Skip to content

Instantly share code, notes, and snippets.

@cameron

cameron/docker-ssl-cert-generate

Last active February 2, 2023 10:09
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save cameron/10797040 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save cameron/10797040 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. cameron revised this gist Apr 16, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion docker-ssl-cert-generate
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,6 @@
    #! /bin/bash

    # HEADS UP! Make sure to use '*' or a valid hostname for the FDQN prompt, or you
    # HEADS UP! Make sure to use '*' or a valid hostname for the FDQN prompt

    echo 01 > ca.srl
    openssl genrsa -des3 -out ca-key.pem
  2. cameron created this gist Apr 16, 2014.
    28 changes: 28 additions & 0 deletions docker-ssl-cert-generate
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,28 @@
    #! /bin/bash

    # HEADS UP! Make sure to use '*' or a valid hostname for the FDQN prompt, or you

    echo 01 > ca.srl
    openssl genrsa -des3 -out ca-key.pem
    openssl req -new -x509 -days 365 -key ca-key.pem -out ca.pem

    openssl genrsa -des3 -out server-key.pem
    openssl req -new -key server-key.pem -out server.csr

    openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem -out server-cert.pem

    openssl genrsa -des3 -out client-key.pem
    openssl req -new -key client-key.pem -out client.csr

    echo extendedKeyUsage = clientAuth > extfile.cnf

    openssl x509 -req -days 365 -in client.csr -CA ca.pem -CAkey ca-key.pem -out client-cert.pem -extfile extfile.cnf

    openssl rsa -in server-key.pem -out server-key.pem
    openssl rsa -in client-key.pem -out client-key.pem

    # server
    # sudo docker -d --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:4243

    # client -- note that this uses --tls instead of --tlsverify, which I had trouble with
    # docker --tls --tlscacert=ca.pem --tlscert=client-cert.pem --tlskey=client-key.pem -H=dns-name-of-docker-host:4243