使用TSL签署与配置 Dokcer API

Docker API 认证可以采用 TLS/SSL 证书来确保用户与 API 之间连接的安全性，下面介绍如何签发自 SSL 证书，并配置 docker api 使用 SSL 证书进行通信。

自签发SSL

[root@xiexianbin ~]# mkdir certs
[root@xiexianbin ~]# cd certs/
[root@xiexianbin certs]#
[root@xiexianbin certs]# ll
total 0
[root@xiexianbin certs]# openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
................................++
...........................++
e is 65537 (0x10001)
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:
[root@xiexianbin certs]# openssl req -new -x509 -days 3650 -key ca-key.pem -sha256 -out ca.pem
Enter pass phrase for ca-key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:China
Locality Name (eg, city) [Default City]:SH
Organization Name (eg, company) [Default Company Ltd]:xiexianbin.cn
Organizational Unit Name (eg, section) []:it
Common Name (eg, your name or your server's hostname) []:127.0.0.1
Email Address []:
[root@xiexianbin certs]# openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
................++
.................................++
e is 65537 (0x10001)
[root@xiexianbin certs]# openssl req -subj "/CN=docker.xiexianbin.cn" -sha256 -new -key server-key.pem -out server.csr
[root@xiexianbin certs]# echo subjectAltName = DNS:docker.xiexianbin.cn,IP:127.0.0.1 >> extfile.cnf
[root@xiexianbin certs]# echo extendedKeyUsage = serverAuth >> extfile.cnf
[root@xiexianbin certs]# openssl x509 -req -days 3650 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
Signature ok
subject=/CN=docker.xiexianbin.cn
Getting CA Private Key
Enter pass phrase for ca-key.pem:
[root@xiexianbin certs]# cp ca.pem /etc/ssl/certs/ca.pem
[root@xiexianbin certs]# cp server-cert.pem /etc/ssl/certs/server-cert.pem
[root@xiexianbin certs]# cp server-key.pem /etc/ssl/certs/server-key.pem

修改docker配置

修改 /usr/lib/systemd/system/docker.service

[Service]
# for containers run by docker
ExecStart=...
          -H unix:///var/run/docker.sock \
          -H tcp://0.0.0.0:2376 \
          --tlsverify \
          --tlscacert=/etc/ssl/certs/ca.pem \
          --tlscert=/etc/ssl/certs/server-cert.pem \
          --tlskey=/etc/ssl/certs/server-key.pem \
          ...

重启Docker服务

systemctl daemon-reload
systemctl restart docker.service

Docker Client证书签发

[root@xiexianbin certs]# openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus
.......................................++
...................................................................................................................................................................................................................................................++
e is 65537 (0x10001)
[root@xiexianbin certs]# openssl req -subj '/CN=client' -new -key key.pem -out client.csr
[root@xiexianbin certs]# echo extendedKeyUsage = clientAuth > extfile-client.cnf
[root@xiexianbin certs]# openssl x509 -req -days 3650 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem   -CAcreateserial -out cert.pem -extfile extfile-client.cnf
Signature ok
subject=/CN=client
Getting CA Private Key
Enter pass phrase for ca-key.pem:
[root@xiexianbin certs]# chmod -v 0400 ca-key.pem key.pem server-key.pem
mode of ‘ca-key.pem’ changed from 0644 (rw-r--r--) to 0400 (r--------)
mode of ‘key.pem’ changed from 0644 (rw-r--r--) to 0400 (r--------)
mode of ‘server-key.pem’ changed from 0644 (rw-r--r--) to 0400 (r--------)
[root@xiexianbin certs]# chmod -v 0444 ca.pem server-cert.pem cert.pem
mode of ‘ca.pem’ changed from 0644 (rw-r--r--) to 0444 (r--r--r--)
mode of ‘server-cert.pem’ changed from 0644 (rw-r--r--) to 0444 (r--r--r--)
mode of ‘cert.pem’ changed from 0644 (rw-r--r--) to 0444 (r--r--r--)

SSL证书验证

[root@xiexianbin certs]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=127.0.0.1:2376 version
Client:
 Version:         1.11.1
 ...

Server:
 Version:         1.11.1
 ...