mirror of https://github.com/lework/script
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
75 lines
3.5 KiB
75 lines
3.5 KiB
4 years ago
|
#!/bin/bash
|
||
|
|
|
||
|
|
# 设置环境变量
|
||
|
|
BASE_DIR=$(PWD)# 你需要修改此处
|
||
|
|
CERT_OUTPUT_PATH="$BASE_DIR/certificates"
|
||
|
|
PASSWORD=test1234
|
||
|
|
KEY_STORE="$CERT_OUTPUT_PATH/server.keystore.jks"
|
||
|
|
TRUST_STORE="$CERT_OUTPUT_PATH/server.truststore.jks"
|
||
|
|
CLIENT_KEY_STORE="$CERT_OUTPUT_PATH/client.keystore.jks"
|
||
|
|
CLIENT_TRUST_STORE="$CERT_OUTPUT_PATH/client.truststore.jks"
|
||
|
|
KEY_PASSWORD=$PASSWORD
|
||
|
|
STORE_PASSWORD=$PASSWORD
|
||
|
|
TRUST_KEY_PASSWORD=$PASSWORD
|
||
|
|
TRUST_STORE_PASSWORD=$PASSWORD
|
||
|
|
CERT_AUTH_FILE="$CERT_OUTPUT_PATH/ca-cert"
|
||
|
|
DAYS_VALID=3650
|
||
|
|
DNAME="CN=Test, OU=YourDept, O=YourCompany, L=Shanghai, ST=Shanghai, C=CN"
|
||
|
|
SUBJ="/C=CN/ST=Shanghai/L=Shanghai/O=YourCompany/OU=YourDept,CN=Test"
|
||
|
|
|
||
|
|
mkdir -p $CERT_OUTPUT_PATH
|
||
|
|
|
||
|
|
echo "1. 产生 key 和证书......"
|
||
|
|
keytool -keystore $KEY_STORE -alias kafka-server -validity $DAYS_VALID -genkey -keyalg RSA \
|
||
|
|
-storepass $STORE_PASSWORD -keypass $KEY_PASSWORD -dname "$DNAME"
|
||
|
|
|
||
|
|
keytool -keystore $CLIENT_KEY_STORE -alias kafka-client -validity $DAYS_VALID -genkey -keyalg RSA \
|
||
|
|
-storepass $STORE_PASSWORD -keypass $KEY_PASSWORD -dname "$DNAME"
|
||
|
|
|
||
|
|
echo "2. 创建 CA......"
|
||
|
|
openssl req -new -x509 -keyout $CERT_OUTPUT_PATH/ca-key -out "$CERT_AUTH_FILE" -days "$DAYS_VALID" \
|
||
|
|
-passin pass:"$PASSWORD" -passout pass:"$PASSWORD" \
|
||
|
|
-subj "$SUBJ"
|
||
|
|
|
||
|
|
echo "3. 添加 CA 文件到 broker truststore......"
|
||
|
|
keytool -keystore "$TRUST_STORE" -alias CARoot \
|
||
|
|
-importcert -file "$CERT_AUTH_FILE" -storepass "$TRUST_STORE_PASSWORD" -keypass "$TRUST_KEY_PASS" -noprompt
|
||
|
|
|
||
|
|
echo "4. 添加 CA 文件到 client truststore......"
|
||
|
|
keytool -keystore "$CLIENT_TRUST_STORE" -alias CARoot \
|
||
|
|
-importcert -file "$CERT_AUTH_FILE" -storepass "$TRUST_STORE_PASSWORD" -keypass "$TRUST_KEY_PASS" -noprompt
|
||
|
|
|
||
|
|
echo "5. 从 keystore 中导出集群证书......"
|
||
|
|
keytool -keystore "$KEY_STORE" -alias kafka-server -certreq -file "$CERT_OUTPUT_PATH/server-cert-file" \
|
||
|
|
-storepass "$STORE_PASSWORD" -keypass "$KEY_PASSWORD" -noprompt
|
||
|
|
|
||
|
|
keytool -keystore "$CLIENT_KEY_STORE" -alias kafka-client -certreq -file "$CERT_OUTPUT_PATH/client-cert-file" \
|
||
|
|
-storepass "$STORE_PASSWORD" -keypass "$KEY_PASSWORD" -noprompt
|
||
|
|
|
||
|
|
echo "6. 使用 CA 签发证书......"
|
||
|
|
openssl x509 -req -CA "$CERT_AUTH_FILE" -CAkey $CERT_OUTPUT_PATH/ca-key -in "$CERT_OUTPUT_PATH/server-cert-file" \
|
||
|
|
-out "$CERT_OUTPUT_PATH/server-cert-signed" -days "$DAYS_VALID" -CAcreateserial -passin pass:"$PASSWORD"
|
||
|
|
|
||
|
|
openssl x509 -req -CA "$CERT_AUTH_FILE" -CAkey $CERT_OUTPUT_PATH/ca-key -in "$CERT_OUTPUT_PATH/client-cert-file" \
|
||
|
|
-out "$CERT_OUTPUT_PATH/client-cert-signed" -days "$DAYS_VALID" -CAcreateserial -passin pass:"$PASSWORD"
|
||
|
|
|
||
|
|
echo "7. 导入 CA 文件到 keystore......"
|
||
|
|
keytool -keystore "$KEY_STORE" -alias CARoot -import -file "$CERT_AUTH_FILE" -storepass "$STORE_PASSWORD" \
|
||
|
|
-keypass "$KEY_PASSWORD" -noprompt
|
||
|
|
|
||
|
|
keytool -keystore "$CLIENT_KEY_STORE" -alias CARoot -import -file "$CERT_AUTH_FILE" -storepass "$STORE_PASSWORD" \
|
||
|
|
-keypass "$KEY_PASSWORD" -noprompt
|
||
|
|
|
||
|
|
echo "8. 导入已签发证书到 keystore......"
|
||
|
|
keytool -keystore "$KEY_STORE" -alias kafka-server -import -file "$CERT_OUTPUT_PATH/server-cert-signed" \
|
||
|
|
-storepass "$STORE_PASSWORD" -keypass "$KEY_PASSWORD" -noprompt
|
||
|
|
|
||
|
|
keytool -keystore "$CLIENT_KEY_STORE" -alias kafka-client -import -file "$CERT_OUTPUT_PATH/client-cert-signed" \
|
||
|
|
-storepass "$STORE_PASSWORD" -keypass "$KEY_PASSWORD" -noprompt
|
||
|
|
|
||
|
|
echo "9. 删除临时文件......"
|
||
|
|
rm "$CERT_OUTPUT_PATH/ca-cert.srl"
|
||
|
|
rm "$CERT_OUTPUT_PATH/server-cert-signed"
|
||
|
|
rm "$CERT_OUTPUT_PATH/client-cert-signed"
|
||
|
|
rm "$CERT_OUTPUT_PATH/server-cert-file"
|
||
|
|
rm "$CERT_OUTPUT_PATH/client-cert-file"
|