linux自建证书全流程分享

openssl genrsa -des3 -out minio.key 2048
输入完这个命令会让输入两次密码，密码自定义就可以，两次输入需要一致

openssl rsa -in minio.key -out minio.key
输入完命令让输入密码确认，这里输入第一步的密码

openssl req -utf8 -x509 -new -nodes -key minio.key -sha256 -days 825 -out minio.pem
输入完命令会让输入以下几个信息：
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

openssl genrsa -out minio_server.key 2048

openssl req -new -key minio_server.key -out minio_server.csr
输入完命令会让输入以下几个信息：
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

vim minio_server.ext

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = xx.xx.xxx.xxx
IP.1 = xx.xx.xxx.xxx

openssl x509 -req -in minio_server.csr -CA minio.pem -CAkey minio.key -CAcreateserial -out minio_server.crt -days 3650 -sha256 -extfile minio_server.ext

minio_server.crt

minio启动命令，将上面重命名后的private.key和public.crt放到/minio/config这个目录下
	sudo docker run -p 9000:9000 -p 9001:9001 -d --name minio 
	-v /minio/data:/data 
	-v /minio/config:/root/.minio/certs 
	-e "MINIO_ROOT_USER=admin" 
	-e "MINIO_ROOT_PASSWORD=Minio@2024#qwe" 
	minio/minio server /data --console-address ":9001"

keytool -import -alias public -keystore cacerts -file D://public.crt(自己的路径，文件为上面生成的证书文件)

public OssClient(String configKey, OssProperties ossProperties) {
        this.configKey = configKey;
        this.properties = ossProperties;
        try {
            AwsClientBuilder.EndpointConfiguration endpointConfig =
                new AwsClientBuilder.EndpointConfiguration(properties.getEndpoint(), properties.getRegion());
            AWSCredentials credentials = new BasicAWSCredentials(properties.getAccessKey(), properties.getSecretKey());
            AWSCredentialsProvider credentialsProvider = new AWSStaticCredentialsProvider(credentials);
            ClientConfiguration clientConfig = new ClientConfiguration();
            if (OssConstant.IS_HTTPS.equals(properties.getIsHttps())) {
                clientConfig.setProtocol(Protocol.HTTPS);
                // 绕过https证书验证
                TrustStrategy trustStrategy =(X509Certificate[] chain, String authType) ->true;
                SSLContext sslContext =new SSLContextBuilder().loadTrustMaterial(null, trustStrategy).build();
                SSLConnectionSocketFactory sslsf =new SSLConnectionSocketFactory(sslContext, new String[]{"TLSv1.2"}, null, NoopHostnameVerifier.INSTANCE);
                clientConfig.getApacheHttpClientConfig().setSslSocketFactory(sslsf);
            } else {
                clientConfig.setProtocol(Protocol.HTTP);
            }
            AmazonS3ClientBuilder build = AmazonS3Client.builder()
                .withEndpointConfiguration(endpointConfig)
                .withClientConfiguration(clientConfig)
                .withCredentials(credentialsProvider)
                .disableChunkedEncoding();
            if (!StringUtils.containsAny(properties.getEndpoint(), OssConstant.CLOUD_SERVICE)) {
                // minio 使用https限制使用域名访问 需要此配置 站点填域名
                build.enablePathStyleAccess();
            }
            this.client = build.build();

            createBucket();
        } catch (Exception e) {
            if (e instanceof OssException) {
                throw e;
            }
            throw new OssException("配置错误! 请检查系统配置");
        }
    }