harbor配置自建证书-工具盒子

harbor配置自建证书

腾讯云ssl 证书购买 : 连接

1.生成ca的证书

# mkdir /baimei/softwares/harbor/certs/custom/{ca,server,client}
# cd /baimei/softwares/harbor/certs/custom

(2)生成ca的私钥

 openssl genrsa -out ca/ca.key 4096

(3)生成ca的自签名证书

openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbo.baimei.com" \
 -key ca/ca.key \
 -out ca/ca.crt

harbo.baimei.com 改成自己的域名就可以，一定要统一

2.生成harbor主机证书

(1)生成harbor主机的私钥

openssl genrsa -out server/harbor.baimei.com.key 4096

(2)生成harbor主机的证书申请

openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.baimei.com" \
    -key server/harbor.baimei.com.key \
    -out server/harbor.baimei.com.csr

(3)生成x509 v3扩展文件

cat > server/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=baimei.com
DNS.2=baimei
DNS.3=harbor.baimei.com
EOF

(4)使用"v3.ext"给harbor主机签发证书

openssl x509 -req -sha512 -days 3650 \
    -extfile server/v3.ext \
    -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
    -in server/harbor.baimei.com.csr \
    -out server/harbor.baimei.com.crt

(5)将crt文件转换为cert客户端证书文件

openssl x509 -inform PEM -in server/harbor.baimei.com.crt -out server/harbor.baimei.com.cert

温馨提示:
	docker程序认为"*.crt"文件是CA证书文件，"*.cert"客户端证书文件，于是上面第五步需要转换一下，其实使用cp一下也是可以的，内容并没有变化。

3.配置harbor服务器使用证书

(1)修改harbor的配置文件

 vim /baimei/softwares/harbor/harbor.yml 	
...
hostname: harbor.baimei.com
...
https:
  ...
  certificate: /baimei/softwares/harbor/certs/custom/server/harbor.baimei.com.crt
  private_key: /baimei/softwares/harbor/certs/custom/server/harbor.baimei.com.key
...
harbor_admin_password: 1

(2)安装harbor服务

cd /baimei/softwares/harbor  && ./install.sh

温馨提示:
如果已经安装harbor服务的话，就不需要重复执行"./install.sh"脚本，仅需执行"./prepare"并搭配"docker-compose down"和"docker-compose up -d"即可。

4.客户端配置证书，推荐配置，便于后期维护

[root@centos201 custom]# ll
total 0
drwxr-xr-x 2 root root  48 Jun 13 11:31 ca
drwxr-xr-x 2 root root   6 Jun 13 11:24 client
drwxr-xr-x 2 root root 149 Jun 13 11:31 server

 cp ca/ca.crt server/harbor.baimei.com.key server/harbor.baimei.com.cert client/

ll -R

内容如下：

.:
total 0
drwxr-xr-x 2 root root  48 Jun 13 11:31 ca
drwxr-xr-x 2 root root  85 Jun 13 11:43 client
drwxr-xr-x 2 root root 149 Jun 13 11:31 server

./ca:
total 12
-rw-r--r-- 1 root root 2033 Jun 13 11:25 ca.crt
-rw-r--r-- 1 root root 3243 Jun 13 11:25 ca.key
-rw-r--r-- 1 root root   17 Jun 13 11:31 ca.srl

./client:
total 12
-rw-r--r-- 1 root root 2033 Jun 13 11:43 ca.crt
-rw-r--r-- 1 root root 2122 Jun 13 11:43 harbor.baimei.com.cert
-rw-r--r-- 1 root root 3243 Jun 13 11:43 harbor.baimei.com.key

./server:
total 20
-rw-r--r-- 1 root root 2122 Jun 13 11:31 harbor.baimei.com.cert
-rw-r--r-- 1 root root 2122 Jun 13 11:31 harbor.baimei.com.crt
-rw-r--r-- 1 root root 1716 Jun 13 11:29 harbor.baimei.com.csr
-rw-r--r-- 1 root root 3243 Jun 13 11:29 harbor.baimei.com.key
-rw-r--r-- 1 root root  275 Jun 13 11:30 v3.ext

5.将客户端证书拷贝到需要登录harbor服务器的节点上

1)创建自定义域名的证书存放路径(注意，下面的"harbor.baimei.com"改成你自己的自签域名)

 mkdir -pv /etc/docker/certs.d/harbor.baimei.com

2)拷贝证书文件

 scp client/* 10.0.0.202:/etc/docker/certs.d/harbor.baimei.com/

3)客户端登录验证

cat /etc/docker/daemon.json 

{
  "registry-mirrors": ["https://tuv7rqqq.mirror.aliyuncs.com"]
}

systemctl restart docker

 docker login -u admin -p 1 harbor.baimei.com