13518219792
这篇文章主要介绍了Docker启用TLS实现安全配置的方法的相关知识，内容详细易懂，操作简单快捷，具有一定借鉴价值，相信大家阅读完这篇Docker启用TLS实现安全配置的方法文章都会有所收获，下面我们一起来看看吧。
10年积累的网站制作、做网站经验，可以快速应对客户对网站的新想法和需求。提供各种问题对应的解决方案。让选择我们的客户得到更好、更有力的网络服务。我虽然不认识你，你也不认识我。但先网站制作后付款的网站建设流程，更有环县免费网站建设让你可以放心的选择与我们合作。
启用tls
在docker服务器，生成ca私有和公共密钥
$ openssl genrsa -aes256 -out ca-key.pem 4096 generating rsa private key, 4096 bit long modulus ............................................................................................................................................................................................++ ........++ e is 65537 (0x10001) enter pass phrase for ca-key.pem: verifying - enter pass phrase for ca-key.pem: $ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem enter pass phrase for ca-key.pem: you are about to be asked to enter information that will be incorporated into your certificate request. what you are about to enter is what is called a distinguished name or a dn. there are quite a few fields but you can leave some blank for some fields there will be a default value, if you enter '.', the field will be left blank. ----- country name (2 letter code) [au]: state or province name (full name) [some-state]:queensland locality name (eg, city) []:brisbane organization name (eg, company) [internet widgits pty ltd]:docker inc organizational unit name (eg, section) []:sales common name (e.g. server fqdn or your name) []:$host email address []:sven@home.org.au
有了ca后，可以创建一个服务器密钥和证书签名请求(csr)
$host 是你的服务器ip
$ openssl genrsa -out server-key.pem 4096 generating rsa private key, 4096 bit long modulus .....................................................................++ .................................................................................................++ e is 65537 (0x10001) $ openssl req -subj "/cn=$host" -sha256 -new -key server-key.pem -out server.csr
接着，用ca来签署公共密钥:
$ echo subjectaltname = DNS:$host,ip:$host:127.0.0.1 >> extfile.cnf $ echo extendedkeyusage = serverauth >> extfile.cnf
生成key：
$ openssl x509 -req -days 365 -sha256 -in server.csr -ca ca.pem -cakey ca-key.pem \ -cacreateserial -out server-cert.pem -extfile extfile.cnf signature ok subject=/cn=your.host.com getting ca private key enter pass phrase for ca-key.pem:
创建客户端密钥和证书签名请求:
$ openssl genrsa -out key.pem 4096 generating rsa private key, 4096 bit long modulus .........................................................++ ................++ e is 65537 (0x10001) $ openssl req -subj '/cn=client' -new -key key.pem -out client.csr
修改extfile.cnf：
echo extendedkeyusage = clientauth > extfile-client.cnf
生成签名私钥：
$ openssl x509 -req -days 365 -sha256 -in client.csr -ca ca.pem -cakey ca-key.pem \ -cacreateserial -out cert.pem -extfile extfile-client.cnf signature ok subject=/cn=client getting ca private key enter pass phrase for ca-key.pem:
将docker服务停止，然后修改docker服务文件
[unit] description=docker application container engine documentation=http://docs.docker.io [service] environment="path=/opt/kube/bin:/bin:/sbin:/usr/bin:/usr/sbin" execstart=/opt/kube/bin/dockerd --tlsverify --tlscacert=/root/docker/ca.pem --tlscert=/root/docker/server-cert.pem --tlskey=/root/docker/server-key.pem -h unix:///var/run/docker.sock -h tcp://0.0.0.0:2375 execstartpost=/sbin/iptables -i forward -s 0.0.0.0/0 -j accept execreload=/bin/kill -s hup $mainpid restart=on-failure restartsec=5 limitnofile=infinity limitnproc=infinity limitcore=infinity delegate=yes killmode=process [install] wantedby=multi-user.target
然后重启服务
systemctl daemon-reload systemctl restart docker.service
重启后查看服务状态：
systemctl status docker.service ● docker.service - docker application container engine loaded: loaded (/etc/systemd/system/docker.service; enabled; vendor preset: enabled) active: active (running) since thu 2019-08-08 19:22:26 cst; 1 min ago
已经生效。
使用证书连接：
复制ca.pem,cert.pem,key.pem三个文件到客户端
docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -h=$host:2375 version连接即可
docker-java 启用tls
项目里使用docker的java客户端docker-java调用docker，为了支持tls，在创建客户端时，需要增加tls设置。
首先将ca.pem cert.pem key.pem这三个文件拷贝到本地，例如e:\\docker\\",
然后defaultdockerclientconfig里withdockertlsverify设为true，并设置certpath为刚拷贝的目录。
defaultdockerclientconfig.builder builder =
defaultdockerclientconfig.createdefaultconfigbuilder()
.withdockerhost("tcp://" + server + ":2375")
.withapiversion("1.30");
if (containerconfiguration.getdockertlsverify()) {
builder = builder.withdockertlsverify(true)
.withdockercertpath("e:\\docker\\");
}
return dockerclientbuilder.getinstance(builder.build()).build()关于“Docker启用TLS实现安全配置的方法”这篇文章的内容就介绍到这里，感谢各位的阅读！相信大家对“Docker启用TLS实现安全配置的方法”知识都有一定的了解，大家如果还想学习更多知识，欢迎关注创新互联行业资讯频道。
