docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update https.cnf - Clarify extfile directions 

Directions around `extfile.cnf` for client certificates was somewhat confusing.  Edited the document to clarify that a separate file was to be created, not append a line to the file that had just been created for the server.
This commit is contained in:
Jonathan Springer 2018-12-06 09:12:55 -05:00 committed by GitHub
parent 3154a93123
commit 9f22f38fa7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
engine/security/https.md
View File

@ -113,24 +113,24 @@ request:
$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr $ openssl req -subj '/CN=client' -new -key key.pem -out client.csr
To make the key suitable for client authentication, create an extensions To make the key suitable for client authentication, create a new extensions
config file: config file:
$ echo extendedKeyUsage = clientAuth >> extfile.cnf $ echo extendedKeyUsage = clientAuth > extfile-client.cnf
Now, generate the signed certificate: Now, generate the signed certificate:
$ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \ $ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \
-CAcreateserial -out cert.pem -extfile extfile.cnf -CAcreateserial -out cert.pem -extfile extfile-client.cnf
Signature ok Signature ok
subject=/CN=client subject=/CN=client
Getting CA Private Key Getting CA Private Key
Enter pass phrase for ca-key.pem: Enter pass phrase for ca-key.pem:
After generating `cert.pem` and `server-cert.pem` you can safely remove the After generating `cert.pem` and `server-cert.pem` you can safely remove the
two certificate signing requests: two certificate signing requests and extensions config files:
$ rm -v client.csr server.csr $ rm -v client.csr server.csr extfile.cnf extfile-client.cnf
With a default `umask` of 022, your secret keys are *world-readable* and With a default `umask` of 022, your secret keys are *world-readable* and
writable for you and your group. writable for you and your group.