Docker SSL证书配置(ubuntu22.04）

1，可以直接复制，把161 改成你自己的IP即可

Docker SSL证书配置(ubuntu22.04）
# 
Host = 161.161.161.161

1、生成CA证书私钥

openssl genrsa -out ca.key 4096

 
2、生成CA根证书

#China
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=10.11.173.193" \
 -key ca.key \
 -out ca.crt
 
#USA
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=US/ST=Arkansas/L=Benton/O=example/OU=Personal/CN=161.161.161.161" \
 -key ca.key \
 -out ca.crt

 3、生成服务器证书私钥
#USA
 openssl genrsa -out 161.161.161.161.key 4096
#China 
 openssl genrsa -out 10.11.173.193.key 4096
 
 4、生成证书签名请求

 #China
 openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=10.11.173.193" \
    -key 10.11.173.193.key \
    -out 10.11.173.193.csr
	
#USA
 openssl req -sha512 -new \
    -subj "/C=US/ST=Arkansas/L=Benton/O=example/OU=Personal/CN=161.161.161.161" \
    -key 161.161.161.161.key \
    -out 161.161.161.161.csr

5、生成v3扩展文件

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=161.161.161.161
DNS.2=161.161.161.161
DNS.3=161.161.161.161
DNS.4=161.161.161.161
EOF


6、通过v3扩展文件来生成服务端证书文件

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in 161.161.161.161.csr \
    -out 161.161.161.161.crt

	
7、生成cert证书，供docker 使用。
openssl x509 -inform PEM -in 161.161.161.161.crt -out 161.161.161.161.cert



8、生成用户名密码
htpasswd -Bbn admin 123456 > /data/docker.registry/etc/registry/auth/passwd


9、修改配置文件