Terraform自签名证书Openssl验证失败

我正在尝试使用Terraform创建一个自签名证书，以便在测试/开发环境中内部使用。Terraform自签名证书Openssl验证失败

我首先创建一个CA私钥，自签名证书。

然后，我为要为其启用HTTPS的内部域名创建证书签名请求和私钥。

然后我签署证书。这里是我使用的整个Terraform清单：

resource "tls_private_key" "ca" { 
    algorithm = "ECDSA" 
    ecdsa_curve = "P384" 
} 

resource "tls_self_signed_cert" "ca" { 
    key_algorithm = "${tls_private_key.ca.algorithm}" 
    private_key_pem = "${tls_private_key.ca.private_key_pem}" 

    subject { 
    common_name = "Example CA" 
    organization = "Example, Ltd" 
    country = "GB" 
    } 

    validity_period_hours = 43800 
    is_ca_certificate = true 

    allowed_uses = [ 
    "key_encipherment", 
    "digital_signature", 
    "server_auth", 
    "client_auth", 
    ] 
} 

resource "tls_private_key" "registry" { 
    algorithm = "ECDSA" 
    ecdsa_curve = "P384" 
} 

resource "tls_cert_request" "registry" { 
    key_algorithm = "${tls_private_key.registry.algorithm}" 
    private_key_pem = "${tls_private_key.registry.private_key_pem}" 

    subject { 
    common_name = "registry.test.example.com" 
    organization = "Example, Ltd" 
    country = "GB" 
    } 

    dns_names = ["registry.test.example.com"] 
} 

resource "tls_locally_signed_cert" "registry" { 
    cert_request_pem = "${tls_cert_request.registry.cert_request_pem}" 

    ca_key_algorithm = "${tls_private_key.ca.algorithm}" 
    ca_private_key_pem = "${tls_private_key.ca.private_key_pem}" 
    ca_cert_pem = "${tls_self_signed_cert.ca.cert_pem}" 

    validity_period_hours = 43800 

    allowed_uses = [ 
    "key_encipherment", 
    "digital_signature", 
    "server_auth", 
    "client_auth", 
    ] 
}

我运行Terraform清单。然后我从状态文件中提取生成的证书并将它们保存到文件中。

我试图验证与OpenSSL的最终证书，但得到一个错误：

$ openssl verify -CAfile ca-cert.pem registry.pem 
registry.pem: C = GB, ST = , L = , postalCode = , O = "Example, Ltd", OU = , CN = registry.example.com 
error 20 at 0 depth lookup:unable to get local issuer certificate

任何想法的问题是什么？我花了很多时间试图弄清楚这一点。

基本上我想用它在我的测试/开发环境中为私有Docker注册表启用HTTPS。

来源

2016-07-25 Richard Knop

您需要添加cert_signing到tls_private_key.ca.allowed_uses：

resource "tls_self_signed_cert" "ca" { 
    key_algorithm = "${tls_private_key.ca.algorithm}" 
    private_key_pem = "${tls_private_key.ca.private_key_pem}" 

    subject { 
    common_name = "Example CA" 
    organization = "Example, Ltd" 
    country = "GB" 
    } 

    validity_period_hours = 43800 
    is_ca_certificate = true 

    allowed_uses = [ 
    "key_encipherment", 
    "digital_signature", 
    "server_auth", 
    "client_auth", 
    "cert_signing" 
    ] 
}

参见：https://www.terraform.io/docs/providers/tls/r/self_signed_cert.html#cert_signing

来源

2016-07-25 11:08:54 Keymon

Terraform自签名证书Openssl验证失败

回答

相关问题