1.3.7.2. 自己署名証明書の生成 (オプション)

手順

1. 必要に応じて証明書情報を調整します。

   $ host_fqdn=$( hostname --long )
   $ cert_c="<Country Name>"   # Country Name (C, 2 letter code)
   $ cert_s="<State>"          # Certificate State (S)
   $ cert_l="<Locality>"       # Certificate Locality (L)
   $ cert_o="<Organization>"   # Certificate Organization (O)
   $ cert_ou="<Org Unit>"      # Certificate Organizational Unit (OU)
   $ cert_cn="${host_fqdn}"    # Certificate Common Name (CN)
   
   $ openssl req \
       -newkey rsa:4096 \
       -nodes \
       -sha256 \
       -keyout /opt/registry/certs/domain.key \
       -x509 \
       -days 365 \
       -out /opt/registry/certs/domain.crt \
       -addext "subjectAltName = DNS:${host_fqdn}" \
       -subj "/C=${cert_c}/ST=${cert_s}/L=${cert_l}/O=${cert_o}/OU=${cert_ou}/CN=${cert_cn}"

   注記

   <Country Name> を置き換える場合には、2 文字のみを使用します。例: US

2. レジストリーノードの ca-trust を新規証明書で更新します。

   $ sudo cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
   $ sudo update-ca-trust extract