update

Certificats Linux/01-Generation-Certificat-CA.sh

@@ -0,0 +1,19 @@
+openssl genrsa -aes256 -out ca-key.pem 4096
+openssl req -new -x509 -days 365 -subj "/C=FR/ST=NORD/L=ROUBAIX/O=Tips-Of-Mine/OU=IT/CN=tips-of-mine.local" -key ca-key.pem -sha256 -out ca.pem
+openssl genrsa -out server-key.pem 4096
+openssl req -sha256 -new -subj "/C=FR/ST=NORD/L=ROUBAIX/O=Tips-Of-Mine/OU=IT/CN=tips-of-mine.local" -key server-key.pem -out server.csr
+cat > v3-server.cnf <<-EOF
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1=tips-of-mine.local
+DNS.2=tips-of-mine
+DNS.3=hostname
+IP.1=127.0.0.1
+IP.2=@IP
+EOF
+openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile v3-server.cnf

Certificats Linux/02-Generation-Certificat-Server.sh

@@ -0,0 +1,20 @@
+
+openssl genrsa -out key.pem 4096
+openssl rep -subj "/CN=client" -new -key key.pem -out client.csr
+cat > v3-client.cnf <<-EOF
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+extendedKeyUsage = clientAuth
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1=tips-of-mine.local
+DNS.2=tips-of-mine
+DNS.3=hostname
+IP.1=127.0.0.1
+IP.2=@IP
+EOF
+openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile v3-client.cnf
+chmod -v 0400 ca-key.pem key.pem server-key.pem
+chmod -v 0444 ca.pem server-cert.pem cert.pem

Certificats Linux/03-Mise-en-place.sh

@@ -0,0 +1,25 @@
+mkdir -p /etc/docker/certs.d/example.com:2376
+cp ca.pem server-cert.pem server-key.pem /etc/docker/certs.d/example.com:2376
+
+nano /lib/systemd/system/docker.service
+
+	-> Remove '-H fd://' from 'ExecStart'
+
+# Create /etc/docker/daemon.json
+tee /etc/docker/daemon.json << EOL
+{
+  "tlsverify": true,
+  "tlscacert": "/etc/docker/certs.d/example.com:2376/ca.pem",
+  "tlscert"  : "/etc/docker/certs.d/example.com:2376/server-cert.pem",
+  "tlskey"   : "/etc/docker/certs.d/example.com:2376/server-key.pem",
+  "hosts"    : ["fd://", "0.0.0.0:2376"]
+}
+EOL
+
+# Reload and restart
+systemctl daemon-reload
+systemctl restart docker
+
+# Test client connection from another server
+# copy ca.pem, cert.pem and key.pem to another machine
+docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem --host=example.com:2376 version