mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-25 14:26:27 +00:00
[DOCS] Remove old certgen examples
Original commit: elastic/x-pack-elasticsearch@f97d0ab00c
This commit is contained in:
lcawley
parent
f71dc549a5
commit
3ff175b541
@ -101,125 +101,6 @@ which can be blank. This parameter cannot be used with the `-csr` parameter.
|
|||||||
[float]
|
[float]
|
||||||
=== Examples
|
=== Examples
|
||||||
|
|
||||||
////
|
|
||||||
The tool can be used interactively:
|
|
||||||
|
|
||||||
[source,shell]
|
|
||||||
--------------------------------------------------
|
|
||||||
bin/x-pack/certgen
|
|
||||||
--------------------------------------------------
|
|
||||||
This tool assists you in the generation of X.509 certificates and certificate
|
|
||||||
signing requests for use with SSL in the Elastic stack. Depending on the command
|
|
||||||
line option specified, you may be prompted for the following:
|
|
||||||
|
|
||||||
* The path to the output file
|
|
||||||
* The output file is a zip file containing the signed certificates and
|
|
||||||
private keys for each instance. If a Certificate Authority was generated,
|
|
||||||
the certificate and private key will also be included in the output file.
|
|
||||||
* Information about each instance
|
|
||||||
* An instance is any piece of the Elastic Stack that requires a SSL certificate.
|
|
||||||
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
|
|
||||||
may all require a certificate and private key.
|
|
||||||
* The minimum required value for each instance is a name. This can simply be the
|
|
||||||
hostname, which will be used as the Common Name of the certificate. A full
|
|
||||||
distinguished name may also be used.
|
|
||||||
* IP addresses and DNS names are optional. Multiple values can be specified as a
|
|
||||||
comma separated string. If no IP addresses or DNS names are provided, you may
|
|
||||||
disable hostname verification in your SSL configuration.
|
|
||||||
* Certificate Authority private key password
|
|
||||||
* The password may be left empty if desired.
|
|
||||||
|
|
||||||
Let's get started...
|
|
||||||
|
|
||||||
Please enter the desired output file [/home/es/config/x-pack/certificate-bundle.zip]:
|
|
||||||
Enter instance name: node01
|
|
||||||
Enter name for directories and files [node01]:
|
|
||||||
Enter IP Addresses for instance (comma-separated if more than one) []: 10.10.0.1
|
|
||||||
Enter DNS names for instance (comma-separated if more than one) []: node01.mydomain.com,node01
|
|
||||||
Would you like to specify another instance? Press 'y' to continue entering instance information: y
|
|
||||||
Enter instance name: node02
|
|
||||||
Enter name for directories and files [node02]:
|
|
||||||
Enter IP Addresses for instance (comma-separated if more than one) []: 10.10.0.2
|
|
||||||
Enter DNS names for instance (comma-separated if more than one) []: node02.mydomain.com
|
|
||||||
Would you like to specify another instance? Press 'y' to continue entering instance information:
|
|
||||||
Certificates written to /home/es/config/x-pack/certificate-bundle.zip
|
|
||||||
|
|
||||||
This file should be properly secured as it contains the private keys for all
|
|
||||||
instances and the certificate authority.
|
|
||||||
|
|
||||||
After unzipping the file, there will be a directory for each instance containing
|
|
||||||
the certificate and private key. Copy the certificate, key, and CA certificate
|
|
||||||
to the configuration directory of the Elastic product that they will be used for
|
|
||||||
and follow the SSL configuration instructions in the product guide.
|
|
||||||
|
|
||||||
For client applications, you may only need to copy the CA certificate and
|
|
||||||
configure the client to trust this certificate.
|
|
||||||
....
|
|
||||||
--------------------------------------------------
|
|
||||||
|
|
||||||
In this example, the command generates a zip file with the CA certificate,
|
|
||||||
private key, two signed certificates and keys in PEM format for `node01` and
|
|
||||||
`node02`.
|
|
||||||
////
|
|
||||||
////
|
|
||||||
When using a commercial or organization specific CA, the `certgen` tool can be
|
|
||||||
used to generate certificate signing requests (CSR) for the nodes in your
|
|
||||||
cluster:
|
|
||||||
|
|
||||||
[source,shell]
|
|
||||||
--------------------------------------------------
|
|
||||||
....
|
|
||||||
bin/x-pack/certgen -csr
|
|
||||||
This tool assists you in the generation of X.509 certificates and certificate
|
|
||||||
signing requests for use with SSL in the Elastic stack. Depending on the command
|
|
||||||
line option specified, you may be prompted for the following:
|
|
||||||
|
|
||||||
* The path to the output file
|
|
||||||
* The output file is a zip file containing the certificate signing requests
|
|
||||||
and private keys for each instance.
|
|
||||||
* Information about each instance
|
|
||||||
* An instance is any piece of the Elastic Stack that requires a SSL certificate.
|
|
||||||
Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
|
|
||||||
may all require a certificate and private key.
|
|
||||||
* The minimum required value for each instance is a name. This can simply be the
|
|
||||||
hostname, which will be used as the Common Name of the certificate. A full
|
|
||||||
distinguished name may also be used.
|
|
||||||
* IP addresses and DNS names are optional. Multiple values can be specified as a
|
|
||||||
comma separated string. If no IP addresses or DNS names are provided, you may
|
|
||||||
disable hostname verification in your SSL configuration.
|
|
||||||
|
|
||||||
Let's get started...
|
|
||||||
|
|
||||||
Please enter the desired output file [/home/es/config/x-pack/csr-bundle.zip]:
|
|
||||||
Enter instance name: node01
|
|
||||||
Enter name for directories and files [node01]:
|
|
||||||
Enter IP Addresses for instance (comma-separated if more than one) []: 10.10.0.1
|
|
||||||
Enter DNS names for instance (comma-separated if more than one) []: node01.mydomain.com,node01
|
|
||||||
Would you like to specify another instance? Press 'y' to continue entering instance information: y
|
|
||||||
Enter instance name: node02
|
|
||||||
Enter name for directories and files [node02]:
|
|
||||||
Enter IP Addresses for instance (comma-separated if more than one) []: 10.10.0.2
|
|
||||||
Enter DNS names for instance (comma-separated if more than one) []: node02.mydomain.com
|
|
||||||
Would you like to specify another instance? Press 'y' to continue entering instance information:
|
|
||||||
Certificate signing requests written to /Users/jmodi/dev/tmp/elasticsearch-5.0.0-alpha5-SNAPSHOT/config/x-pack/csr-bundle.zip
|
|
||||||
|
|
||||||
This file should be properly secured as it contains the private keys for all
|
|
||||||
instances.
|
|
||||||
|
|
||||||
After unzipping the file, there will be a directory for each instance containing
|
|
||||||
the certificate signing request and the private key. Provide the certificate
|
|
||||||
signing requests to your certificate authority. Once you have received the
|
|
||||||
signed certificate, copy the signed certificate, key, and CA certificate to the
|
|
||||||
configuration directory of the Elastic product that they will be used for and
|
|
||||||
follow the SSL configuration instructions in the product guide.
|
|
||||||
....
|
|
||||||
--------------------------------------------------
|
|
||||||
|
|
||||||
In this case, the command generates a zip file with two CSRs and private
|
|
||||||
keys. The CSRs should be provided to the CA in order to obtain the signed
|
|
||||||
certificates. The signed certificates will need to be in PEM format in order to
|
|
||||||
be used.
|
|
||||||
////
|
|
||||||
[float]
|
[float]
|
||||||
[[certgen-silent]]
|
[[certgen-silent]]
|
||||||
==== Using `certgen` in Silent Mode
|
==== Using `certgen` in Silent Mode
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user