前言

之前開(kāi)啟了docker的2375 Remote API，接到公司安全部門(mén)的要求，需要啟用授權(quán)，翻了下官方文檔

Protect the Docker daemon socket

啟用TLS

在docker服務(wù)器，生成CA私有和公共密鑰

$ openssl genrsa -aes256 -out ca-key.pem 4096Generating RSA private key, 4096 bit long modulus............................................................................................................................................................................................++........++e is 65537 (0x10001)Enter pass phrase for ca-key.pem:Verifying - Enter pass phrase for ca-key.pem:$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pemEnter pass phrase for ca-key.pem:You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:QueenslandLocality Name (eg, city) []:BrisbaneOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Docker IncOrganizational Unit Name (eg, section) []:SalesCommon Name (e.g. server FQDN or YOUR name) []:$HOSTEmail Address []:Sven@home.org.au

有了CA后，可以創(chuàng)建一個(gè)服務(wù)器密鑰和證書(shū)簽名請(qǐng)求(CSR)

$HOST 是你的服務(wù)器ip

$ openssl genrsa -out server-key.pem 4096Generating RSA private key, 4096 bit long modulus.....................................................................++.................................................................................................++e is 65537 (0x10001)$ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr

接著，用CA來(lái)簽署公共密鑰:

$ echo subjectAltName = DNS:$HOST,IP:$HOST:127.0.0.1 >> extfile.cnf $ echo extendedKeyUsage = serverAuth >> extfile.cnf

生成key：

$ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem / -CAcreateserial -out server-cert.pem -extfile extfile.cnfSignature oksubject=/CN=your.host.comGetting CA Private KeyEnter pass phrase for ca-key.pem:

創(chuàng)建客戶(hù)端密鑰和證書(shū)簽名請(qǐng)求:

$ openssl genrsa -out key.pem 4096Generating RSA private key, 4096 bit long modulus.........................................................++................++e is 65537 (0x10001)$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr

修改extfile.cnf：

echo extendedKeyUsage = clientAuth > extfile-client.cnf

生成簽名私鑰：

$ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem / -CAcreateserial -out cert.pem -extfile extfile-client.cnfSignature oksubject=/CN=clientGetting CA Private KeyEnter pass phrase for ca-key.pem: