6.3.7.2. 生成自签名证书（可选）

流程

1. 根据情况调整证书信息。

   $ host_fqdn=$( hostname --long )
   $ cert_c="<Country Name>"   # Country Name (C, 2 letter code)
   $ cert_s="<State>"          # Certificate State (S)
   $ cert_l="<Locality>"       # Certificate Locality (L)
   $ cert_o="<Organization>"   # Certificate Organization (O)
   $ cert_ou="<Org Unit>"      # Certificate Organizational Unit (OU)
   $ cert_cn="${host_fqdn}"    # Certificate Common Name (CN)
   
   $ openssl req \
       -newkey rsa:4096 \
       -nodes \
       -sha256 \
       -keyout /opt/registry/certs/domain.key \
       -x509 \
       -days 365 \
       -out /opt/registry/certs/domain.crt \
       -addext "subjectAltName = DNS:${host_fqdn}" \
       -subj "/C=${cert_c}/ST=${cert_s}/L=${cert_l}/O=${cert_o}/OU=${cert_ou}/CN=${cert_cn}"

   注意

   当替换 <Country Name> 时，请确保它只包含两个字母。例如，US。

2. 使用新证书更新 registry 节点的 ca-trust。

   $ sudo cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
   $ sudo update-ca-trust extract