2.6.3.2. 验证您的证书

将 pod 名称存储在 RATINGSPOD 变量中。

RATINGSPOD=`oc get pods -l app=ratings -o jsonpath='{.items[0].metadata.name}'`

$ RATINGSPOD=`oc get pods -l app=ratings -o jsonpath='{.items[0].metadata.name}'`

Copy to Clipboard

Toggle word wrap

运行以下命令以检索代理上挂载的证书。

oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/root-cert.pem > /tmp/pod-root-cert.pem

$ oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/root-cert.pem > /tmp/pod-root-cert.pem

Copy to Clipboard

Toggle word wrap

文件 /tmp/pod-root-cert.pem 包含向 pod 传播的根证书。

oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/cert-chain.pem > /tmp/pod-cert-chain.pem

$ oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/cert-chain.pem > /tmp/pod-cert-chain.pem

Copy to Clipboard

Toggle word wrap

文件 /tmp/pod-cert-chain.pem 包含向 pod 传播的工作负载证书和 CA 证书。

验证 root 证书与 Operator 指定证书相同。将 <path> 替换为证书的路径。

openssl x509 -in <path>/root-cert.pem -text -noout > /tmp/root-cert.crt.txt

$ openssl x509 -in <path>/root-cert.pem -text -noout > /tmp/root-cert.crt.txt

Copy to Clipboard

Toggle word wrap

openssl x509 -in /tmp/pod-root-cert.pem -text -noout > /tmp/pod-root-cert.crt.txt

$ openssl x509 -in /tmp/pod-root-cert.pem -text -noout > /tmp/pod-root-cert.crt.txt

Copy to Clipboard

Toggle word wrap

diff /tmp/root-cert.crt.txt /tmp/pod-root-cert.crt.txt

$ diff /tmp/root-cert.crt.txt /tmp/pod-root-cert.crt.txt

Copy to Clipboard

Toggle word wrap

预期输出为空。

验证 CA 证书与 Operator 指定证书相同。将 <path> 替换为证书的路径。

sed '0,/^-----END CERTIFICATE-----/d' /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-ca.pem

$ sed '0,/^-----END CERTIFICATE-----/d' /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-ca.pem

Copy to Clipboard

Toggle word wrap

openssl x509 -in <path>/ca-cert.pem -text -noout > /tmp/ca-cert.crt.txt

$ openssl x509 -in <path>/ca-cert.pem -text -noout > /tmp/ca-cert.crt.txt

Copy to Clipboard

Toggle word wrap

openssl x509 -in /tmp/pod-cert-chain-ca.pem -text -noout > /tmp/pod-cert-chain-ca.crt.txt

$ openssl x509 -in /tmp/pod-cert-chain-ca.pem -text -noout > /tmp/pod-cert-chain-ca.crt.txt

Copy to Clipboard

Toggle word wrap

diff /tmp/ca-cert.crt.txt /tmp/pod-cert-chain-ca.crt.txt

$ diff /tmp/ca-cert.crt.txt /tmp/pod-cert-chain-ca.crt.txt

Copy to Clipboard

Toggle word wrap

预期输出为空。

从 root 证书到工作负载证书验证证书链。将 <path> 替换为证书的路径。

head -n 21 /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-workload.pem

$ head -n 21 /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-workload.pem

Copy to Clipboard

Toggle word wrap

openssl verify -CAfile <(cat <path>/ca-cert.pem <path>/root-cert.pem) /tmp/pod-cert-chain-workload.pem

$ openssl verify -CAfile <(cat <path>/ca-cert.pem <path>/root-cert.pem) /tmp/pod-cert-chain-workload.pem

Copy to Clipboard

Toggle word wrap

输出示例

/tmp/pod-cert-chain-workload.pem: OK

/tmp/pod-cert-chain-workload.pem: OK

Copy to Clipboard

Toggle word wrap