nginx

installation

$ sudo apt udpate
$ sudo apt install nginx

configuration

$ sudo ufw app list
Available applications:
  CUPS
  Nginx Full
  Nginx HTTP
  Nginx HTTPS
  OpenSSH
  Postfix
  Postfix SMTPS
  Postfix Submission
  • or
    $ sudo ufw allow 'Nginx HTTP'

ssl cert

generate cert for server

CA (root cert)

$ openssl genrsa -aes256 \
                 -out sample.artifactory.com-ca.key \
                 2048
$ openssl req -new \
              -x509 \
              -days 365 \
              -sha256 \
              -key sample.artifactory.com-ca.key \
              -out sample.artifactory.com-ca.crt \
              -subj "/C=CN/ST=Sichuan/L=Chengdu/O=CompanyName/OU=CDI/CN=sample.artifactory.com"
check more details

cert for server

$ openssl genrsa -out  sample.artifactory.com-server.key 2048
$ openssl req -sha256 -new -key sample.artifactory.com-server.key -out sample.artifactory.com-server.csr -subj "/C=CN/ST=Sichuan/L=Chengdu/O=CompanyName/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@CompanyName.com"
check more details

sign the server cert with CA

$ echo subjectAltName = DNS:sample.artifactory.com,IP:130.147.219.19 >> extfile.cnf
$ echo extendedKeyUsage = serverAuth >> extfile.cnf

$ openssl x509 -req -days 365 -sha256 -in sample.artifactory.com-server.csr -CA sample.artifactory.com-ca.crt -CAkey sample.artifactory.com-ca.key -CAcreateserial -out sample.artifactory.com-server.crt -extfile extfile.cnf
check more details

generate client cert and signed by CA

$ openssl genrsa -out sample.artifactory.com-client.key
$ openssl req -subj "/C=CN/ST=Sichuan/L=Chengdu/O=CompanyName/OU=CDI/CN=sample.artifactory.com/emailAddress=marslo.jiao@CompanyName.com" -new -key sample.artifactory.com-client.key -out sample.artifactory.com-client.csr
$ echo extendedKeyUsage = clientAuth >> extfile.cnf

$ openssl x509 -req \
               -days 365 \
               -sha256 \
               -in sample.artifactory.com-client.csr \
               -CA sample.artifactory.com-ca.crt \
               -CAkey sample.artifactory.com-ca.key \
               -CAcreateserial \
               -out sample.artifactory.com-client.cert \
               -extfile extfile.cnf
check more details

update the file perm

$ sudo chmod -v 0444 sample.artifactory.com-ca.crt sample.artifactory.com-server.crt client.cert
$ sudo chmod -v 0400 sample.artifactory.com-ca.key client.key sample.artifactory.com-server.key

check certs

crt

$ openssl x509 -noout \
               -text \
               -in sample.artifactory.com-server.crt
openssl x509 ca.crt
openssl x509 server.crt

csr

$ openssl req -noout -text -in sample.artifactory.com-server.csr
openssl req

cert in Nginx

$ grep ssl_certificate /etc/nginx/sites-enabled/artifactoryv2.conf
ssl_certificate       /etc/nginx/certs/sample.artifactory.com/sample.artifactory.com-server.crt;
ssl_certificate_key   /etc/nginx/certs/sample.artifactory.com/sample.artifactory.com-server.key;

cert in os

MacOS

add
$ sudo security add-trusted-cert -d \
                                 -r trustRoot \
                                 -k "/Library/Keychains/System.keychain" \
                                 "/Users/marslo/Downloads/sample.artifactory.com-ca.crt"
$ security find-certificate -a -c <artifactory> -Z
$ security find-certificate -a -c artifactor -Z | grep SHA-1
SHA-1 hash: 915D019F0993F369C09D75C6B8DA201B8DE2636E

$ security list-keychain
    "/Users/marslo/Library/Keychains/login.keychain-db"
    "/Library/Keychains/System.keychain"
check more details
remove
$ sudo security delete-certificate -Z 915D019F0993F369C09D75C6B8DA201B8DE2636E

Others

  • 1st
    $ cd /etc/nginx/
$ sudo openssl genrsa -des3 -out server.key 1024
$ sudo openssl req -new -key server.key -out server.csr
$ sudo cp server.key{,.org}
$ sudo cp server.csr{,.org}
$ sudo openssl rsa -in server.key.org -out server.key
$ sudo openssl x509 -req \
                    -days 365 \
                    -in server.csr \
                    -signkey server.key \
                    -out server.crt
check more details
  • 2nd:
check more details

artifactory https

general SSL certs

$ sudo openssl genrsa -des3 -out artifactorykey 2048
$ sudo openssl req -new -key artifactorykey -out artifactorycsr
$ sudo cp artifactorykey{,.org}
$ sudo openssl rsa -in artifactorykey.org -out artifactorykey
$ sudo openssl x509 -req -days 365 -in artifactorycsr -signkey artifactorykey -out artifactorycrt
ssl with ip
ssl with domain
Copyright © marslo 2020-2023 all right reserved，powered by GitbookLast Modified: 2024-03-12 15:01:28

results matching ""

    No results matching ""