Harbor 配置自签证书

环境

Harbor version : harbor.v2.5.3
Docker version : 20.10.8

官方文档 : Configure HTTPS Access to Harbor
照抄文档 : 基本照抄该链接，只为记录

在合适的目录下创建 key 文件：

> openssl genrsa -out ca.key 4096

生成证书：

> openssl req -x509 -new -nodes -sha512 -days 3650  -subj "/CN=my.harbor.com"  -key ca.key  -out ca.crt

创建私钥

> openssl genrsa -out server.key 4096

生成证书签名请求

>openssl req  -new -sha512  -subj "/CN=my.harbor.com"  -key server.key  -out server.csr

创建一个 v3.ext 文件

> cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth 
subjectAltName = @alt_names
[alt_names]
DNS.1=my.harbor.com
EOF

生成harbor仓库主机的证书

> openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt

配置 harbor.yml

> vim harbor.yml
hostname: my.harbor.com
https:
  port: 443
  certificate: /PATH/server.crt
  private_key: /PATH/server.key

执行 prepare && restart harbor

> ./prepare 
> docker-compose down -v
> docker-compose up -d

配置 /etc/hosts

> echo 127.0.0.1 my.harbor.com >> /etc/hosts

cp 证书 到 docker 固定目录中

> mkdir -p /etc/docker/certs.d/my.harbor.com
> cp server.crt  /etc/docker/certs.d/my.harbor.com/server.crt

docker login

> docker login my.harbor.com