Origin: https://github.com/paulczar/omgwtfssl
Sick of googling every time you need a self signed certificate?
This is a small docker image based off alpine linux which makes creating self signed SSL certs easier:
$ docker run -v /tmp/certs:/certs stakater/ssl-certs-generator:1.0
----------------------------
| SSL Cert Generator |
----------------------------
--> Certificate Authority
====> Generating new CA key ca-key.pem
Generating RSA private key, 2048 bit long modulus
..................................+++
..................................+++
e is 65537 (0x10001)
====> Generating new CA Certificate ca.pem
====> Generating new config file openssl.cnf
====> Generating new SSL KEY key.pem
Generating RSA private key, 2048 bit long modulus
....................................................................+++
........................+++
e is 65537 (0x10001)
====> Generating new SSL CSR key.csr
====> Generating new SSL CERT cert.pem
Signature ok
subject=/CN=test
Getting CA Private Key
$ ls /tmp/certs
ca-key.pem ca.pem ca.srl cert.pem key.csr key.pem openssl.cnf
$ openssl verify -CAfile /tmp/certs/ca.pem /tmp/certs/cert.pem
/tmp/certs/cert.pem: OK
Customize the certs using the following Environment Variables:
CA_KEYCA Key file, defaultca-key.pem[1]CA_CERTCA Certificate file, defaultca.pem[1]CA_SUBJECTCA Subject, defaulttest-caCA_EXPIRECA Expiry, default60daysSSL_CONFIGSSL Config, defaultopenssl.cnf[1]SSL_KEYSSL Key file, defaultkey.pemSSL_CSRSSL Cert Request file, defaultkey.csrSSL_CERTSSL Cert file, defaultcert.pemSSL_SIZESSL Cert size, default2048bitsSSL_EXPIRESSL Cert expiry, default60daysSSL_SUBJECTSSL Subject defaultexample.comSSL_DNScomma seperate list of alternative hostnames, no default [2]SSL_IPcomma seperate list of alternative IPs, no default [2]
[1] If file already exists will re-use.
[2] If SSL_DNS or SSL_IP is set will add SSL_SUBJECT to alternative hostname list
Creating web certs for testing SSL just got a hell of a lot easier...
Create Certificate:
$ docker run -v /tmp/certs:/certs \
-e SSL_SUBJECT=test.example.com stakater/ssl-certs-generator:1.0
Enable SSL in /etc/nginx/sites-enabled/default:
server {
listen 443;
server_name test.example.com;
root html;
index index.html index.htm;
ssl on;
ssl_certificate /tmp/certs/cert.pem;
ssl_certificate_key /tmp/certs/key.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
try_files $uri $uri/ =404;
}
}
Restart NGINX and test:
$ service nginx restart
$ echo '127.0.2.1 test.example.com' >> /etc/hosts
$ curl --cacert /tmp/certs/ca.pem https://test.example.com
<!DOCTYPE html>
<html>
<head>
...
Slightly more interesting example of using stakater/ssl-certs-generator as a volume container to build and host SSL certs for the Docker Registry image
Create the volume container for the registry from stakater/ssl-certs-generator:
$ docker run \
--name certs \
-e SSL_SUBJECT=test.example.com \
stakater/ssl-certs-generator
----------------------------
| SSL Cert Generator |
----------------------------
--> Certificate Authority
====> Generating new CA key ca-key.pem
Generating RSA private key, 2048 bit long modulus
..........+++
.......................................................+++
e is 65537 (0x10001)
====> Generating new CA Certificate ca.pem
====> Generating new config file openssl.cnf
====> Generating new SSL KEY key.pem
Generating RSA private key, 2048 bit long modulus
........................................................................................................................................................+++
...+++
e is 65537 (0x10001)
====> Generating new SSL CSR key.csr
====> Generating new SSL CERT cert.pem
Signature ok
subject=/CN=test.example.com
Getting CA Private Key
Run the registry using --volumes-from to use the volume container created above:
$ docker run -d \
--name registry \
--volumes-from certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/cert.pem \
-e REGISTRY_HTTP_TLS_KEY=/certs/key.pem \
-p 5000:5000 \
registry:2
Make sure it works:
$ echo "127.0.2.1 test.example.com" >> /etc/hosts
$ docker tag paulczar/omgwtfssl test.example.com:5000/omgwtfbbq
$ docker push test.example.com:5000/omgwtfbbq
The push refers to a repository [test.example.com:5000/omgwtfbbq] (len: 1)
e34964fe7cfa: Pushed
d52b82eb9ff3: Pushed
6b030e7d76a6: Pushed
8a648f689ddb: Pushed
latest: digest: sha256:8a97202b0ad9b375ff478d84ed948ae7ddd298196fd3b341fc8391a0fe71345a size: 7617