证书生成
证书生成的方式非常多,同类的文档也很容易找到,这里推荐此篇文章:https://coreos.com/os/docs/latest/generate-self-signed-certificates.html,但是由于etcd的特殊性,server端配置的证书,也会被用于去进行客户端认证,因此需要在 server 的 usages 里面加上:client auth
选项,否则会出现此种问题:certificate specifies an incompatible key usage
下面是完整的ca-config.json内容:
{
"signing": {
"default": {
"expiry": "43800h"
},
"profiles": {
"server": {
"expiry": "43800h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth" // 此处需要特别注意,由于etcd实现方式不同,server的证书也会用于进行客户端认证,此选项必须的
]
},
"client": {
"expiry": "43800h",
"usages": [
"signing",
"key encipherment",
"client auth"
]
},
"peer": {
"expiry": "43800h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}