[root@localhost etcd]# mv cfssljson_linux-amd64 /usr/bin/cfssljson
3、添加可执行权限
[root@localhost etcd]# chmod +x /usr/bin/{cfssl,cfssljson}
4、配置CA选项
[root@localhost etcd]# mkdir etcd-ca-gen
[root@localhost etcd]# cd etcd-ca-gen
[root@localhost etcd]# cat > ca-config.json << EOF
{
"signing": {
"default": {
"expiry": "43800h"
},
"profiles": {
"server": {
"expiry": "43800h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
},
"client": {
"expiry": "43800h",
"usages": [
"signing",
"key encipherment",
"client auth"
]
},
"peer": {
"expiry": "43800h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
[root@localhost etcd]# cat > ca-csr.json <<EOF
{
"CN": "WAE Etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "FJ",
"ST": "Xia Men"
}
]
}
EOF
5、生成CA证书
[root@localhost etcd]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -#将会生成以下几个文件：
ca-key.pem
ca.csr
ca.pem
6、生成服务器端证书
[root@localhost etcd]# cat > server.json <<EOF
{
"CN": "WAE Etcd Server",
"hosts": [
"127.0.0.1",
"etcd1-com-hakim.com",
"etcd2-com-hakim.com",
"etcd3-com-hakim.com",
"etcd4-com-hakim.com",
"etcd5-com-hakim.com"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "FJ",
"ST": "Xia Men"
}
]
}
EOF
[root@localhost etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server server.json | cfssljson -bare server
7、生成对等证书
$ cp server.json member.json
$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer member.json | cfssljson -bare member
8、生成客户端证书
[root@localhost etcd]# cat > client.json <<EOF
{
"CN": "client",
"hosts": [""],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "FJ",
"ST": "Xia Men"
}
]
}
EOF
[root@localhost etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client.json | cfssljson -bare client
9、保存证书和密钥
将所有 pem 文件复制到 /etc/etcd/etcd-ca/ 目录下，命令如下：
[root@localhost etcd]# mkdir /etc/etcd/etcd-ca/
[root@localhost etcd]# cp *.pem /etc/etcd/etcd-ca/
三、配置Etcd
增加etcd配置文件，内容如下：
[root@localhost etcd]# vim /etc/etcd/etcd.conf
[member]
ETCD_NAME=etcd1
ETCD_DATA_DIR="/var/lib/etcd/data"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="etcd1-com-hakim.com:2380"
ETCD_INITIAL_CLUSTER="etcd1=etcd1-com-hakim.com:2380,etcd2=https://etcd2-com-…"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="etcd1-com-hakim.com:2379"
#[security]
ETCD_CERT_FILE="/etc/etcd/etcd-ca/server.pem"
ETCD_KEY_FILE="/etc/etcd/etcd-ca/server-key.pem"
ETCD_CLIENT_CERT_AUTH="true"
ETCD_TRUSTED_CA_FILE="/etc/etcd/etcd-ca/ca.pem"
ETCD_AUTO_TLS="true"
ETCD_PEER_CERT_FILE="/etc/etcd/etcd-ca/member.pem"
ETCD_PEER_KEY_FILE="/etc/etcd/etcd-ca/member-key.pem"
ETCD_PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/etcd-ca/ca.pem"
ETCD_PEER_AUTO_TLS="true"
