GlooMeshCreateCerts.md

Create a CA root cert

openssl req -new -newkey rsa:4096 -x509 -sha256 \
        -days 3650 -nodes -out relay-root.crt -keyout relay-root.key \
        -subj "/CN=enterprise-networking-ca" \
        -addext "extendedKeyUsage = clientAuth, serverAuth"

Create a server cert

echo "Create server cert

openssl genrsa -out "relay-server-tls.key" 2048

cat > "relay-server-tls.conf" <<EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = @alt_names
[alt_names]
DNS= *.myocpcluster.us-south.containers.appdomain.cloud
EOF

openssl req -new -key "relay-server-tls.key" -out relay-server-tls.csr -subj "/CN=enterprise-networking-ca" -config "relay-server-tls.conf"

openssl x509 -req \
  -days 3650 \
  -CA relay-root.crt -CAkey relay-root.key \
  -set_serial 0 \
  -in relay-server-tls.csr -out relay-server-tls.crt \
  -extensions v3_req -extfile "relay-server-tls.conf"

Create client cert

# Client certs need to have DNS name from cluster_name
echo "Creating relay client-certs for cluster remotecluster1"
# The value here is the most important, the management-plane uses the SAN to figure out the indentity
# Replace the cluster name here

echo "[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = @alt_names
[alt_names]
DNS = remotecluster1" > "relay-client-tls.conf"

openssl genrsa -out "relay-client-tls.key" 2048

openssl req -new -key "relay-client-tls.key" -out relay-client-tls.csr -subj "/CN=enterprise-networking-ca" -config "relay-client-tls.conf"

openssl x509 -req \
    -days 3650 \
    -CA relay-root.crt -CAkey relay-root.key \
    -set_serial 0 \
    -in relay-client-tls.csr -out relay-client-tls.crt \
    -extensions v3_req -extfile "relay-client-tls.conf"