openssl.cnf详解

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

BASE_DOMAIN=
CLUSTER_NAME=
CERT_DIR=
APISERVER_CLUSTER_IP=
MASTER_NAME=

[ ca ]
# man ca
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = \${ENV::CERT_DIR}
certs             = \$dir
crl_dir           = \$dir/crl
new_certs_dir     = \$dir
database          = \$dir/index.txt
serial            = \$dir/serial
# certificate revocation lists.
crlnumber         = \$dir/crlnumber
crl               = \$dir/crl/intermediate-ca.crl
crl_extensions    = crl_ext
default_crl_days  = 30
default_md        = sha256

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_loose

[ policy_loose ]
# Allow the CA to sign a range of certificates.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
# man req
default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only
default_md          = sha256

[ req_distinguished_name ]
countryName                    = Country Name (2 letter code)
stateOrProvinceName            = State or Province Name
localityName                   = Locality Name
0.organizationName             = Organization Name
organizationalUnitName         = Organizational Unit Name
commonName                     = Common Name

# Certificate extensions (man x509v3_config)

[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ client_cert ]
basicConstraints = CA:FALSE
nsCertType = client
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = @etcd_client

[ server_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth

[ identity_server_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS.1:tectonic-identity-api.tectonic-system.svc.cluster.local

[ etcd_server_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @etcd_server_and_peer_dns

[ etcd_peer_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @etcd_server_and_peer_dns

[ apiserver_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @apiserver_names

[ master_component_client_cert ]
basicConstraints = CA:FALSE
nsCertType = client
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
subjectAltName = @master_component_names


[etcd_server_and_peer_dns]
DNS.1 = \${ENV::BASE_DOMAIN}
DNS.2 = localhost
IP.1 = 10.0.0.5
IP.2 = 127.0.0.1
IP.3 = 127.0.0.5

[apiserver_names]
DNS.1 = \${ENV::CLUSTER_NAME}-\${ENV::BASE_DOMAIN}
DNS.2 = \${ENV::BASE_DOMAIN}
DNS.3 = kubernetes
DNS.4 = kubernetes.default
DNS.5 = kubernetes.default.svc
DNS.6 = kubernetes.default.svc.cluster.local
IP.1 = \${ENV::APISERVER_CLUSTER_IP}
IP.2 = 10.0.0.5
IP.3 = 10.0.0.4


[ master_component_names ]
DNS.1 = \${ENV::MASTER_NAME}.\${ENV::BASE_DOMAIN}
DNS.2 = \${ENV::BASE_DOMAIN}
IP.1 = 10.0.0.5
IP.2 = 10.0.0.4

# used for etcd_client
[ etcd_client ]
DNS.1 = localhost
IP.1 = 10.0.0.5
IP.2 = 10.0.0.4
IP.3 = 10.0.0.6
IP.4 = 127.0.0.1

1
2
3
4
5

BASE_DOMAIN=                  # 基础域名，通常用于 Kubernetes 集群或 API 服务器的域名配置
CLUSTER_NAME=                 # 集群名称，通常作为集群的标识符
CERT_DIR=                     # 证书文件存放的目录
APISERVER_CLUSTER_IP=         # API 服务器的集群内部 IP 地址
MASTER_NAME=                  # Kubernetes 主节点的名称

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# Directory and file locations.
dir               = \${ENV::CERT_DIR}    # 证书存放的根目录
certs             = \$dir                 # 证书文件夹
crl_dir           = \$dir/crl             # CRL（证书吊销列表）文件夹
new_certs_dir     = \$dir                 # 新证书文件夹
database          = \$dir/index.txt       # 用于存储证书请求、签发等信息的数据库文件
serial            = \$dir/serial          # 用于跟踪签发证书的序列号文件
crlnumber         = \$dir/crlnumber       # CRL 证书吊销序列号
crl               = \$dir/crl/intermediate-ca.crl  # 吊销列表文件
crl_extensions    = crl_ext               # CRL 扩展配置
default_crl_days  = 30                    # 默认 CRL 有效期为 30 天
default_md        = sha256                # 默认使用 sha256 哈希算法
name_opt          = ca_default            # 证书的名称选项
cert_opt          = ca_default            # 证书的选项
default_days      = 375                   # 证书默认有效期为 375 天
preserve          = no                    # 是否保留 CA 对已签发证书的审计日志
policy            = policy_loose          # 使用 'policy_loose' 签发证书

1
2
3
4
5
6
7

countryName             = optional       # 国家名称可选
stateOrProvinceName     = optional       # 省/州名称可选
localityName            = optional       # 地市名称可选
organizationName        = optional       # 组织名称可选
organizationalUnitName  = optional       # 组织单位名称可选
commonName              = supplied       # 公共名称是必须提供的（通常是域名或主机名）
emailAddress            = optional       # 邮件地址可选

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

[ req ]
default_bits        = 4096           # 默认的密钥位数为 4096 位
distinguished_name  = req_distinguished_name  # 引用 'req_distinguished_name' 部分来定义 DN（区分名称）
string_mask         = utf8only       # 使用 UTF-8 字符编码
default_md          = sha256         # 默认使用 sha256 作为散列算法

[ req_distinguished_name ]
countryName                    = Country Name (2 letter code)  # 国家（2个字母的国家代码）
stateOrProvinceName            = State or Province Name      # 省/州名称
localityName                   = Locality Name               # 城市/地区名称
0.organizationName             = Organization Name           # 组织名称
organizationalUnitName         = Organizational Unit Name    # 组织单位名称
commonName                     = Common Name                 # 通用名称（通常是域名或主机名）

1
2
3
4
5
6

subjectKeyIdentifier = hash                     # 用于标识证书的主题密钥标识符
authorityKeyIdentifier = keyid:always,issuer    # 用于标识证书的颁发者密钥标识符
# 基本约束，标明该证书为 CA 证书，且路径长度为 0（不能作为其他证书的颁发机构）
# CA:true 表示这个为ca
basicConstraints = critical, CA:true, pathlen:0  
keyUsage = critical, digitalSignature, cRLSign, keyCertSign  # 证书使用场景：数字签名、证书吊销列表签名、证书签发

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

[ client_cert ]
# 不允许作为 CA 证书使用
basicConstraints = CA:FALSE
# 客户端证书使用场景
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
# 扩展用途：客户端身份验证、服务器身份验证
extendedKeyUsage = clientAuth, serverAuth
# 使用 'etcd_client' 部分中定义内容用作的 SAN 配置
subjectAltName = @etcd_client


[ server_cert ]
# 不允许作为 CA 证书使用
basicConstraints = CA:FALSE
# 服务器证书使用场景
keyUsage = critical, digitalSignature, keyEncipherment
# 扩展用途：服务器身份验证、客户端身份验证
extendedKeyUsage = serverAuth, clientAuth
# 使用 'etcd_server_and_peer_dns' 配置
subjectAltName = @etcd_server_and_peer_dns

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

[ etcd_server_and_peer_dns ]
DNS.1 = \${ENV::BASE_DOMAIN}             # 基础域名
DNS.2 = localhost                        # 本地主机名
IP.1 = 10.0.0.5                          # IP 地址
IP.2 = 127.0.0.1                         # 本地回环地址
IP.3 = 127.0.0.5                         # 另一个本地回环地址

[ apiserver_names ]
# 使用集群名称和基础域名组成的 DNS 名称
# 使用上面的变量
DNS.1 = \${ENV::CLUSTER_NAME}-\${ENV::BASE_DOMAIN}
# 基础域名
DNS.2 = \${ENV::BASE_DOMAIN}
# API 服务器的 IP 地址
IP.1 = \${ENV::APISERVER_CLUSTER_IP}
# 备用 IP 地址
IP.2 = 10.0.0.5