ETCD 安全证书

“signing”,

“key encipherment”,

“client auth”

]

},

“peer”: {

“expiry”: “43800h”,

“usages”: [

“signing”,

“key encipherment”,

“server auth”,

“client auth”

]

}

}

}

}

EOF

[root@localhost etcd]# cat > ca-csr.json <<EOF

{

“CN”: “WAE Etcd CA”,

“key”: {

“algo”: “rsa”,

“size”: 2048

},

“names”: [

{

“C”: “CN”,

“L”: “FJ”,

“ST”: “Xia Men”

}

]

}

EOF

5、生成CA证书

[root@localhost etcd]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -#将会生成以下几个文件：

ca-key.pem

ca.csr

ca.pem

6、生成服务器端证书

[root@localhost etcd]# cat > server.json <<EOF

{

“CN”: “WAE Etcd Server”,

“hosts”: [

“127.0.0.1”,

“etcd1-com-hakim.com”,

“etcd2-com-hakim.com”,

“etcd3-com-hakim.com”,

“etcd4-com-hakim.com”,

“etcd5-com-hakim.com”

],

“key”: {

“algo”: “rsa”,

“size”: 2048

},

“names”: [

{

“C”: “CN”,

“L”: “FJ”,

“ST”: “Xia Men”

}

]

}

EOF

[root@localhost etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server server.json | cfssljson -bare server