-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update/rename certs.sh; add default cert rotation script
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
- Loading branch information
Showing
3 changed files
with
130 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| #!/usr/bin/env bash | ||
| set -e | ||
| umask 027 | ||
|
|
||
| # Example K3s self-signed CA rotation script. | ||
| # | ||
| # This script will generate new self-signed root CA certificates, and cross-sign them with the | ||
| # current self-signed root CA certificates. It will then generate new leaf CA certificates | ||
| # signed by the new self-signed/cross-signed root CAs. The resulting cluster CA bundle will | ||
| # allow existing certificates to be trusted up until the original root CAs expire. | ||
| # | ||
| CONFIG=" | ||
| [v3_ca] | ||
| subjectKeyIdentifier = hash | ||
| authorityKeyIdentifier = keyid:always,issuer:always | ||
| basicConstraints=CA:true" | ||
| TIMESTAMP=$(date +%s) | ||
| PRODUCT="${PRODUCT:-k3s}" | ||
| DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}" | ||
| TEMP_DIR=$(mktemp -d) | ||
|
|
||
| if type -t openssl-3 &>/dev/null; then | ||
| OPENSSL=openssl-3 | ||
| else | ||
| OPENSSL=openssl | ||
| fi | ||
|
|
||
| echo "Using $(which ${OPENSSL}): $(${OPENSSL} version)" | ||
|
|
||
| if ! ${OPENSSL} ecparam -help &>/dev/null; then | ||
| echo "openssl not found or missing Elliptic Curve (ecparam) support." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! ${OPENSSL} req -help 2>&1 | grep -q CAkey; then | ||
| echo "openssl req missing -CAkey support; please use OpenSSL 3.0.0 or newer" | ||
| exit 1 | ||
| fi | ||
|
|
||
| mkdir -p ${TEMP_DIR}/server/tls/etcd | ||
|
|
||
| for TYPE in client server request-header etcd/peer etcd/server; do | ||
| if [ ! -f ${DATA_DIR}/server/tls/${TYPE}-ca.crt ]; then | ||
| echo "Current ${TYPE} CA cert does not exist; cannot continue" | ||
| exit 1 | ||
| fi | ||
| if [ "$(grep -cF BEGIN ${DATA_DIR}/server/tls/${TYPE}-ca.crt)" != "1" ]; then | ||
| echo "Current ${TYPE} CA cert is not-self-signed; cannot continue" | ||
| exit 1 | ||
| fi | ||
|
|
||
| CERT_NAME="${PRODUCT}-$(echo ${TYPE} | tr / -)-root-ca" | ||
| echo "Generating ${CERT_NAME} cross-signed root certificate authority key and certificates" | ||
| ${OPENSSL} ecparam -name prime256v1 -genkey -out ${TEMP_DIR}/server/tls/${TYPE}-root-ca.key | ||
| ${OPENSSL} req -x509 -new -nodes -sha256 -days 7300 \ | ||
| -subj "/CN=${CERT_NAME}@${TIMESTAMP}" \ | ||
| -key ${TEMP_DIR}/server/tls/${TYPE}-root-ca.key \ | ||
| -out ${TEMP_DIR}/server/tls/${TYPE}-root-ca-ssigned.pem \ | ||
| -config <(echo "${CONFIG}") -extensions v3_ca | ||
| ${OPENSSL} req -x509 -new -nodes -sha256 -days 7300 \ | ||
| -subj "/CN=${CERT_NAME}@${TIMESTAMP}" \ | ||
| -key ${TEMP_DIR}/server/tls/${TYPE}-root-ca.key \ | ||
| -out ${TEMP_DIR}/server/tls/${TYPE}-root-ca-xsigned.pem \ | ||
| -CAkey ${DATA_DIR}/server/tls/${TYPE}-ca.key \ | ||
| -CA ${DATA_DIR}/server/tls/${TYPE}-ca.crt \ | ||
| -config <(echo "${CONFIG}") -extensions v3_ca | ||
|
|
||
| CERT_NAME="${PRODUCT}-$(echo ${TYPE} | tr / -)-ca" | ||
| echo "Generating ${CERT_NAME} leaf certificate authority EC key and certificate" | ||
| ${OPENSSL} ecparam -name prime256v1 -genkey -out ${TEMP_DIR}/server/tls/${TYPE}-ca.key | ||
| ${OPENSSL} req -x509 -new -nodes -sha256 -days 7300 \ | ||
| -subj "/CN=${CERT_NAME}@${TIMESTAMP}" \ | ||
| -key ${TEMP_DIR}/server/tls/${TYPE}-ca.key \ | ||
| -out ${TEMP_DIR}/server/tls/${TYPE}-ca.pem \ | ||
| -CAkey ${TEMP_DIR}/server/tls/${TYPE}-root-ca.key \ | ||
| -CA ${TEMP_DIR}/server/tls/${TYPE}-root-ca-ssigned.pem \ | ||
| -config <(echo "${CONFIG}") \ | ||
| -extensions v3_ca | ||
|
|
||
| cat ${TEMP_DIR}/server/tls/${TYPE}-ca.pem \ | ||
| ${TEMP_DIR}/server/tls/${TYPE}-root-ca-ssigned.pem \ | ||
| ${TEMP_DIR}/server/tls/${TYPE}-root-ca-xsigned.pem \ | ||
| ${DATA_DIR}/server/tls/${TYPE}-ca.crt > ${TEMP_DIR}/server/tls/${TYPE}-ca.crt | ||
| done | ||
|
|
||
| ${OPENSSL} genrsa -traditional -out ${TEMP_DIR}/server/tls/service.key 2048 | ||
| cat ${DATA_DIR}/server/tls/service.key >> ${TEMP_DIR}/server/tls/service.key | ||
|
|
||
| export SERVER_CA_HASH=$(${OPENSSL} x509 -noout -fingerprint -sha256 -in ${TEMP_DIR}/server/tls/server-root-ca-ssigned.pem | awk -F= '{ gsub(/:/, "", $2); print tolower($2) }') | ||
| SERVER_TOKEN=$(awk -F:: '{print "K10" ENVIRON["SERVER_CA_HASH"] FS $2}' ${DATA_DIR}/server/token) | ||
| AGENT_TOKEN=$(awk -F:: '{print "K10" ENVIRON["SERVER_CA_HASH"] FS $2}' ${DATA_DIR}/server/agent-token) | ||
|
|
||
| echo | ||
| echo "Cross-signed CA certs and keys now available in ${TEMP_DIR}/server/tls" | ||
| echo "Updated server token: ${SERVER_TOKEN}" | ||
| echo "Updated agent token: ${AGENT_TOKEN}" | ||
| echo | ||
| echo "You may now run:" | ||
| echo " k3s certificate rotate-ca --path=${TEMP_DIR}/server --force" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters