13.3.2.2. 手动添加 SSL/TLS 证书

流程

• 创建证书颁发机构并签署证书。如需更多信息，请参阅创建证书颁发机构并签署证书。

  openssl.cnf

  [req]
  req_extensions = v3_req
  distinguished_name = req_distinguished_name
  [req_distinguished_name]
  [ v3_req ]
  basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = example-registry-quay-quay-enterprise.apps.docs.quayteam.org 

  1

  
  DNS.2 = example-registry-quay-builder-quay-enterprise.apps.docs.quayteam.org 

  2

  1

  必须包含 Red Hat Quay registry URL 的 alt_name。

  2

  BUILDMAN_HOSTNAME的 alt_name

  示例命令

  $ openssl genrsa -out rootCA.key 2048
  $ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
  $ openssl genrsa -out ssl.key 2048
  $ openssl req -new -key ssl.key -out ssl.csr
  $ openssl x509 -req -in ssl.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ssl.cert -days 356 -extensions v3_req -extfile openssl.cnf