签发ca 证书

[root@harbor ~]# mkdir /data/ssl 
[root@harbor ~]# cd /data/ssl/
[root@harbor ssl]# openssl genrsa -out ca.key 3072
Generating RSA private key, 3072 bit long modulus (2 primes)
......................................................................................................++++
.......................................................++++
e is 65537 (0x010001)
[root@harbor ssl]# openssl req -new -x509 -days 36500 -key ca.key -out ca.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CH  #国家
State or Province Name (full name) []:BJ #省
Locality Name (eg, city) [Default City]: #城市
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

[root@harbor ssl]# openssl genrsa -out harbor.key 3072
Generating RSA private key, 3072 bit long modulus (2 primes)
...................................++++
........................................................................++++
e is 65537 (0x010001)
生成请求证书文件
[root@harbor ssl]# openssl req -new -key harbor.key -out harbor.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CH
State or Province Name (full name) []:BJ
Locality Name (eg, city) [Default City]:BJ                                                                      
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:harbor                 
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:  
An optional company name []:

签发证书
[root@harbor ssl]# openssl x509 -req -in harbor.csr -CA ca.pem  -CAkey ca.key -CAcreateserial -out harbor.pem -days 36500
Signature ok
subject=C = CH, ST = BJ, L = BJ, O = Default Company Ltd, CN = harbor
Getting CA Private Key

　　镜像仓库

[root@harbor harbor]# vim harbor.yml 
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: harbor

# http related config
#http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  #  port: 80

# https related config
https:
  # https port for harbor, default is 443
    port: 443
  # The path of cert and key files for nginx
    certificate: /data/ssl/harbor.pem   #配置证书路径
    private_key: /data/ssl/harbor.key #证书路径
保存退出



[root@harbor harbor]# ./install.sh