ETCD 部署并启用证书认证

证书生成

证书生成的方式非常多，同类的文档也很容易找到，这里推荐此篇文章：https://coreos.com/os/docs/latest/generate-self-signed-certificates.html，但是由于etcd的特殊性，server端配置的证书，也会被用于去进行客户端认证，因此需要在 server 的 usages 里面加上：client auth选项，否则会出现此种问题：certificate specifies an incompatible key usage

下面是完整的ca-config.json内容：

{
   
    "signing": {
   
        "default": {
   
            "expiry": "43800h"
        },
        "profiles": {
   
            "server": {
   
                "expiry": "43800h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth" // 此处需要特别注意，由于etcd实现方式不同，server的证书也会用于进行客户端认证，此选项必须的
                ]
            },
            "client": {
   
                "expiry": "43800h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
   
                "expiry": "43800h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }