在Docker中生成自签名证书

Question

在Docker中生成自签名证书

dockerdockerfile

22

当docker启动时，我需要生成一个自签名证书。基本上我们的docker是使用concourse ci启动的。因此必须在dockerfile中进行，不能使用docker run选项。

请让我知道任何相关的输入。

- Vidya

3个回答

14

我在nginx:alpine中使用了相似的东西：

FROM nginx:1.19.1-alpine

RUN apk update && \
    apk add --no-cache openssl && \
    openssl req -x509 -nodes -days 365 \
    -subj  "/C=CA/ST=QC/O=Company Inc/CN=example.com" \
     -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key \
     -out /etc/ssl/certs/nginx-selfsigned.crt;

- Matthew Hegarty

1

受到Kevin Kopf的启发

#!/bin/bash
set -e

OPENSSL_INSTALLED=false

if which openssl >/dev/null
then 
  OPENSSL_INSTALLED=true
fi

## certificate parameters
COUNTRY_NAME="US"
STATE_NAME="New Mexico"
LOCALITY_NAME="Roswell"
ORGANIZATION_NAME="ACME Co, LLC."
ORGANIZATIONAL_UNIT_NAME="ACME Department"
COMMON_NAME="www.domain.com"
EMAIL_ADDRESS="email@domain"

## apache or nginx
SERVER_KEY="apache-selfsigned.key"
SERVER_KEY_PATH="/etc/ssl/private"
SERVER_CRT="apache-selfsigned.crt"
SERVER_CRT_PATH="/etc/ssl/certs"

OPENSSL_SUBJ_OPTIONS="
Country Name (2 letter code) [AU]:$COUNTRY_NAME
State or Province Name (full name) [Some-State]:$STATE_NAME
Locality Name (eg, city) []:$LOCALITY_NAME
Organization Name (eg, company) [Internet Widgits Pty Ltd]:$ORGANIZATION_NAME
Organizational Unit Name (eg, section) []:$ORGANIZATIONAL_UNIT_NAME
Common Name (e.g. server FQDN or YOUR name) []:$COMMON_NAME
Email Address []:$EMAIL_ADDRESS
"

if [ "$OPENSSL_INSTALLED" = true ]
then 
    echo "generating self signed certificate"
    echo "with these options: "
    echo "$OPENSSL_SUBJ_OPTIONS"
    echo ""

    ## generate self signed certificate
    openssl req \
        -new \
        -newkey rsa:4096 \
        -days 365 \
        -nodes \
        -x509 \
        -subj "/emailAddress=$EMAIL_ADDRESS/C=$COUNTRY_NAME/ST=$STATE_NAME/L=$LOCALITY_NAME/O=$ORGANIZATION_NAME/OU=$ORGANIZATIONAL_UNIT_NAME/CN=$COMMON_NAME" \
        -keyout $SERVER_KEY \
        -out $SERVER_CRT
    
    ## uncomment: move to correct location
    #mv -f $SERVER_KEY $SERVER_KEY_PATH/$SERVER_KEY
    #mv -f $SERVER_CRT $SERVER_CRT_PATH/$SERVER_CRT
else
    echo "openssl is not installed"
    exit 1
fi

#end

- Phill Pafford

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- Kevin Kopf · Accepted Answer

简单的RUN命令有什么问题？它对我有效，并成功创建了自签名证书。

FROM debian:wheezy

RUN apt-get update && \
    apt-get install -y openssl && \
    openssl genrsa -des3 -passout pass:x -out server.pass.key 2048 && \
    openssl rsa -passin pass:x -in server.pass.key -out server.key && \
    rm server.pass.key && \
    openssl req -new -key server.key -out server.csr \
        -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com" && \
    openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

在 Dockerfile 中，证书仅在镜像构建期间创建一次；然后您可以在镜像中使用该证书。

如果您需要每次容器启动时都使用新的自签名证书，则可以使用外部 shell 脚本来实现。如下所示：

#!/bin/bash

openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
openssl rsa -passin pass:x -in server.pass.key -out server.key
rm server.pass.key
openssl req -new -key server.key -out server.csr \
    -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

将该shell脚本放入您的Dockerfile中并设置默认执行：

FROM debian:wheezy

RUN apt-get update && \
    apt-get install -y openssl

COPY generate-certificate.sh /tmp/generate-certificate.sh

CMD [ "/tmp/generate-certificate.sh" ]

每次您使用 docker run .... 启动容器时，都会生成一个新的唯一证书。