主页
产品
Red Hat Advanced Cluster Management for Kubernetes
2.4
监管
1.2. 替换管理入口证书

1.2. 替换管理入口证书

如果您不想使用 OpenShift 默认入口证书，您可以通过更新 Red Hat Advanced Cluster Management for Kubernetes 路由来替换管理入口证书。

1.2.1. 替换管理入口证书的先决条件
复制链接

将您的 management-ingress 证书和私钥准备妥当。如果需要，您可以使用 OpenSSL 生成 TLS 证书。将证书上的通用名称参数 CN 设置为 manangement-ingress。如果您要生成证书，请加入以下设置：

在您的证书主题备用名称（SAN）列表中包括 Red Hat Advanced Cluster Management for Kubernetes 的路由名称作为域名。
运行以下命令来接收路由名称：
```
oc get route -n open-cluster-management
```
```
oc get route -n open-cluster-management
```
Copy to Clipboard Toggle word wrap
您可能会收到以下响应：
```
multicloud-console.apps.grchub2.dev08.red-chesterfield.com
```
```
multicloud-console.apps.grchub2.dev08.red-chesterfield.com
```
Copy to Clipboard Toggle word wrap

1.2.1.1. 用于生成证书的示例配置文件
复制链接

以下示例配置文件和 OpenSSL 命令提供了有关如何使用 OpenSSL 生成 TLS 证书的示例。查看以下 csr.cnf 配置文件，该文件定义了用来使用 OpenSSL 生成证书的配置设置。

[ req ]               # Main settings
default_bits = 2048       # Default key size in bits.
prompt = no               # Disables prompting for certificate values so the configuration file values are used.
default_md = sha256       # Specifies the digest algorithm.
req_extensions = req_ext  # Specifies the configuration file section that includes any extensions.
distinguished_name = dn   # Specifies the section that includes the distinguished name information.

[ dn ]               # Distinguished name settings
C = US                    # Country
ST = North Carolina             # State or province
L = Raleigh                # Locality
O = Red Hat Open Shift     # Organization
OU = Red Hat Advanced Container Management        # Organizational unit
CN = management-ingress  # Common name.

[ req_ext ]          # Extensions
subjectAltName = @alt_names # Subject alternative names

[ alt_names ]        # Subject alternative names
DNS.1 = multicloud-console.apps.grchub2.dev08.red-chesterfield.com

[ v3_ext ]          # x509v3 extensions
authorityKeyIdentifier=keyid,issuer:always  # Specifies the public key that corresponds to the private key that is used to sign a certificate.
basicConstraints=CA:FALSE                   # Indicates whether the certificate is a CA certificate during the certificate chain verification process.
#keyUsage=keyEncipherment,dataEncipherment   # Defines the purpose of the key that is contained in the certificate.
extendedKeyUsage=serverAuth                 # Defines the purposes for which the public key can be used.
subjectAltName=@alt_names                   # Identifies the subject alternative names for the identify that is bound to the public key by the CA.

[ req ]               # Main settings
default_bits = 2048       # Default key size in bits.
prompt = no               # Disables prompting for certificate values so the configuration file values are used.
default_md = sha256       # Specifies the digest algorithm.
req_extensions = req_ext  # Specifies the configuration file section that includes any extensions.
distinguished_name = dn   # Specifies the section that includes the distinguished name information.

[ dn ]               # Distinguished name settings
C = US                    # Country
ST = North Carolina             # State or province
L = Raleigh                # Locality
O = Red Hat Open Shift     # Organization
OU = Red Hat Advanced Container Management        # Organizational unit
CN = management-ingress  # Common name.

[ req_ext ]          # Extensions
subjectAltName = @alt_names # Subject alternative names

[ alt_names ]        # Subject alternative names
DNS.1 = multicloud-console.apps.grchub2.dev08.red-chesterfield.com

[ v3_ext ]          # x509v3 extensions
authorityKeyIdentifier=keyid,issuer:always  # Specifies the public key that corresponds to the private key that is used to sign a certificate.
basicConstraints=CA:FALSE                   # Indicates whether the certificate is a CA certificate during the certificate chain verification process.
#keyUsage=keyEncipherment,dataEncipherment   # Defines the purpose of the key that is contained in the certificate.
extendedKeyUsage=serverAuth                 # Defines the purposes for which the public key can be used.
subjectAltName=@alt_names                   # Identifies the subject alternative names for the identify that is bound to the public key by the CA.

Copy to Clipboard

Toggle word wrap

备注：请必使用您的管理入口的正确主机名更新标记的 SAN，即 DNS.1。

1.2.1.2. 用于生成证书的 OpenSSL 命令
复制链接

以下 OpenSSL 命令与上述配置文件一同用来生成所需的 TLS 证书。

生成您的证书颁发机构 (CA) RSA 私钥：
```
openssl genrsa -out ca.key 4096
```
```
openssl genrsa -out ca.key 4096
```
Copy to Clipboard Toggle word wrap

使用您的 CA 密钥生成自签名 CA 证书：

openssl req -x509 -new -nodes -key ca.key -subj "/C=US/ST=North Carolina/L=Raleigh/O=Red Hat OpenShift" -days 400 -out ca.crt

openssl req -x509 -new -nodes -key ca.key -subj "/C=US/ST=North Carolina/L=Raleigh/O=Red Hat OpenShift" -days 400 -out ca.crt

Copy to Clipboard

Toggle word wrap

为您的证书生成 RSA 私钥：
```
openssl genrsa -out ingress.key 4096
```
```
openssl genrsa -out ingress.key 4096
```
Copy to Clipboard Toggle word wrap

使用私钥生成证书签名请求 (CSR)：

openssl req -new -key ingress.key -out ingress.csr -config csr.cnf

openssl req -new -key ingress.key -out ingress.csr -config csr.cnf

Copy to Clipboard

Toggle word wrap

使用您的 CA 证书和密钥及 CSR 生成签名证书：

openssl x509 -req -in ingress.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out ingress.crt -sha256 -days 300 -extensions v3_ext -extfile csr.cnf

openssl x509 -req -in ingress.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out ingress.crt -sha256 -days 300 -extensions v3_ext -extfile csr.cnf

Copy to Clipboard

Toggle word wrap

检查证书内容：

openssl x509  -noout -text -in ./ingress.crt

openssl x509  -noout -text -in ./ingress.crt

Copy to Clipboard

Toggle word wrap

返回顶部

1.2. 替换管理入口证书

1.2.1. 替换管理入口证书的先决条件
复制链接

1.2.1.1. 用于生成证书的示例配置文件
复制链接

1.2.1.2. 用于生成证书的 OpenSSL 命令
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

1.2. 替换管理入口证书

1.2.1. 替换管理入口证书的先决条件复制链接链接已复制到粘贴板!

1.2.1.1. 用于生成证书的示例配置文件复制链接链接已复制到粘贴板!

1.2.1.2. 用于生成证书的 OpenSSL 命令复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

1.2.1. 替换管理入口证书的先决条件
复制链接

1.2.1.1. 用于生成证书的示例配置文件
复制链接

1.2.1.2. 用于生成证书的 OpenSSL 命令
复制链接