使用terraform 生成自签名证书
terraform 是一个很不错的基础设施工具，我们可以用来做关于基础设施部署的事情，可以实现基础设施即代码
以下演示一个简单的自签名证书的生成（使用tls provider）
main.tf 文件
resource "tls_private_key" "example" {
algorithm = "RSA"
}
resource "tls_self_signed_cert" "example" {
key_algorithm = "${tls_private_key.example.algorithm}"
private_key_pem = "${tls_private_key.example.private_key_pem}"
# Certificate expires after 12 hours.
validity_period_hours = 120000000
# Generate a new certificate if Terraform is run within three
# hours of the certificate's expiration time.
early_renewal_hours = 30000000
is_ca_certificate = true
# Reasonable set of uses for a server SSL certificate.
allowed_uses = [
"key_encipherment",
"digital_signature",
"server_auth",
]
ip_addresses = ["127.0.0.1","192.168.0.111","10.10.18.119"]
dns_names = ["api.example.com", "k8sapi.example.com"]
subject {
common_name = "example.com"
organization = "example, Inc"
}
}
data "archive_file" "userinfos" {
type = "zip"
output_path = "tf-result/cert.zip"
source {
content = tls_private_key.example.private_key_pem
filename = "private_key_pem"
}
source {
content = tls_private_key.example.public_key_pem
filename = "public_key_pem"
}
source {
content = tls_self_signed_cert.example.cert_pem
filename = "cert_pem"
}
}
resource 说明
以上代码使用了archive provider 进行生成文件压缩，使用tls_private_key 生成私钥
使用tls_self_signed_cert 生成自签名证书
运行
- init 下载插件
terraform init
- 查看计划
terraform plan
效果
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
<= read (data resources)
Terraform will perform the following actions:
# data.archive_file.userinfos will be read during apply
# (config refers to values not yet known)
<= data "archive_file" "userinfos" {
+ id = (known after apply)
+ output_base64sha256 = (known after apply)
+ output_md5 = (known after apply)
+ output_path = "tf-result/cert.zip"
+ output_sha = (known after apply)
+ output_size = (known after apply)
+ type = "zip"
+ source {
+ content = (known after apply)
+ filename = "cert_pem"
}
+ source {
+ content = (known after apply)
+ filename = "private_key_pem"
}
+ source {
+ content = (known after apply)
+ filename = "public_key_pem"
}
}
# tls_private_key.example will be created
+ resource "tls_private_key" "example" {
+ algorithm = "RSA"
+ ecdsa_curve = "P224"
+ id = (known after apply)
+ private_key_pem = (known after apply)
+ public_key_fingerprint_md5 = (known after apply)
+ public_key_openssh = (known after apply)
+ public_key_pem = (known after apply)
+ rsa_bits = 2048
}
# tls_self_signed_cert.example will be created
+ resource "tls_self_signed_cert" "example" {
+ allowed_uses = [
+ "key_encipherment",
+ "digital_signature",
+ "server_auth",
]
+ cert_pem = (known after apply)
+ dns_names = [
+ "api.example.com",
+ "k8sapi.example.com",
]
+ early_renewal_hours = 30000000
+ id = (known after apply)
+ ip_addresses = [
+ "127.0.0.1",
+ "192.168.0.111",
+ "10.10.18.119",
]
+ is_ca_certificate = true
+ key_algorithm = "RSA"
+ private_key_pem = (known after apply)
+ validity_end_time = (known after apply)
+ validity_period_hours = 120000000
+ validity_start_time = (known after apply)
+ subject {
+ common_name = "example.com"
+ organization = "example, Inc"
}
}
Plan: 2 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.
- apply
terraform apply
效果
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
<= read (data resources)
Terraform will perform the following actions:
# data.archive_file.userinfos will be read during apply
# (config refers to values not yet known)
<= data "archive_file" "userinfos" {
+ id = (known after apply)
+ output_base64sha256 = (known after apply)
+ output_md5 = (known after apply)
+ output_path = "tf-result/cert.zip"
+ output_sha = (known after apply)
+ output_size = (known after apply)
+ type = "zip"
+ source {
+ content = (known after apply)
+ filename = "cert_pem"
}
+ source {
+ content = (known after apply)
+ filename = "private_key_pem"
}
+ source {
+ content = (known after apply)
+ filename = "public_key_pem"
}
}
# tls_private_key.example will be created
+ resource "tls_private_key" "example" {
+ algorithm = "RSA"
+ ecdsa_curve = "P224"
+ id = (known after apply)
+ private_key_pem = (known after apply)
+ public_key_fingerprint_md5 = (known after apply)
+ public_key_openssh = (known after apply)
+ public_key_pem = (known after apply)
+ rsa_bits = 2048
}
# tls_self_signed_cert.example will be created
+ resource "tls_self_signed_cert" "example" {
+ allowed_uses = [
+ "key_encipherment",
+ "digital_signature",
+ "server_auth",
]
+ cert_pem = (known after apply)
+ dns_names = [
+ "api.example.com",
+ "k8sapi.example.com",
]
+ early_renewal_hours = 30000000
+ id = (known after apply)
+ ip_addresses = [
+ "127.0.0.1",
+ "192.168.0.111",
+ "10.10.18.119",
]
+ is_ca_certificate = true
+ key_algorithm = "RSA"
+ private_key_pem = (known after apply)
+ validity_end_time = (known after apply)
+ validity_period_hours = 120000000
+ validity_start_time = (known after apply)
+ subject {
+ common_name = "example.com"
+ organization = "example, Inc"
}
}
Plan: 2 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
tls_private_key.example: Creating...
tls_private_key.example: Creation complete after 0s [id=4bb57b583566785ce23a003432515e07fcebfdba]
tls_self_signed_cert.example: Creating...
tls_self_signed_cert.example: Creation complete after 0s [id=132700825268662052341550768328847386301]
data.archive_file.userinfos: Refreshing state...
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
- 文件内容
unzip cert.zip
Archive: cert.zip
inflating: cert_pem
inflating: private_key_pem
inflating: public_key_pem
说明
我们可以结合vault 的tls 管理以及tf 方便的进行证书管理——基础设施即代码
参考资料
https://www.terraform.io/docs/providers/tls/r/self_signed_cert.html
https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine
使用terraform 生成自签名证书的更多相关文章
- cmd命令生成android签名证书
cmd命令生成android签名证书,有空在写一篇eclipse导出带签名的apk,这里面包括生成新的签名.现在还是讲讲在cmd怎么操作生成签名证书. 1.dos下进入JDK的bin目录 运行如下命令 ...
- windows下使用makecert命令生成自签名证书
1.makecert命令路径 C:\Program Files (x86)\Windows Kits\8.1\bin\x64 2.生成一个自签名证书 makecert -r -pe -n " ...
- openssl生成自签名证书
1.生成x509格式的CA自签名证书 openssl req -new -x509 -keyout ca.key -out ca.crt 2.生成服务端的私钥(key文件)及申请证书文件csr文件 o ...
- 用OpenSSL生成自签名证书在IIS上搭建Https站点（用于iOS的https访问）
前提: 先安装openssl,安装有两种方式,第一种直接下载安装包,装上就可运行:第二种可以自己下载源码,自己编译.这里推荐第一种. 安装包:http://slproweb.com/products/ ...
- [ipsec][strongswan] 用strongswan pki工具生成自签名证书
如题.我在实验环境里,分别要为两个endpoint(T9和T129)生成证书. 证书是如何生成的呢? 证书是由根证书机构签发的.申请证书的人将request提交给根证书机构,然后根证书机构根据requ ...
- ios生成自签名证书，实现web下载安装app
抄自http://beyondvincent.com/blog/2014/03/17/five-tips-for-using-self-signed-ssl-certificates-with-ios ...
- 生成自签名证书-开启https
1.生成CA证书 # 生成 CA 私钥 openssl genrsa -out ca.key 2048 # X.509 Certificate Signing Request (CSR) Manage ...
- OpenSSL使用1（用OpenSSL生成自签名证书在IIS上搭建Https站点）（用于iOS的https访问）
前提: 先安装openssl,安装有两种方式,第一种直接下载安装包,装上就可运行:第二种可以自己下载源码,自己编译.这里推荐第一种. 安装包:http://slproweb.com/products/ ...
- Windows下生成自签名证书
最近通过openssl生成了自签名的证书,总结成下面这张图. 说明:下载openssl0.9.8之后解压,然后运行bin\openssl.exe进入openssl运行环境,然后按上图中顺序执行命令.( ...
随机推荐
- Unity 代码提示符和UGUI屏幕自适应
[Header]("提示字符") Canvas Scaler 屏幕自适应
- 手写ORM入门篇（一）
对象关系映射(英语:(Object Relational Mapping,简称ORM,或O/RM,或O/R mapping),是一种程序技术,用于实现面向对象编程语言里不同类型系统的数据之间的转换 . ...
- VMware 网络介绍
3.1 网卡介绍 如图所示,你的机器有两块网卡,一个是有线,一个是无线. 装完VM之后,会出现两块虚拟网卡,如图 VM有四种连接方式,我们着重介绍前三种 3.2 桥接 选择桥接模式,说明V ...
- win10 bcdedit testsigning
win10 bcdedit testsigning # 禁用系统完整性检查和禁用驱动签名以及进入测试签名驱动模式> bcdedit.exe /set nointegritychecks on & ...
- 必须掌握的Linux用户组知识
在 Linux 系统中用户组起着重要作用.用户组提供了一种简单方法供一组用户互相共享文件.用户组也允许系统管理员更加有效地管理用户权限,因为管理员可以将权限分配给用户组而不是逐一分配给单个用户. 尽管 ...
- 2. ES6基础-let和const命令
目录 1. let命令 1.1 用法 1. 2 不存在变量提升 1.3 区域绑定 1.4 不允许重复声明 2. const命令 2.1 用法 2.2 与let类似的特性 2.3 const本质 2.4 ...
- jQuery判断当前页面是APP内打开还是浏览器打开
一.代码如下: function check_useragent() { var browser = { versions: function() { var u = navigator.userAg ...
- python关于try except的使用方法
一.常见错误总结 AttributeError 试图访问一个对象没有的树形,比如foo.x,但是foo没有属性x IOError 输入/输出异常;基本上是无法打开文件 ImportError 无法引入 ...
- Java文件流下载并提示文件不存在
做文件下载功能的时候,一般使用流的形式下载文件, 如果源文件不存在,下载页面可能就会没有提示,或者一片空白 用户操作之后可能一头雾水,那如何友好提示呢? 想到的有两种 1.可以尝试下载一个名称为:文件 ...
- Oracle 11g新特性direct path read引发的系统停运故障诊断处理
黎俊杰 | 2016-07-28 14:37 声明:部分表名为了脱敏而用XX代替 1.故障现象 (1)一个业务系统输入用户名与密码后无法进入首页,表现为一直在运行等待,运行缓慢 (2)整个系统无法正常 ...