Skip to content

Instantly share code, notes, and snippets.

@gkarugi

gkarugi/Docker.MD

Last active February 3, 2019 12:28
Show Gist options
  • Save gkarugi/b5c7825657eac44932dc12c913c62ee1 to your computer and use it in GitHub Desktop.
Save gkarugi/b5c7825657eac44932dc12c913c62ee1 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Docker.MD

Generate CA certificates for use with docker

Generate the certs

echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' | cfssl gencert -initca - | cfssljson -bare ca -
echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","server auth","client auth"]}}}' > ca-config.json
export ADDRESS=192.168.122.68,ext1.example.com,coreos1.local,coreos1
export NAME=server
echo '{"CN":"'$NAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$ADDRESS" - | cfssljson -bare $NAME
export ADDRESS=
export NAME=client
echo '{"CN":"'$NAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$ADDRESS" - | cfssljson -bare $NAME

Verify the certs

openssl x509 -in ca.pem -text -noout
openssl x509 -in server.pem -text -noout
openssl x509 -in client.pem -text -noout
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment