ssl

[!TIP|label:see also]

reference:

openssl

  • check version

    $ openssl version
OpenSSL 3.1.2 1 Aug 2023 (Library: OpenSSL 3.1.2 1 Aug 2023)

$ openssl version -a
OpenSSL 3.1.2 1 Aug 2023 (Library: OpenSSL 3.1.2 1 Aug 2023)
built on: Tue Aug  1 13:36:55 2023 UTC
platform: darwin64-x86_64-cc
options:  bn(64,64)
compiler: clang -fPIC -arch x86_64 -O3 -Wall -DL_ENDIAN -DOPENSSL_PIC -D_REENTRANT -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/usr/local/etc/openssl@3"
ENGINESDIR: "/usr/local/Cellar/openssl@3/3.1.2/lib/engines-3"
MODULESDIR: "/usr/local/Cellar/openssl@3/3.1.2/lib/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0x7ffaf3bfffebffff:0x40000000029c67af

$ openssl version -d
OPENSSLDIR: "/usr/local/etc/openssl@3"

ssl cert

create cert for server

ca (root cert)

$ openssl genrsa -aes256 -out ca.key 2048 $ openssl req -new -x509 -sha256 -days 365 -key ca.key -out ca.crt -subj "/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com"

$ openssl genrsa -aes256 -out ca.key 2048 Generating RSA private key, 2048 bit long modulus ....................................................................+++ ...................................................+++ unable to write 'random state' e is 65537 (0x10001) Enter pass phrase for ca.key:artifactory Verifying - Enter pass phrase for ca.key:artifactory $ openssl req -new -x509 -sha256 -days 365 -key ca.key -out ca.crt -subj "/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com" Enter pass phrase for ca.key:artifactory

cert for server (csr)

$ openssl genrsa -out server.key 2048 $ openssl req -new -sha256 -key server.key -out server.csr -subj "/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com"

$ openssl genrsa -out server.key 2048 Generating RSA private key, 2048 bit long modulus ......................................................................+++ ............................................................................................................................................................................................................................+++ unable to write 'random state' e is 65537 (0x10001) $ openssl req -new -sha256 -key server.key -out server.csr -subj "/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com"

sign the server cert with CA

$ echo subjectAltName = DNS:sample.artifactory.com,IP:130.147.219.19 >> extfile.cnf $ echo extendedKeyUsage = serverAuth >> extfile.cnf

$ openssl x509 -req -days 365 -sha256 -CAcreateserial -CA ca.crt -CAkey ca.key -in server.csr -out server.crt -extfile extfile.cnf

$ echo subjectAltName = DNS:sample.artifactory.com,IP:130.147.219.19 >> extfile.cnf $ echo extendedKeyUsage = serverAuth >> extfile.cnf

$ openssl x509 -req -days 365 -sha256 -CAcreateserial -CA ca.crt -CAkey ca.key -in server.csr -out server.crt -extfile extfile.cnf Signature ok subject=/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com Getting CA Private Key Enter pass phrase for ca.key:artifactory unable to write 'random state'

$ ls extfile.cnf ca.key server.csr www.srl ca.crt server.crt server.key

generate cert for client (cert) and singed by CA

$ openssl genrsa -out client.key $ openssl req -new -key client.key -out client.csr -subj "/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com"

$ echo extendedKeyUsage = clientAuth >> extfile.cnf $ openssl x509 -req -days 365 -sha256 -CAcreateserial -CA ca.crt -CAkey ca.key -in client.csr -out client.cert -extfile extfile.cnf

$ openssl genrsa -out client.key 2048 Generating RSA private key, 2048 bit long modulus ................................................+++ .......................+++ unable to write 'random state' e is 65537 (0x10001)

$ openssl req -new -subj "/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com" -key client.key -out client.csr

$ echo extendedKeyUsage = clientAuth >> extfile.cnf $ cat extfile.cnf subjectAltName = DNS:sample.artifactory.com,IP:130.147.219.19 gxtendedKeyUsage = serverAuth extendedKeyUsage = clientAuth

$ openssl x509 -req -days 365 -sha256 -CAcreateserial -CA ca.crt -CAkey ca.key -in client.csr -out client.cert -extfile extfile.cnf Signature ok subject=/C=CN/ST=Sichuan/L=Chengdu/O=mycompany/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com Getting CA Private Key Enter pass phrase for ca.key:artifactor unable to write 'random state'

Update the file perm

$ sudo chmod -v 0444 ca.crt server.crt client.cert
$ sudo chmod -v 0400 ca.key client.key server.key

verify

crt

$ openssl x509 -noout -text -in server.crt

$ openssl x509 -noout -text -in ca.crt Certificate: Data: Version: 3 (0x2) Serial Number: 15145698426239402702 (0xd23054792b3142ce) Signature Algorithm: sha256WithRSAEncryption Issuer: C=CN, ST=Sichuan, L=Chengdu, O=mycompany, OU=CDI, CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com Validity Not Before: Jan 2 11:35:31 2018 GMT Not After : Jan 2 11:35:31 2019 GMT Subject: C=CN, ST=Sichuan, L=Chengdu, O=mycompany, OU=CDI, CN=sample.artifactory.com/emailAddress=marslo.jiao@mycompany.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:d0:3f:b6:c5:e5:52:8d:c7:26:3f:e7:0a:7a:5f: c1:71:2a:9e:34:07:7e:10:4a:3d:c4:4f:f7:df:58: 93:0d:fa:00:e8:21:75:6d:d1:45:7d:bd:27:f2:c5: 08:13:8f:4f:be:91:9f:28:19:7e:c3:a7:42:1b:fc: b4:96:21:8a:33:59:79:27:a3:cf:13:3e:cd:92:0d: 7e:b9:9f:0d:01:bf:27:5f:e4:7a:7d:db:69:a3:78: 96:a8:c3:a9:2d:31:28:97:ba:6c:20:17:ab:eb:85: ce:2c:25:e8:3e:a0:8b:c0:0b:b2:a9:e1:ac:9f:e1: 57:35:bb:64:6a:99:2e:8f:27:f1:04:40:a7:16:32: 31:4e:ad:18:5e:9e:0b:dd:42:17:af:8a:58:c6:1a: e9:00:52:97:7b:7a:24:cc:b1:81:8d:b9:20:60:e4: 96:d5:77:82:07:4e:df:9c:3a:26:95:d5:ed:aa:a1: 24:94:64:0e:93:9a:9e:9b:d4:78:6b:46:50:69:05: 19:6a:ff:7b:1d:1b:0f:ce:6b:30:33:c7:99:9d:6a: 30:0c:fc:f8:74:00:df:65:6f:fa:1b:24:0a:73:77: 4d:94:45:27:9b:93:a6:81:37:57:57:6f:e9:ae:e4: 5e:a8:b8:be:31:0f:73:4b:9e:1b:ed:78:5c:48:ec: 0b:a5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Alternative Name: IP Address:130.147.219.19 X509v3 Subject Key Identifier: 23:32:BC:61:9E:51:8E:94:22:30:5B:AE:68:8A:7E:8E:53:D2:45:7C X509v3 Authority Key Identifier: keyid:23:32:BC:61:9E:51:8E:94:22:30:5B:AE:68:8A:7E:8E:53:D2:45:7C

        X509v3 Basic Constraints:
            CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
     69:a3:fe:35:63:a5:e8:4e:e6:3e:4f:9d:f6:82:3d:73:f2:a7:
     22:c1:46:e5:09:5e:61:81:b7:70:3c:62:ba:43:7d:bd:ac:67:
     d0:41:ea:a7:b8:41:47:04:bc:41:9a:46:35:31:3f:62:10:7a:
     58:73:45:3a:59:3b:41:6b:2b:1e:62:42:b7:7e:c1:6b:92:25:
     2a:df:3f:69:b5:26:8e:c7:5d:c6:24:a0:65:21:b7:63:74:60:
     7f:3b:0e:9a:80:a4:4f:a2:79:20:19:92:64:60:b7:53:5c:09:
     6e:46:6e:7a:d7:ee:ef:f4:2e:27:7a:1a:0e:da:5b:8b:7a:bf:
     40:56:9f:16:63:6b:89:ab:48:65:07:45:e0:a0:21:7c:0f:6d:
     9c:2a:ab:ca:d0:02:06:8a:39:7a:ea:65:b9:04:13:0f:6b:cd:
     ea:e5:9f:59:c5:d2:06:b2:e4:c3:cb:ab:59:69:aa:11:e6:08:
     49:12:cc:d4:29:21:2b:59:c1:dc:bb:e6:a9:7d:96:68:a4:7b:
     61:76:8a:21:a9:69:a5:83:d5:8b:f6:08:4e:c0:34:64:6b:65:
     96:ac:ed:cd:c1:0b:54:7d:a9:57:07:77:0c:6a:43:9e:4f:c0:
     6c:12:88:e8:cf:34:08:67:af:1c:2f:bb:49:54:1b:17:95:89:
     b3:2d:c9:5f

csr

$ openssl req -noout -text -in server.csr

certificate in Nginx

$ grep ssl_certificate /etc/nginx/sites-enabled/artifactoryv2.conf
ssl_certificate       /etc/nginx/certs/sample.artifactory.com/server.crt;
ssl_certificate_key   /etc/nginx/certs/sample.artifactory.com/server.key;

get remote server certs

[!TIP] references:

keytool

$ keytool -printcert -rfc -sslserver <domain.com>:<port> > cacert.crt

  • check

    # convert to pem
$ openssl x509 -inform PEM -in cacert.crt -out outcert.pem -text

# or
$ openssl x509 -noout -text -in cacert.crt

openssl

[!NOTE|label:see more]

$ echo -n |
  openssl s_client -showcerts \
                   -servername <domain.com> \
                   -connect <domain.com>:<port> 2>/dev/null |
  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' \
  > cacert.crt

# or
$ echo -n | openssl s_client \
                 -showcerts \
                 -connect <domain.com>:<port> 2>/dev/null |
         sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p; /-END CERTIFICATE-/q' |
         openssl x509 -text -noout |
         grep Not

  • check

    $ keytool -printcert -v -file cacert.crt

bundle certs

[!NOTE|label:references:]

generic usage

$ awk -v cmd='openssl x509 -noout -serial' \
             '/BEGIN/{close(cmd)}; {print | cmd}' \
       < /path/to/bundle.crt

# or
$ awk -v cmd="openssl x509 -text -noout" \
             '/-----BEGIN/ { c = $0; next } c { c = c "\n" $0 } /-----END/ { print c|cmd; close(cmd); c = 0 }' \
      < /path/to/bundle.crt

# or
$ awk < /path/to/bundle.crt -v cmd="openssl x509 -issuer -subject -dates -noout" \
        '/^-----BEGIN/,/^-----END/ {print|cmd} /^-----END/ {close(cmd)}'

# or
$ cat /path/to/bundle.crt |
  awk '{
    if ($0 == "-----BEGIN CERTIFICATE-----") cert=""
    else if ($0 == "-----END CERTIFICATE-----") print cert
    else cert=cert$0
  }' |
  while read CERT; do echo "$CERT" | base64 -d | openssl x509 -inform DER -text -noout; done

get serial number

$ awk -v cmd='openssl x509 -noout -serial' \
             '/BEGIN/{close(cmd)}; {print | cmd}' \
       < /path/to/bundle.crt |
       awk -F= '{print $2}' |
       sed 's/../&:/g;s/:$//'
# or
$ openssl storeutl -noout -text -certs </path/to/file.crt> | sed -n '/Serial Number:/{n;p;}'

# i.e.:
$ awk -v cmd='openssl x509 -noout -serial' \
             '/BEGIN/{close(cmd)}; {print | cmd}' < google.crt |
      awk -F= '{print $2}' |
      sed 's/../&:/g;s/:$//'
71:8D:F8:A4:D1:48:8A:78:09:CC:ED:27:10:7D:81:84
7F:F0:05:A0:7C:4C:DE:D1:00:AD:9D:66:A5:10:7B:98
77:BD:0D:6C:DB:36:F9:1A:EA:21:0F:C4:F0:58:D3:0D
## or
$ openssl storeutl -noout -text -certs google.crt | sed -n '/Serial Number:/{n;p;}'
            71:8d:f8:a4:d1:48:8a:78:09:cc:ed:27:10:7d:81:84
            7f:f0:05:a0:7c:4c:de:d1:00:ad:9d:66:a5:10:7b:98
            77:bd:0d:6c:db:36:f9:1a:ea:21:0f:c4:f0:58:d3:0d

get issuer and subject

$ awk -v cmd='openssl x509 -noout -subject -issuer' \
             '/BEGIN/{close(cmd)}; {print | cmd}' \
      < /path/to/bundle.crt
# or
$ openssl crl2pkcs7 -nocrl -certfile /path/to/bundle.crt | openssl pkcs7 -print_certs -noout

# i.e.:
$ openssl s_client -showcerts -connect google.com:443 </dev/null 2>/dev/null |
          sed -n -e '/BEGIN CERTIFICATE/,/END CERTIFICATE/ p' |
          awk -v cmd='openssl x509 -noout -subject -issuer -dates; echo ""' \
                     '/BEGIN/{close(cmd)}; {print | cmd}'

# or
$ openssl s_client -showcerts -connect google.com:443 </dev/null 2>/dev/null |
          sed -n -e '/BEGIN CERTIFICATE/,/END CERTIFICATE/ p' > google.crt
$:wa awk -v cmd='openssl x509 -noout -subject -issuer -dates; echo ""' \
             '/BEGIN/{close(cmd)}; {print | cmd}' \
      < google.crt
subject=CN = *.google.com
issuer=C = US, O = Google Trust Services, CN = WR2
notBefore=Jul 30 12:32:53 2024 GMT
notAfter=Oct 22 12:32:52 2024 GMT

subject=C = US, O = Google Trust Services, CN = WR2
issuer=C = US, O = Google Trust Services LLC, CN = GTS Root R1
notBefore=Dec 13 09:00:00 2023 GMT
notAfter=Feb 20 14:00:00 2029 GMT

subject=C = US, O = Google Trust Services LLC, CN = GTS Root R1
issuer=C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
notBefore=Jun 19 00:00:42 2020 GMT
notAfter=Jan 28 00:00:42 2028 GMT

get dates

# local
$ openssl storeutl -noout -text -certs /path/to/bundle.crt | grep 'Not'
## or
$ awk -v cmd='openssl x509 -noout -dates' \
             '/BEGIN/{close(cmd)}; {print | cmd}' \
      < /path/to/bundle.crt
## remote
$ echo -n | openssl s_client -showcerts -connect <domain.com>:<port> 2>/dev/null | grep 'Not'

# i.e.:
## local
$ awk -v cmd='openssl x509 -noout -dates' '/BEGIN/{close(cmd)}; {print | cmd}' < google.crt
notBefore=Jul 30 12:32:53 2024 GMT
notAfter=Oct 22 12:32:52 2024 GMT
notBefore=Dec 13 09:00:00 2023 GMT
notAfter=Feb 20 14:00:00 2029 GMT
notBefore=Jun 19 00:00:42 2020 GMT
notAfter=Jan 28 00:00:42 2028 GMT
## remote
$ echo -n | openssl s_client -showcerts -connect google.com:443 2>/dev/null | command grep 'Not'
   v:NotBefore: Jul 30 12:32:53 2024 GMT; NotAfter: Oct 22 12:32:52 2024 GMT
   v:NotBefore: Dec 13 09:00:00 2023 GMT; NotAfter: Feb 20 14:00:00 2029 GMT
   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT

cheatsheet

generate private key and csr

$ openssl genrsa -out privateKey.key 2048
$ openssl req -new -key privateKey.key -out CSR.csr

# or
$ openssl req -out CSR.csr \
              -new -newkey rsa:2048 \
              -nodes \
              -keyout privateKey.key \
              -subj "/C=US/ST=Florida/L=Saint Petersburg/O=Your Company, Inc./OU=IT/CN=yourdomain.com"

need to input the following info to generate CSR :

  • Country Name: 2-digit country code where our organization is legally located.

  • State/Province: Write the full name of the state where the organization is legally located.

  • City: Write the full name of the city where our organization is legally located.

  • Organization Name: Write the legal name of our organization.

  • Organization Unit: Name of the department

  • Common Name: Fully Qualified Domain Name

generate a self-signed certificate

$ openssl req -x509 \
              -sha256 \
              -nodes \
              -days 365 \
              -newkey rsa:2048 \
              -keyout privateKey.key \
              -out certificate.crt

check ssl certificate

  • check private key info

    $ openssl rsa -noout -text -in privateKey.key

  • check csr info

    $ openssl req -text -noout -in CSR.csr

  • view ssl certificate info

    $ openssl x509 -text -noout -in certificate.crt

get issuer

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -issuer

get subject

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -subject

get expiration date

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -dates

# or
$ openssl x509 -enddate -noout -in /path/to/name.pem

# i.e.:
$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -dates
notBefore=Sep  8 00:00:00 2021 GMT
notAfter=Aug 18 23:59:59 2022 GMT

get serial number

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -serial
serial=038**************************9CE

$ openssl x509 -noout -serial -in server.crt
serial=038**************************9CE

show multiple information

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -dates -subject -issuer

show fingerprint

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -fingerprint

extract from the ssl certificate (decoded)

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509 -noout -text

show the ssl certificate

$ echo -n |
       openssl s_client \
               [-servername <domain.com>] \
               -connect <domain.com>:<port> 2>/dev/null |
       openssl x509
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

verifying the keys match

$ openssl pkey -pubout -in privateKey.key | openssl sha256
# or
$ openssl req -pubkey -in CSR.csr -noout | openssl sha256
# or
$ openssl x509 -pubkey -in certificate.crt -noout | openssl sha256

check remote certificate chain

[!NOTE|label:see also:]

$ echo -n |
       openssl s_client -connect <domain.com>:<port> 2>/dev/null |
       awk '/Certificate chain/,/---/'
# or
$ echo -n |
       openssl s_client -connect <domain.com>:<port> 2>/dev/null |
       sed -n '/Certificate chain/,/---/p'

# i.e.:
$ echo -n |
       openssl s_client -connect google.com:443 2>/dev/null |
       awk '/Certificate chain/,/---/'
Certificate chain
 0 s:CN = *.google.com
   i:C = US, O = Google Trust Services, CN = WR2
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jul 30 12:32:53 2024 GMT; NotAfter: Oct 22 12:32:52 2024 GMT
 1 s:C = US, O = Google Trust Services, CN = WR2
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Dec 13 09:00:00 2023 GMT; NotAfter: Feb 20 14:00:00 2029 GMT
 2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT
---

services

Kubernetes

[!NOTE|label:references:]

from Kubernetes secrets

  • key

    $ kubectl -n kube-system get secrets <SECRET_NAME> -o yaml -o jsonpath="{.data.tls\.key}" | base64 -d > server.key

  • crt

    $ kubectl -n kube-system get secrets sample-tls -o yaml -o jsonpath="{.data.tls\.crt}" | base64 -d > server.crt

to Kubernetes secrets

  • key

    $ cat server.key | base64 -w0

  • crt

    $ cat server.crt | base64 -w0

  • advanced usage

    $ kubectl -n kube-system get secrets <SECRET_NAME> -o yaml |
    sed -r -e "s/(\s*tls.crt:)(.*)$/\1 $(cat server.crt | base64 -w0)/g" \
           -e "s/(\s*tls.key:)(.*)$/\1 $(cat server.key | base64 -w0)/g" |
  kubectl apply -f -

jenkins self-signed SSL

[!NOTE|label:references:]

  • create a truststore

    $ keytool -import -v -trustcacerts -alias jenkins.domain.com \
          -file certificate.pem \
          -keystore cacerts.jks \
          -storepass changeit

  • add into JVM options

    -Djavax.net.ssl.trustStore=/var/jenkins_home/cacerts.jks
-Djavax.net.ssl.trustStorePassword=changeit

  • use the truststore when connection from the agent

    $ java -Djavax.net.ssl.trustStore=/var/jenkins_home/cacerts.jks \
       -Djavax.net.ssl.trustStorePassword=changeit \
       -jar agent.jar \
       -jnlpURL https://jenkins.domain.com/cjoc/jnlpSharedSlaves/sharedagent/slave-agent.jnlp \
       -secret xxx

Artifactory HTTPS

$ sudo openssl genrsa -des3 -out artifactory.key 2048 $ sudo openssl req -new -key artifactory.key -out artifactorycsr $ sudo cp artifactory.key{,.org} $ sudo openssl rsa -in artifactory.key.org -out artifactory.key $ sudo openssl x509 -req -days 365 -in artifactorycsr -signkey artifactory.key -out artifactory.crt

$ sudo openssl genrsa -des3 -out artifactory.key 2048 Generating RSA private key, 2048 bit long modulus .........................+++ ........................................................................+++ e is 65537 (0x10001) Enter pass phrase for artifactory.key: artifactory Verifying - Enter pass phrase for artifactory.key: artifactory

$ sudo openssl req -new -key artifactory.key -out artifactorycsr Enter pass phrase for artifactory.key: artifactory You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.

Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Sichuan Locality Name (eg, city) []:Chengdu Organization Name (eg, company) [Internet Widgits Pty Ltd]:mycompany Ltd Organizational Unit Name (eg, section) []:. Common Name (e.g. server FQDN or YOUR name) []:192.168.1.102 Email Address []:.

Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:. An optional company name []:.

$ sudo cp artifactory.key{,.org}

$ sudo openssl rsa -in artifactory.key.org -out artifactory.key Enter pass phrase for artifactory.key.org: artifactory writing RSA key

$ sudo openssl x509 -req -days 365 -in artifactorycsr -signkey artifactory.key -out artifactory.crt Signature ok subject=/C=CN/ST=Sichuan/L=Chengdu/O=mycompany Ltd/CN=192.168.1.102 Getting Private key

$ sudo openssl genrsa -des3 -out artifactory.key 2048 Generating RSA private key, 2048 bit long modulus ........................+++ .......................................+++ e is 65537 (0x10001) Enter pass phrase for artifactory.key: artifactory Verifying - Enter pass phrase for artifactory.key: artifactory

$ sudo openssl req -new -key artifactory.key -out artifactorycsr Enter pass phrase for artifactory.key: artifactory You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.

Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Sichuan Locality Name (eg, city) []:Chengdu Organization Name (eg, company) [Internet Widgits Pty Ltd]:mycompany Ltd Organizational Unit Name (eg, section) []:mycompany CDI Common Name (e.g. server FQDN or YOUR name) []:docker-1.artifactory Email Address []:.

Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:. An optional company name []:.

$ sudo cp artifactory.key{,.org} $ sudo openssl rsa -in artifactory.key.org -out artifactory.key Enter pass phrase for artifactory.key.org: artifactory writing RSA key

$ sudo openssl x509 -req -days 365 -in artifactorycsr -signkey artifactory.key -out artifactory.crt Signature ok subject=/C=CN/ST=Sichuan/L=Chengdu/O=mycompany Ltd/OU=mycompany CDI/CN=docker-1.artifactory Getting Private key

PreviousmediaNextkeystore

Last updated