harbor https自签名证书生成及配置（helm方式安装harbor）

﹏ヽ暗。殇╰゛Y 2024-03-25 22:48 64阅读 0赞

### 生成https自签名证书 ###

# Generate a Certificate Authority Certificate
    openssl genrsa -out ca.key 4096
    
    openssl req -x509 -new -nodes -sha512 -days 3650 \
     -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=core.harbor.domain" \
     -key ca.key \
     -out ca.crt
     
     
    # Generate a Server Certificate
    openssl genrsa -out core.harbor.domain.key 4096
    
    openssl req -sha512 -new \
        -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=core.harbor.domain" \
        -key core.harbor.domain.key \
        -out core.harbor.domain.csr
        
    cat > v3.ext <<-EOF
    authorityKeyIdentifier=keyid,issuer
    basicConstraints=CA:FALSE
    keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
    extendedKeyUsage = serverAuth
    subjectAltName = @alt_names
    
    [alt_names]
    DNS.1=core.harbor.domain
    DNS.2=core.harbor
    DNS.3=hostname
    EOF   
    
    openssl x509 -req -sha512 -days 3650 \
        -extfile v3.ext \
        -CA ca.crt -CAkey ca.key -CAcreateserial \
        -in core.harbor.domain.csr \
        -out core.harbor.domain.crt

### 配置证书 ###

k delete secret myharbor-ingress -n harbor
    
    k create secret -n harbor generic myharbor-ingress --from-file=ca.crt=ca.crt --from-file=tls.crt=core.harbor.domain.crt --from-file=tls.key=core.harbor.domain.key

### 访问测试 ###

https://core.harbor.domain

### 参考连接 ###

[https://goharbor.io/docs/2.7.0/install-config/configure-https/][https_goharbor.io_docs_2.7.0_install-config_configure-https]  
[https://www.orchome.com/16725][https_www.orchome.com_16725]

[https_goharbor.io_docs_2.7.0_install-config_configure-https]: https://goharbor.io/docs/2.7.0/install-config/configure-https/
[https_www.orchome.com_16725]: https://www.orchome.com/16725