title: “Create Certificates”
date: 2019-07-30T14:47:45
slug: create-certificates
Create CA Key
openssl genrsa -out ca.key 2048
Create CA CSR
openssl req -new -key ca.key -subj "/CN=KUBERNETES-CA" -out ca.csr
Create CA Certificate
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt
Create Admin Key
openssl genrsa -out admin.key 2048
Create Admin CSR (CN Will be the User Name, OU Will be the System Group)
openssl req -new -key admin.key -subj \
"/CN=kube-admin/OU=system:masters" -out admin.csr
Create the Certificate
openssl x509 -req -in admin.csr –CA ca.crt -CAkey ca.key -out admin.crt
Or in the case of a “ca.srl: No such file or directory” error:
openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -CAserial ca.seq -out admin.crt
Test the Admin Certificate:
curl https://kube-apiserver:6443/api/v1/pods \
--key admin.key --cert admin.crt --cacert ca.crt
Create Scheduler Key
openssl genrsa -out scheduler.key 2048
Create Scheduler CSR
openssl req -new -key scheduler.key -subj \
"/CN=system:kube-scheduler" -out scheduler.csr
Create the Certificate
openssl x509 -req -in scheduler.csr –CA ca.crt -CAkey ca.key -out scheduler.crt
Or in the case of a “ca.srl: No such file or directory” error:
openssl x509 -req -in scheduler.csr -CA ca.crt -CAkey ca.key -CAcreateserial -CAserial ca.seq -out scheduler.crt
Create API Server Key
openssl genrsa -out apiserver.key 2048
Create openssl.cnf
[ req ]
default\_bits = 2048
prompt = no
default\_md = sha256
req\_extensions = req\_ext
distinguished\_name = dn
[ dn ]
C = <country>
ST = <state>
L = <city>
O = <organization>
OU = <organization unit>
CN = <MASTER\_IP>
[ req\_ext ]
subjectAltName = @alt\_names
[ alt\_names ]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster
DNS.5 = kubernetes.default.svc.cluster.local
IP.1 = 10.96.0.1
IP.2 = 172.17.0.87
[ v3\_ext ]
authorityKeyIdentifier=keyid,issuer:always
basicConstraints=CA:FALSE
keyUsage=keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=@alt\_names
Create API Server csr
openssl req -new -key apiserver.key -subj \
"/CN=kube-apiserver" -out apiserver.csr -config openssl.cnf
Create Apiserver Certificate
openssl x509 -req -in apiserver.csr \
-CA ca.crt -CAkey ca.key -out apiserver.crt
Or if you get the error unable to load number from ca.srl
openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -CAserial ca.seq -out apiserver.crt