1、下载对应版本的certgen的二进制文件
2、使用certgen生成证书
将x.x.x.x换成自己的实际IP
$ certgen -host "x.x.x.x,0.0.0.0"
Created a new certificate 'public.crt', 'private.key' valid for the following names 📜
- "x.x.x.x"
- "0.0.0.0"
3、将公钥和私钥拷贝到~/.minio/certs目录下:
说明:~/.minio/certs目录在用户文件夹下,如 /root/.minio/certs目录
$ pwd
/root
$ cp private.key .minio/certs/
$ cp public.crt .minio/certs/
4、重启minio(这里根据实际情况,我这里使用systemctl来管理minio)
$ systemctl restart minio
5、客户端使用API调用minio时候,需要指定public.crt
的位置。
Python示例:
import sys
import urllib3
from minio import Minio
service = "ip:port"
access_key = "用户名"
secret_key = "密码"
secure = True
httpClient = urllib3.PoolManager(cert_reqs='CERT_REQUIRED', ca_certs='./certs/public.crt')
client = Minio(
endpoint=service,
access_key=access_key,
secret_key=secret_key,
secure=True,
http_client=httpClient,
)
print(client.bucket_exists("test"))
Golang示例:
package main
import (
"context"
"crypto/tls"
"crypto/x509"
"fmt"
"github.com/minio/minio-go/v7"
"github.com/minio/minio-go/v7/pkg/credentials"
"io/ioutil"
"log"
"net/http"
)
func main() {
ctx := context.Background()
endpoint := "IP:Port"
accessKeyID := "用户名"
secretAccessKey := "密码"
useSSL := true
// 初始化证书池
certPool := x509.NewCertPool()
// 读取public.crt的内容
caCrt, err := ioutil.ReadFile("./certs/public.crt")
if err != nil {
log.Fatalln("public.crt read error:", err)
}
// 解析证书,并添加到证书池
certPool.AppendCertsFromPEM(caCrt)
// 解析客户端的证书,这里直接忽略掉
//clientCrt, err := tls.LoadX509KeyPair("ca/client.crt", "ca/key.unencrypted.pem")
//if err != nil {
// log.Fatalln("client.crt LoadX509KeyPair error:", err)
//}
transport := &http.Transport{
TLSClientConfig: &tls.Config{
RootCAs: certPool, // 设置双向认证的证书
// Certificates: []tls.Certificate{clientCrt}, // 客户端证书,需要传递给服务端
InsecureSkipVerify: true, // 是否验证服务端证书,True为不验证
},
}
// 初始化minio客户端
minioClient, err := minio.New(endpoint, &minio.Options{
Creds: credentials.NewStaticV4(accessKeyID, secretAccessKey, ""),
Secure: useSSL,
Transport: transport,
})
if err != nil {
log.Fatalln(err)
}
found, err := minioClient.BucketExists(ctx, "test")
if err != nil {
log.Fatalln(err)
}
fmt.Println(found)
}