mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-24 17:25:16 -06:00
Stephan Renatus
3286c39822
* identifier: add TLSBased This is only the identifier, the server setup still has to be done. Note that it diverges a little from what was proposed in the issue: not every client cert needs to have a CN record -- so instead, we'll use whatever is the cert's subject as client identity. * Drive-by fix: identifier_test: don't use same package for TokenBased tests. * server: require and verify client cert for AuthenticationTLS * server: allow setting CA pool via --tls-ca-cert-file * server: expose new authentication via parameter * [nit] server: simplify getListenerForHTTPServer * server_test: use httptest for integration-y TLS tests * book/security: mention TLS authn with example Signed-off-by: Stephan Renatus <srenatus@chef.io>
36 lines
1.3 KiB
Bash
Executable File
36 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# taken from
|
|
# https://github.com/dexidp/dex/blob/2d1ac74ec0ca12ae4d36072525d976c1a596820a/examples/k8s/gencert.sh#L22
|
|
|
|
cat <<EOF >req.cnf
|
|
[req]
|
|
req_extensions = v3_req
|
|
distinguished_name = req_distinguished_name
|
|
|
|
[req_distinguished_name]
|
|
|
|
[v3_req]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
DNS.1 = opa.example.com
|
|
IP.1 = 127.0.0.1
|
|
EOF
|
|
|
|
openssl genrsa -out ca-key.pem 2048
|
|
openssl req -x509 -new -nodes -key ca-key.pem -days 1000 -out ca.pem -subj "/CN=my-ca"
|
|
|
|
openssl genrsa -out client-key.pem 2048
|
|
openssl req -new -key client-key.pem -out csr.pem -subj "/CN=my-client"
|
|
openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 1000
|
|
|
|
openssl genrsa -out client-key-2.pem 2048
|
|
openssl req -new -key client-key-2.pem -out csr.pem -subj "/CN=my-client-2"
|
|
openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert-2.pem -days 1000
|
|
|
|
openssl genrsa -out server-key.pem 2048
|
|
openssl req -new -key server-key.pem -out csr.pem -subj "/CN=my-server" -config req.cnf
|
|
openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 1000 -extensions v3_req -extfile req.cnf
|