Terraform自签名证书Openssl验证失败

Question

我正在尝试使用Terraform创建一个自签名证书，以便在测试/开发环境中内部使用。

我首先创建了一个CA私钥，自签名证书。

然后，我为要为其启用HTTPS的内部域名创建一个证书签名请求和私钥。

然后我在证书上签名。这是我使用的整个Terraform清单：

resource "tls_private_key" "ca" {
  algorithm = "ECDSA"
  ecdsa_curve = "P384"
}
resource "tls_self_signed_cert" "ca" {
  key_algorithm = "${tls_private_key.ca.algorithm}"
  private_key_pem = "${tls_private_key.ca.private_key_pem}"
  subject {
    common_name = "Example CA"
    organization = "Example, Ltd"
    country = "GB"
  }
  validity_period_hours = 43800
  is_ca_certificate = true
  allowed_uses = [
    "key_encipherment",
    "digital_signature",
    "server_auth",
    "client_auth",
  ]
}
resource "tls_private_key" "registry" {
  algorithm = "ECDSA"
  ecdsa_curve = "P384"
}
resource "tls_cert_request" "registry" {
  key_algorithm = "${tls_private_key.registry.algorithm}"
  private_key_pem = "${tls_private_key.registry.private_key_pem}"
  subject {
    common_name = "registry.test.example.com"
    organization = "Example, Ltd"
    country = "GB"
  }
  dns_names = ["registry.test.example.com"]
}
resource "tls_locally_signed_cert" "registry" {
  cert_request_pem = "${tls_cert_request.registry.cert_request_pem}"
  ca_key_algorithm = "${tls_private_key.ca.algorithm}"
  ca_private_key_pem = "${tls_private_key.ca.private_key_pem}"
  ca_cert_pem = "${tls_self_signed_cert.ca.cert_pem}"
  validity_period_hours = 43800
  allowed_uses = [
    "key_encipherment",
    "digital_signature",
    "server_auth",
    "client_auth",
  ]
}

我运行Terraform清单。然后，我从状态文件中提取生成的证书，并将它们保存到文件中。

我试图用openssl验证最终证书，但得到了一个错误：

$ openssl verify -CAfile ca-cert.pem registry.pem 
registry.pem: C = GB, ST = , L = , postalCode = , O = "Example, Ltd", OU = , CN = registry.example.com
error 20 at 0 depth lookup:unable to get local issuer certificate

你知道问题出在哪里吗？我花了很多时间试图弄清楚这一点。

基本上，我想在我的测试/开发环境中使用它为私有Docker注册表启用HTTPS。

Answer 1

您需要将cert_signing添加到tls_private_key.ca.allowed_uses:

resource "tls_self_signed_cert" "ca" {
  key_algorithm = "${tls_private_key.ca.algorithm}"
  private_key_pem = "${tls_private_key.ca.private_key_pem}"
  subject {
    common_name = "Example CA"
    organization = "Example, Ltd"
    country = "GB"
  }
  validity_period_hours = 43800
  is_ca_certificate = true
  allowed_uses = [
    "key_encipherment",
    "digital_signature",
    "server_auth",
    "client_auth",
    "cert_signing"
  ]
}

请参阅：https://www.terraform.io/docs/providers/tls/r/self_signed_cert.html#cert_signing