Docker tls SAN证书生成

一、首先要有openssl，网上下载一个自己安装就可以了。
二、执行如下脚本生成需要的证书

#!/bin/bash
#相关配置信息
# docker主机IP
SERVER=$2
# 密码
PASSWORD="123456"
# 国家
COUNTRY="CN"
# 省份
STATE="浙江省"
# 城市
CITY="杭州市"
# 机构名称
ORGANIZATION="弗兰科"
# 机构单位
ORGANIZATIONAL_UNIT="弗兰科"
# 邮箱
EMAIL="zhangjin@flksec.com"
#文件当前目录
curdir=`pwd`
function GenerateCA() {
    ###开始生成文件###
    echo "开始生成文件"
    echo "GenerateCA ca-key.pem ca.pem"
    #生成ca私钥(使用aes256加密)
    openssl genrsa -aes256 -passout pass:$PASSWORD  -out ca-key.pem 2048
    #生成ca证书，填写配置信息
    openssl req -new -x509 -passin "pass:$PASSWORD" -days 3650 -key ca-key.pem -sha256 -out ca.pem -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=*/emailAddress=$EMAIL"
    cp -rf ca.pem ca-key.pem ${curdir}/ca.pem
    tar -cvf ${curdir}/ca.tar ca.pem ca-key.pem
    echo "生成文件完成"
    ###生成结束###
}
function GenerateServer() {
    ###开始生成文件###
    echo "开始生成文件"
    echo "${SERVER}"
    echo "GenerateServer server-key.pem server-cert.pem"
    #生成server证书私钥文件
    openssl genrsa -out server-key.pem 2048
    #生成server证书请求文件
    openssl req -subj "/CN=$SERVER" -new -key server-key.pem -out server.csr
    echo "subjectAltName=IP:${SERVER},IP:0.0.0.0" >> extfile.cnf
    echo "extendedKeyUsage=serverAuth" >> extfile.cnf
    #使用CA证书及CA密钥以及上面的server证书请求文件进行签发，生成server自签证书
    openssl x509 -req -days 3650 -in server.csr -CA ca.pem -CAkey ca-key.pem -passin "pass:$PASSWORD" -CAcreateserial  -out server-cert.pem -extfile extfile.cnf
    #打包服务端证书、密钥、CA
    tar -cvf ${curdir}/${SERVER}_server.tar ca.pem server-cert.pem server-key.pem
    echo "生成文件完成"
    ###生成结束###
}
function GenerateClient() {
    ###开始生成文件###
    echo "开始生成文件"
    echo "GenerateClient key.pem cert.pem"
    #生成client证书RSA私钥文件
    openssl genrsa -out key.pem 2048
    #生成client证书请求文件
    openssl req -subj '/CN=client' -new -key key.pem -out client.csr
    sh -c 'echo "extendedKeyUsage=clientAuth" > extfile.cnf'
    #生成client自签证书（根据上面的client私钥文件、client证书请求文件生成）
    openssl x509 -req -days 3650 -in client.csr -CA ca.pem -CAkey ca-key.pem  -passin "pass:$PASSWORD" -CAcreateserial -out cert.pem  -extfile extfile.cnf
    tar -cvf ${curdir}/client.tar ca.pem cert.pem key.pem
    echo "生成文件完成"
    ###生成结束###
}
function Clean() {
    #删除无用文件
    rm -rf client.csr server.csr extfile.cnf  ca.srl
}
function Docker_DaemonReload_Restart() {
    #开始修改docker启动配置文件
    cp -rf /lib/systemd/system/docker.service /lib/systemd/system/docker.service_bak
    num=`sed -n '/^ExecStart/=' /lib/systemd/system/docker.service`
    num_d="${num}d"
    sed -i "${num_d}" /lib/systemd/system/docker.service
    num_i="${num}i"
    sed -i "${num_i} ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/server-cert.pem --tlskey=/etc/docker/server-key.pem -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock" /lib/systemd/system/docker.service
    # 重新加载文件
    systemctl daemon-reload
    systemctl restart docker.service
    systemctl status docker.service
}
var1=$1
function run() {
    #切换到生产密钥的目录
    cd /etc/docker
    if [ "client" == "$var1" ];then
        GenerateClient
    elif [ "server" == "$var1" ] && [ -n "${SERVER}" ];then
        GenerateServer
    elif [ "otherserver" == "$var1" ] && [ -n "${SERVER}" ];then
        mkdir -p /etc/docker/otherserver/
        cp ca.pem ca-key.pem /etc/docker/otherserver/
        cd /etc/docker/otherserver/
        GenerateServer
    elif [ "ca" == "$var1" ];then
        GenerateCA
    elif [ "restart" == "$var1" ];then
        Docker_DaemonReload_Restart
    else
        echo "docker-tls.sh [option]..."
        echo "              ca | 生成CA证书文件"
        echo "              client | 生成客户端证书、私钥"
        echo "              server IP | 生成服务端证书、私钥"
        echo "              otherserver IP | 生成服务端证书、私钥"
        echo "              restart | 修改并重新加载配置，重启docker服务"
    fi
    Clean
}
run