Minio添加TLS认证以及通过Golang和Python通过https访问

1、下载对应版本的certgen的二进制文件

2、使用certgen生成证书

将x.x.x.x换成自己的实际IP

$ certgen -host "x.x.x.x,0.0.0.0"

Created a new certificate 'public.crt', 'private.key' valid for the following names 📜
 - "x.x.x.x"
 - "0.0.0.0"

3、将公钥和私钥拷贝到~/.minio/certs目录下：

说明：~/.minio/certs目录在用户文件夹下，如 /root/.minio/certs目录

$ pwd
/root

$ cp private.key .minio/certs/
$ cp public.crt .minio/certs/

4、重启minio（这里根据实际情况，我这里使用systemctl来管理minio）

$ systemctl restart minio

5、客户端使用API调用minio时候，需要指定public.crt的位置。

Python示例：

import sys

import urllib3
from minio import Minio


service = "ip:port"
access_key = "用户名"
secret_key = "密码"
secure = True
httpClient = urllib3.PoolManager(cert_reqs='CERT_REQUIRED', ca_certs='./certs/public.crt')

client = Minio(
    endpoint=service,
    access_key=access_key,
    secret_key=secret_key,
    secure=True,
    http_client=httpClient,
)

print(client.bucket_exists("test"))

Golang示例：

package main

import (
    "context"
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "github.com/minio/minio-go/v7"
    "github.com/minio/minio-go/v7/pkg/credentials"
    "io/ioutil"
    "log"
    "net/http"
)

func main() {
    ctx := context.Background()
    endpoint := "IP:Port"
    accessKeyID := "用户名"
    secretAccessKey := "密码"
    useSSL := true

    // 初始化证书池
    certPool := x509.NewCertPool()
    // 读取public.crt的内容
    caCrt, err := ioutil.ReadFile("./certs/public.crt")
    if err != nil {
        log.Fatalln("public.crt read error:", err)
    }
    // 解析证书，并添加到证书池
    certPool.AppendCertsFromPEM(caCrt)

    // 解析客户端的证书，这里直接忽略掉
    //clientCrt, err := tls.LoadX509KeyPair("ca/client.crt", "ca/key.unencrypted.pem")
    //if err != nil {
    //    log.Fatalln("client.crt LoadX509KeyPair error:", err)
    //}

    transport := &http.Transport{
        TLSClientConfig: &tls.Config{
            RootCAs:            certPool,                     // 设置双向认证的证书
            // Certificates:       []tls.Certificate{clientCrt}, // 客户端证书，需要传递给服务端
            InsecureSkipVerify: true, // 是否验证服务端证书，True为不验证
        },
    }
    
    // 初始化minio客户端
    minioClient, err := minio.New(endpoint, &minio.Options{
        Creds:     credentials.NewStaticV4(accessKeyID, secretAccessKey, ""),
        Secure:    useSSL,
        Transport: transport,
    })
    if err != nil {
        log.Fatalln(err)
    }

    found, err := minioClient.BucketExists(ctx, "test")
    if err != nil {
        log.Fatalln(err)
    }

    fmt.Println(found)
}