mirror of
https://github.com/aljazceru/cdk.git
synced 2026-01-14 02:15:50 +01:00
83 lines
1.9 KiB
Markdown
83 lines
1.9 KiB
Markdown
# gRPC TLS Certificate Generation Guide
|
|
|
|
This guide explains how to generate the necessary TLS certificates for securing gRPC communication between client and server.
|
|
|
|
## Overview
|
|
|
|
The script generates the following certificates and keys:
|
|
- Certificate Authority (CA) certificate and key
|
|
- Server certificate and key
|
|
- Client certificate and key
|
|
|
|
All certificates are generated in PEM format, which is commonly used in Unix/Linux systems.
|
|
|
|
## Prerequisites
|
|
|
|
- OpenSSL installed on your system
|
|
- Bash shell environment
|
|
|
|
## Generated Files
|
|
|
|
The script will create the following files:
|
|
- `ca.key` - Certificate Authority private key
|
|
- `ca.pem` - Certificate Authority certificate
|
|
- `server.key` - Server private key
|
|
- `server.pem` - Server certificate
|
|
- `client.key` - Client private key
|
|
- `client.pem` - Client certificate
|
|
|
|
## Usage
|
|
|
|
1. Make the script executable:
|
|
```bash
|
|
chmod +x generate_certs.sh
|
|
```
|
|
2. Run the script:
|
|
```bash
|
|
./generate_certs.sh
|
|
```
|
|
|
|
## Certificate Details
|
|
|
|
### Certificate Authority (CA)
|
|
- 4096-bit RSA key
|
|
- Valid for 365 days
|
|
- Used to sign both server and client certificates
|
|
|
|
### Server Certificate
|
|
- 4096-bit RSA key
|
|
- Valid for 365 days
|
|
- Includes Subject Alternative Names (SAN):
|
|
- DNS: localhost
|
|
- DNS: my-server
|
|
- IP: 127.0.0.1
|
|
|
|
### Client Certificate
|
|
- 4096-bit RSA key
|
|
- Valid for 365 days
|
|
- Used for client authentication
|
|
|
|
## Verification
|
|
|
|
The script includes verification steps to ensure the certificates are properly generated:
|
|
```bash
|
|
# Verify server certificate
|
|
openssl verify -CAfile ca.pem server.pem
|
|
|
|
# Verify client certificate
|
|
openssl verify -CAfile ca.pem client.pem
|
|
```
|
|
|
|
## Security Notes
|
|
|
|
1. Keep private keys (*.key files) secure and never share them
|
|
2. The CA certificate (ca.pem) needs to be distributed to both client and server
|
|
3. Server needs:
|
|
- server.key
|
|
- server.pem
|
|
- ca.pem
|
|
4. Client needs:
|
|
- client.key
|
|
- client.pem
|
|
- ca.pem
|