CentOS 7.4 
		
		
			
			
				
					
				|  | 192.168.61.11 node1 192.168.61.12 node2 192.168.61.13 node3   | 
				
			 
		 
 TLS密钥和证书 这里部署的etcd集群使用TLS证书对证书通信进行加密,并开启基于CA根证书签名的双向数字证书认证。 下面介绍使用cfssl生成所需要的私钥和证书. centos-mini版本的linux需要安装开发包: yum groupinstall “Development Tools” 安装cfssl cfssl是使用Go语言开发的工具,如果系统中安装了Go,可以使用直接go get安装cfssl: 项目地址:https://github.com/cloudflare/cfssl 
		
		
			
			
				
					
				|  | go get -u <a class="vglnk" href="http://github.com/cloudflare/cfssl/cmd/" rel="nofollow">github.com/cloudflare/cfssl/cmd/</a>...   | 
				
			 
		 
 会在$GOPATH/bin下安装cfssl, cfssjosn, mkbundle等工具。 CA证书和私钥 创建ca-config.json: 
		
		
			
			
				
					
				| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | <span class="p">{</span>   <span class="nt">"signing"</span><span class="p">:</span> <span class="p">{</span>     <span class="nt">"default"</span><span class="p">:</span> <span class="p">{</span>       <span class="nt">"expiry"</span><span class="p">:</span> <span class="s2">"87600h"</span>     <span class="p">},</span>     <span class="nt">"profiles"</span><span class="p">:</span> <span class="p">{</span>       <span class="nt">"frognew"</span><span class="p">:</span> <span class="p">{</span>         <span class="nt">"usages"</span><span class="p">:</span> <span class="p">[</span>             <span class="s2">"signing"</span><span class="p">,</span>             <span class="s2">"key encipherment"</span><span class="p">,</span>             <span class="s2">"server auth"</span><span class="p">,</span>             <span class="s2">"client auth"</span>         <span class="p">],</span>         <span class="nt">"expiry"</span><span class="p">:</span> <span class="s2">"87600h"</span>       <span class="p">}</span>     <span class="p">}</span>   <span class="p">}</span> <span class="p">}</span>   | 
				
			 
		 
 ca-config.json中可以定义多个profile,分别设置不同的expiry和usages等参数。如上面的ca-config.json中定义了名称为frognew的profile,这个profile的expiry 87600h为10年,useages中: signing表示此CA证书可以用于签名其他证书,ca.pem中的CA=TRUE server auth表示TLS Server Authentication client auth表示TLS Client Authentication 创建CA证书签名请求配置ca-csr.json: 
		
		
			
			
				
					
				| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | <span class="p">{</span>   <span class="nt">"CN"</span><span class="p">:</span> <span class="s2">"frognew"</span><span class="p">,</span>   <span class="nt">"key"</span><span class="p">:</span> <span class="p">{</span>     <span class="nt">"algo"</span><span class="p">:</span> <span class="s2">"rsa"</span><span class="p">,</span>     <span class="nt">"size"</span><span class="p">:</span> <span class="mi">2048</span>   <span class="p">},</span>   <span class="nt">"names"</span><span class="p">:</span> <span class="p">[</span>     <span class="p">{</span>       <span class="nt">"C"</span><span class="p">:</span> <span class="s2">"CN"</span><span class="p">,</span>       <span class="nt">"ST"</span><span class="p">:</span> <span class="s2">"BeiJing"</span><span class="p">,</span>       <span class="nt">"L"</span><span class="p">:</span> <span class="s2">"BeiJing"</span><span class="p">,</span>       <span class="nt">"O"</span><span class="p">:</span> <span class="s2">"frognew"</span><span class="p">,</span>       <span class="nt">"OU"</span><span class="p">:</span> <span class="s2">"cloudnative"</span>     <span class="p">}</span>   <span class="p">]</span> <span class="p">}</span>   | 
				
			 
		 
 下面使用cfss生成CA证书和私钥: 
		
		
			
			
				
					
				|  | cfssl gencert -initca ca-csr.json | cfssljson -bare ca   | 
				
			 
		 
 
		
		
			
			
				
					
				|  | ls ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem   | 
				
			 
		 
 ca-key.pem和ca.pem需要保存在一个安全的地方,后边会用到。 etcd证书和私钥 创建etcd证书签名请求配置etcd-csr.json: 
		
		
			
			
				
					
				| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | <span class="p">{</span>     <span class="nt">"CN"</span><span class="p">:</span> <span class="s2">"frognew"</span><span class="p">,</span>     <span class="nt">"hosts"</span><span class="p">:</span> <span class="p">[</span>       <span class="s2">"127.0.0.1"</span><span class="p">,</span>       <span class="s2">"192.168.61.11"</span><span class="p">,</span>       <span class="s2">"192.168.61.12"</span><span class="p">,</span>       <span class="s2">"192.168.61.13"</span><span class="p">,</span>       <span class="s2">"node1"</span><span class="p">,</span>       <span class="s2">"node2"</span><span class="p">,</span>       <span class="s2">"node3"</span>     <span class="p">],</span>     <span class="nt">"key"</span><span class="p">:</span> <span class="p">{</span>         <span class="nt">"algo"</span><span class="p">:</span> <span class="s2">"rsa"</span><span class="p">,</span>         <span class="nt">"size"</span><span class="p">:</span> <span class="mi">2048</span>     <span class="p">},</span>     <span class="nt">"names"</span><span class="p">:</span> <span class="p">[</span>         <span class="p">{</span>             <span class="nt">"C"</span><span class="p">:</span> <span class="s2">"CN"</span><span class="p">,</span>             <span class="nt">"ST"</span><span class="p">:</span> <span class="s2">"BeiJing"</span><span class="p">,</span>             <span class="nt">"L"</span><span class="p">:</span> <span class="s2">"BeiJing"</span><span class="p">,</span>             <span class="nt">"O"</span><span class="p">:</span> <span class="s2">"frognew"</span><span class="p">,</span>             <span class="nt">"OU"</span><span class="p">:</span> <span class="s2">"cloudnative"</span>         <span class="p">}</span>     <span class="p">]</span> <span class="p">}</span>   | 
				
			 
		 
 注意上面配置hosts字段中制定授权使用该证书的IP和域名列表,因为现在要生成的证书需要被etcd集群各个节点使用,所以这里指定了各个节点的IP和hostname。 下面生成etcd的证书和私钥: 
		
		
			
			
				
					
				|  | cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=frognew etcd-csr.json | cfssljson -bare etcd   ls etcd* etcd.csr  etcd-csr.json  etcd-key.pem  etcd.pem   | 
				
			 
		 
 对生成的证书可以使用cfssl或openssl查看: 
		
		
			
			
				
					
				|  | cfssl-certinfo -cert etcd.pem   openssl x509  -noout -text -in  etcd.pem   | 
				
			 
		 
 安装etcd 将CA证书ca.pem, etcd秘钥etcd-key.pem, Read more…