66 lines
2.1 KiB
Bash
66 lines
2.1 KiB
Bash
#!/bin/bash
|
||
|
||
# 定义证书存储目录
|
||
CERT_DIR="/etc/docker/certs"
|
||
mkdir -p "$CERT_DIR"
|
||
cd "$CERT_DIR"
|
||
|
||
# 提示用户输入主机名/IP 地址列表
|
||
read -p "请输入 Docker 守护进程的主机名或 IP 地址，用逗号分隔（例如：10.0.10.19,localhost）: " DOCKER_HOSTS
|
||
if [ -z "$DOCKER_HOSTS" ]; then
|
||
echo "主机名/IP 地址不能为空！"
|
||
exit 1
|
||
fi
|
||
|
||
# 生成 CA 私钥和证书
|
||
openssl genrsa -out ca-key.pem 4096
|
||
openssl req -x509 -new -nodes -key ca-key.pem -days 36500 -out ca.pem -subj "/C=CN/ST=Chongqing/L=Chongqing/O=LiteyukiStudio/CN=MyCA"
|
||
|
||
# 生成服务器密钥和证书签名请求（CSR）
|
||
openssl genrsa -out server-key.pem 4096
|
||
openssl req -new -key server-key.pem -out server.csr -subj "/C=CN/ST=Chongqing/L=Chongqing/O=LiteyukiStudio/CN=$DOCKER_HOSTS"
|
||
|
||
# 创建一个配置文件来指定 SANs
|
||
cat > san.cnf <<EOF
|
||
[req]
|
||
distinguished_name = req_distinguished_name
|
||
req_extensions = req_ext
|
||
|
||
[req_distinguished_name]
|
||
|
||
[req_ext]
|
||
subjectAltName = @alt_names
|
||
|
||
[alt_names]
|
||
EOF
|
||
|
||
# 将输入的主机名/IP 地址分割为数组
|
||
IFS=',' read -r -a HOSTS <<< "$DOCKER_HOSTS"
|
||
|
||
# 为每个主机添加 DNS 和 IP 条目到 SANs
|
||
for i in "${!HOSTS[@]}"; do
|
||
echo "DNS.$((i+1)) = ${HOSTS[$i]}" >> san.cnf
|
||
echo "IP.$((i+1)) = ${HOSTS[$i]}" >> san.cnf
|
||
done
|
||
|
||
# 生成服务器证书
|
||
openssl x509 -req -days 36500 -in server.csr -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem -extfile san.cnf -extensions req_ext
|
||
|
||
# 删除不必要的 CSR 文件和配置文件
|
||
rm -f server.csr san.cnf
|
||
|
||
# 生成客户端密钥和证书签名请求（CSR）
|
||
openssl genrsa -out client-key.pem 4096
|
||
openssl req -new -key client-key.pem -out client.csr -subj "/C=CN/ST=Chongqing/L=Chongqing/O=LiteyukiStudio/CN=client"
|
||
|
||
# 生成客户端证书
|
||
openssl x509 -req -days 36500 -in client.csr -CA ca.pem -CAkey ca-key.pem -set_serial 02 -out client-cert.pem
|
||
|
||
# 删除不必要的客户端 CSR 文件
|
||
rm -f client.csr
|
||
|
||
# 设置权限
|
||
chmod 0400 ca-key.pem server-key.pem client-key.pem
|
||
chmod 0444 ca.pem server-cert.pem client-cert.pem
|
||
|
||
echo "证书生成完成，保存在 $CERT_DIR 目录下。" |