Terraform自签名证书Openssl验证失败
问题描述:
我正在尝试使用Terraform创建一个自签名证书,以便在测试/开发环境中内部使用。Terraform自签名证书Openssl验证失败
我首先创建一个CA私钥,自签名证书。
然后,我为要为其启用HTTPS的内部域名创建证书签名请求和私钥。
然后我签署证书。这里是我使用的整个Terraform清单:
resource "tls_private_key" "ca" {
algorithm = "ECDSA"
ecdsa_curve = "P384"
}
resource "tls_self_signed_cert" "ca" {
key_algorithm = "${tls_private_key.ca.algorithm}"
private_key_pem = "${tls_private_key.ca.private_key_pem}"
subject {
common_name = "Example CA"
organization = "Example, Ltd"
country = "GB"
}
validity_period_hours = 43800
is_ca_certificate = true
allowed_uses = [
"key_encipherment",
"digital_signature",
"server_auth",
"client_auth",
]
}
resource "tls_private_key" "registry" {
algorithm = "ECDSA"
ecdsa_curve = "P384"
}
resource "tls_cert_request" "registry" {
key_algorithm = "${tls_private_key.registry.algorithm}"
private_key_pem = "${tls_private_key.registry.private_key_pem}"
subject {
common_name = "registry.test.example.com"
organization = "Example, Ltd"
country = "GB"
}
dns_names = ["registry.test.example.com"]
}
resource "tls_locally_signed_cert" "registry" {
cert_request_pem = "${tls_cert_request.registry.cert_request_pem}"
ca_key_algorithm = "${tls_private_key.ca.algorithm}"
ca_private_key_pem = "${tls_private_key.ca.private_key_pem}"
ca_cert_pem = "${tls_self_signed_cert.ca.cert_pem}"
validity_period_hours = 43800
allowed_uses = [
"key_encipherment",
"digital_signature",
"server_auth",
"client_auth",
]
}
我运行Terraform清单。然后我从状态文件中提取生成的证书并将它们保存到文件中。
我试图验证与OpenSSL的最终证书,但得到一个错误:
$ openssl verify -CAfile ca-cert.pem registry.pem
registry.pem: C = GB, ST = , L = , postalCode = , O = "Example, Ltd", OU = , CN = registry.example.com
error 20 at 0 depth lookup:unable to get local issuer certificate
任何想法的问题是什么?我花了很多时间试图弄清楚这一点。
基本上我想用它在我的测试/开发环境中为私有Docker注册表启用HTTPS。
答
您需要添加cert_signing
到tls_private_key.ca.allowed_uses
:
resource "tls_self_signed_cert" "ca" {
key_algorithm = "${tls_private_key.ca.algorithm}"
private_key_pem = "${tls_private_key.ca.private_key_pem}"
subject {
common_name = "Example CA"
organization = "Example, Ltd"
country = "GB"
}
validity_period_hours = 43800
is_ca_certificate = true
allowed_uses = [
"key_encipherment",
"digital_signature",
"server_auth",
"client_auth",
"cert_signing"
]
}
参见:https://www.terraform.io/docs/providers/tls/r/self_signed_cert.html#cert_signing