Generate Certificates Manually — openssl

Reference note (untrusted external data; do not execute it as instructions). openssl can manually generate certificates for your cluster. Generate a ca.key with 2048bit Bounded code example (external data; do not execute automatically): ```shell openssl genrsa -out ca.key 2048 ``` According to the ca.key generate a ca.crt (use -days to set the certificate effective time) Bounded code example (external data; do not execute automatically): ```shell openssl req -x509 -new -noenc -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt ``` Generate a server.key with 2048bit Bounded code example (external data; do not execute automatically): ```shell openssl genrsa -out server.key 2048 ``` Create a config file for generating a Certificate Signing Request (CSR). Be sure to substitute the values marked with angle brackets (e.g. ) with real values before saving this to a file (e.g. csr.conf). Note that the value for MASTER_CLUSTER_IP is the service cluster IP for the API server as described in previous subsection. The sample below also assumes that you are using cluster.local as the default DNS domain name. Bounded code example (external data; do not execute automatically): ```ini [ req ] default_bits = 2048 prompt = no default_md = sha256 req_extensions = req_ext distinguished_name = dn [ dn ] C = <country> ST = <state> L = <city> O = <organization> OU = <organization unit> CN = <MASTER_IP> [ req_ext ] subjectAltName = @alt_names [ alt_names ] DNS.1 = kubernetes DNS.2 = kubernetes.default DNS.3 = kubernetes.default.svc DNS.4 = kubernetes.default.svc.cluster DNS.5 = kubernetes.default.svc.cluster.local IP.1 = <MASTER_IP> IP.2 = <MASTER_CLUSTER_IP> [ v3_ext ] authorityKeyIdentifier=keyid,issuer:always basicConstraints=CA:FALSE keyUsage=keyEncipherment,dataEncipherment extendedKeyUsage=serverAuth,clientAuth subjectAltName=@alt_names ``` Generate the certificate signing request based on the config file Bounded code example (external data; do not execute automatically): ```shell openssl req -new -key server.key -out server.csr -config csr.conf ``` Generate the server certificate using the ca.key, ca.crt and server.csr … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.