查看ISTIO-CITADEL的证书信息

进行任何一个POD，查看/etc/certs目录，即可知道证书信息。

kubectl exec -it reviews-v1-fd6c96c74-wptxg -c istio-proxy bash
ls /etc/certs

三个证书文件：

cert-chain.pem: 当前ENVOY需要提交给通信对方的ENVOY证书。有公钥。

key.pem: cert-chain.pem对应的私钥。

root-cert.pem:用于验证当前节点证书是否有效。每个Citadel服务一个证书。

使用openssl查看cert-chain.pem证书信息：

cat cert-chain.pem |openssl x509 -text -noout

输出如下：

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:6f:8f:ed:af:9f:88:dc:92:7e:76:44:ab:74:14:1b
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: O=k8s.cluster.local
        Validity
            Not Before: Jul 18 03:57:47 2019 GMT
            Not After : Oct 16 03:57:47 2019 GMT
        Subject: O=
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b7:9e:60:2a:4b:b6:61:d5:b6:37:db:ac:a8:94:
                    71:d6:11:c3:c2:ec:ed:90:08:a0:78:30:b0:50:fb:
                    2f:b4:8c:b0:5c:0e:91:99:2c:0e:87:59:4b:7e:ca:
                    f8:a9:f2:2d:54:8c:01:7a:cf:29:97:e6:6a:91:99:
                    30:21:8a:55:b0:47:a2:19:04:32:d6:94:ce:c3:21:
                    45:fc:a1:c4:ca:fd:ed:6d:93:0e:fe:bf:be:f7:68:
                    51:e2:35:2b:5d:17:b3:2f:ff:7c:a1:cf:90:6e:1e:
                    04:d2:d8:5e:df:b9:3a:da:a6:15:a0:1e:c2:43:5a:
                    39:09:b8:fe:9b:9a:38:b0:7c:7b:3d:a9:0b:ed:3f:
                    aa:49:cf:1b:f2:b4:bd:45:74:dd:6a:6a:13:07:c1:
                    0d:a2:ae:11:90:c9:b4:27:f6:b5:2f:b3:fd:b8:78:
                    7e:5b:2a:65:c8:5b:f0:38:8b:70:e4:62:ac:4e:24:
                    b8:42:89:33:d9:ea:1d:51:10:21:07:ef:b7:e6:78:
                    18:fc:39:6c:e4:4d:01:5d:0b:54:39:c6:7c:d1:07:
                    c8:3f:0b:21:87:f8:ba:e2:6a:a0:03:5e:e2:0b:d0:
                    f3:5a:a2:57:c5:0a:d8:a1:f5:26:94:50:70:bc:3b:
                    87:72:f5:d0:5c:f2:29:6a:66:1e:e9:70:b5:a9:60:
                    89:0d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Alternative Name:
                URI:spiffe://cluster.local/ns/default/sa/default
    Signature Algorithm: sha256WithRSAEncryption
         53:ed:05:b3:ae:df:ce:e1:9c:48:fc:ae:ad:03:3d:25:34:1b:
         b0:fb:8d:f0:77:05:63:f7:ab:d4:f9:f8:67:fd:ff:23:f6:58:
         92:b4:cc:ec:a4:7b:a1:8f:d8:0a:09:2a:7b:7f:52:11:64:f4:
         65:d7:91:0a:4c:a4:d1:2c:f2:49:54:59:2e:01:9b:6c:4f:40:
         01:c9:a1:bb:fa:6d:e9:b0:83:5a:f3:3f:e0:2f:2b:92:0e:9d:
         71:4a:cc:ac:d3:5e:2d:71:66:6b:c8:a3:f6:0d:7b:14:64:dc:
         7a:c4:36:4a:85:f6:a4:7e:bf:9b:59:b9:fa:1b:c0:de:e1:32:
         c9:9c:c2:f0:25:c8:a1:03:ae:81:66:68:a1:9c:e0:57:52:ed:
         d3:6e:3b:a0:a2:71:a5:e3:d9:23:fc:59:a3:5a:18:56:2d:2e:
         d5:cc:ac:d0:94:73:cb:e1:91:bb:94:49:c1:e8:2c:ee:57:2d:
         35:a1:e7:18:39:d3:c2:b8:47:af:c8:b1:fb:94:5b:5c:49:e4:
         40:95:ba:a3:0f:b0:05:18:14:54:ef:92:ce:d8:84:6f:5f:04:
         6e:25:b2:99:55:94:be:41:fc:22:49:5c:c1:9b:f9:19:9a:6a:
         88:99:ab:23:73:54:93:62:a0:a9:f1:de:55:b8:b4:c9:92:86:
         a0:e5:90:44

如何要看具体的过期时间或是证书有效范围，可以使用两个子命令(这里的技巧是-A n这样的shell写法，输出当前行之后的n行内容):