr > k8s_pki_intermediate_ca_for_service_etcd.csr
  • Проверить более подробно
openssl req  -in k8s_pki_intermediate_ca_for_service_etcd.csr -text

Генерация сертификата по запросу

  • @ k8s_pki_intermediate_ca_for_service_etcd.csr - имя файла (с префиксом @) в котором сохранен запрос на создание сертификата с предыдущего шага

Создание сертефиката CA на основании запроса

vault \
  write \
    -format=json \
    k8s_pki_root_ca/root/sign-intermediate \
    csr=@k8s_pki_intermediate_ca_for_service_etcd.csr \
    country="Ukraine" \
    locality="Kharkov" \
    street_address="Lui Pastera st. 322 app. 131" \
    postal_code="61172" \
    organization="K8s The Hardest Way Labs" \
    ou="IT" \
    format=pem_bundle \
    ttl="175200h" > k8s_pki_intermediate_ca_for_service_etcd_pem_bundle.json

"Сырой" результат

cat k8s_pki_intermediate_ca_for_service_etcd_pem_bundle.json

PEM Файл

cat k8s_pki_intermediate_ca_for_service_etcd_pem_bundle.json | jq -r .data.certificate > k8s_pki_intermediate_ca_for_service_etcd_certificate.pem

-----BEGIN CERTIFICATE-----
MIIE9TCCA92gAwIBAgIUT+T1Nm5/8WjEJmyXwSG7RlRtmJMwDQYJKoZIhvcNAQEL
BQAwgcAxEDAOBgNVBAYTB1VrcmFpbmUxEDAOBgNVBAcTB0toYXJrb3YxLTAPBgNV
BAkTCGFwcC4gMTMxMBoGA1UECRMTTHVpIFBhc3RlcmEgU3QuIDMyMjEOMAwGA1UE
ERMFNjExNzIxFTATBgNVBAoTDEhvbWUgTmV0d29yazELMAkGA1UECxMCSVQxNzA1
BgNVBAMTLlJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IGZvciBIb21lIE5ldHdv
cmsgdjIwHhcNMjIxMDAyMTYxNjU1WhcNNDIwOTI3MTYxNzI1WjCBtjEQMA4GA1UE
BhMHVWtyYWluZTEQMA4GA1UEBxMHS2hhcmtvdjElMCMGA1UECRMcTHVpIFBhc3Rl
cmEgc3QuIDMyMiBhcHAuIDEzMTEOMAwGA1UEERMFNjExNzIxITAfBgNVBAoTGEs4
cyBUaGUgSGFyZGVzdCBXYXkgTGFiczELMAkGA1UECxMCSVQxKTAnBgNVBAMTIElu
dGVybWVkaWF0ZSBDQSBmb3Igc2VydmljZSBFVENkMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAw+BKXwFhQKQPN2oycnHz1OVaKt2wO/jSwlwIgL8Uqhsy
l1aVsEwOGZl4WSg+8O6WZYjMzOk8Xv5DVNulHEec2RbzfCyeejE9N5HTKb6LEN5S
X/81WyM6YfjRbZ+5BnqPdL8Mt8YbF04VzlOz5qREdNPIPmd8iwzCDEO0wNJp/2g3
26DHwSqdC0GfmlDNqnUTVvnxHkk+Gsn7Zx6gfg2pcpu7hlpanNUftGNOt/UA6mSc
IGNH1mnGX4OMFyHaqAljSWcPfvepoUqe0ZMOhkpEl6oI0EhigHyjwpzMULjp1JhP
MGiTBBBThH3CgCT7Ixkja/wjQQkKcW2xgXueuQ27FwIDAQABo4HuMIHrMA4GA1Ud
DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRAf2zV00Ozzw9c
ludrrD8ZTYtJNDAfBgNVHSMEGDAWgBQC+IUrdfjhHGkoMDIhLYZxr6vsPDBIBggr
BgEFBQcBAQQ8MDowOAYIKwYBBQUHMAKGLGh0dHA6Ly92YXVsdC5ob21lOjgyMDAv
djEvazhzX3BraV9yb290X2NhL2NhMD4GA1UdHwQ3MDUwM6AxoC+GLWh0dHA6Ly92
YXVsdC5ob21lOjgyMDAvdjEvazhzX3BraV9yb290X2NhL2NybDANBgkqhkiG9w0B
AQsFAAOCAQEAAGRmGgzdHM5w00Xos03Be0jat24CSQskVCAHFhV9dJN7v4YVuZUG
HVsb2m0MQmw5b3WGo2J9lNqIO0ETgnzqvye+Zj3DcetYaHZ300Rpv5QFqQNdebQY
O8MP03NvqPrlsscGmjWQ8swKRKIBjsIgVlQuWMK/30k5QXEX9Nys/p3gl+OfK6MA
nhKE6vYOneNpXTHJOly/0boyNf+/+MkFgFeLbe/gxNgyJu8CVYfaGjQ4FQNqDoy3
lMdepwKstmOo05m3/6qs6jEfVVjSf90hMbBbdelzpe3/ectYEc5ZqRdqNfeo5luR
MYmvkBormMQyOa3qsXCOjcyxQZ4hvXIVJA==
-----END CERTIFICATE-----

Детали сертефиката

openssl x509 -in intermediateCA.cert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:b2:aa:32:ee:ea:2f:84:75:bb:8f:ec:2e:98:56:70:1c:66:f6:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = Ukraine, L = Kharkov, street = app. 131 + street = Lui Pastera St. 322, postalCode = 61172, O = Home Network, OU = IT, CN = Root Certificate Authority for Home Network
        Validity
            Not Before: Oct 11 09:22:37 2021 GMT
            Not After : Oct  6 09:23:07 2041 GMT
        Subject: C = Ukraine, L = Kharkov, street = Lui Pastera st. 322 app. 131, postalCode = 61172, O = Home Network, OU = IT, CN = Intermediate CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c8:26:59:96:45:90:57:2e:03:32:99:6b:65:50:
                    29:fd:fb:72:35:05:2d:56:f8:ac:b2:6b:64:e0:b9:
                    cf:51:6e:58:5c:ca:3c:db:d4:3b:21:b6:42:40:76:
                    88:66:dd:bc:0f:9c:40:82:3f:20:b7:01:12:8e:c8:
                    df:31:ad:ea:58:3a:5a:61:b2:7d:fe:2f:7b:69:8c:
                    e7:ef:ab:b4:d2:25:79:75:f7:88:23:91:44:46:ec:
                    08:73:d8:50:7f:a0:fa:b4:f9:df:58:2d:80:7f:4d:
                    30:a1:d8:7d:ab:fb:79:17:31:7f:81:c8:94:dc:20:
                    74:3e:d3:7f:ba:12:be:f7:f9:fd:2a:3a:66:32:cb:
                    f5:3a:d6:59:a3:60:64:13:ce:58:4b:c7:30:56:67:
                    5c:6f:2c:d2:4a:68:c1:a8:64:78:03:c8:9d:79:6c:
                    bc:82:72:e4:a9:d0:66:05:9c:18:6d:c2:f4:b7:04:
                    be:b0:be:e8:68:9f:93:41:4e:32:dd:9c:f4:73:60:
                    0f:2c:6c:fa:b4:49:5a:69:51:0c:9d:69:56:37:bd:
                    d0:46:dc:7b:28:5a:ad:9d:f6:14:2c:e9:ce:7a:53:
                    2b:29:6b:1a:6c:90:a8:e9:11:da:52:a7:ff:ff:8d:
                    f4:36:70:70:2e:a7:80:1e:40:14:1a:8a:77:be:11:
                    fc:c5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                57:CC:17:CF:CF:21:94:71:42:B8:AB:06:7C:FD:FC:45:6D:F9:6A:4F
            X509v3 Authority Key Identifier:
                keyid:DB:3A:73:7A:03:25:2E:17:48:46:58:67:19:AD:86:2E:04:3D:EB:EC

    Signature Algorithm: sha256WithRSAEncryption
         88:e6:3d:6f:b3:11:a6:6f:6c:e1:77:5a:7b:ac:b2:62:6e:7b:
         69:24:7c:53:83:4a:86:f6:90:ca:cc:ed:de:ad:40:e2:6b:9d:
         e2:7d:34:5c:85:18:cd:aa:07:1d:4c:93:bc:f4:c6:c2:56:93:
         1c:2b:cf:3e:13:4d:57:dc:ab:46:64:c1:51:dd:5e:08:d4:69:
         a9:b5:d8:38:96:e8:9c:63:3a:ce:f7:64:b8:d0:28:91:1e:bf:
         54:17:3f:02:7e:d8:3d:27:11:99:02:4d:0c:37:74:9c:a6:3b:
         71:3c:cd:5f:66:ce:1d:d8:83:6d:42:dc:a3:b5:9f:c8:f3:a8:
         ad:a2:03:ec:28:7a:3b:86:b2:1d:a3:d2:06:98:56:bb:38:7b:
         ae:97:fb:98:97:76:7d:70:d2:ce:00:41:dc:04:56:ab:43:d5:
         67:bd:09:8f:a5:d6:aa:de:de:00:af:01:47:46:b9:f9:64:c8:
         0c:f4:76:ef:45:b8:2b:de:7b:39:53:8b:97:f5:37:52:79:f1:
         da:b2:1a:00:b9:51:af:20:5a:ae:32:95:63:d1:a8:d4:01:e7:
         75:ca:e5:5d:ed:2d:94:48:4d:6c:f1:1c:8d:ee:3d:ed:d0:3e:
         c5:1b:ba:51:10:24:c1:9d:96:0a:a8:17:3b:38:8d:98:76:2c:
         1d:3e:f4:07

Валидация с помошью корневого CA

openssl verify -verbose -CAfile rootCA.pem intermediateCA.cert.pem
intermediateCA.cert.pem: OK

Конфигурация Vault для использования промежуточного CA

Загрузка промежуточного сертефиката

vault write pki_intermediate_ca/intermediate/set-signed \
    certificate=@intermediateCA.cert.pem

Configure URLs

vault write pki_intermediate_ca/config/urls \
    issuing_certificates="http://vault.home:8200/v1/pki_intermediate_ca/ca" \
    crl_distribution_points="http://vault.home:8200/v1/pki_intermediate_ca/crl"
Источник — https://noname.com.ua/mediawiki/index.php?title=Vault_PKI_Intermediate_ca_etcd_Kubernetes_the_hard_way_v2&oldid=10051