67 lines
2.5 KiB
Bash
67 lines
2.5 KiB
Bash
|
#!/bin/bash
|
||
|
|
# =============================================================================
|
||
|
|
# Manual mTLS certificate generation script (for dev/testing only)
|
||
|
|
# =============================================================================
|
||
|
|
# In production, use cert-manager (see k8s/base/cert-manager/).
|
||
|
|
# This script generates self-signed certificates for local testing.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# ./deploy/scripts/generate-mtls-certs.sh
|
||
|
|
#
|
||
|
|
# Output: deploy/mtls/
|
||
|
|
# =============================================================================
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
OUTPUT_DIR="deploy/mtls"
|
||
|
|
SERVICES=("execute-service" "data-service" "news-service" "api-gateway" "dashboard")
|
||
|
|
DAYS_VALID=365
|
||
|
|
|
||
|
|
mkdir -p "$OUTPUT_DIR/ca" "$OUTPUT_DIR/certs"
|
||
|
|
|
||
|
|
# ── Generate Root CA ────────────────────────────────────────────────────────
|
||
|
|
echo "Generating Root CA..."
|
||
|
|
openssl genrsa -out "$OUTPUT_DIR/ca/ca.key" 4096 2>/dev/null
|
||
|
|
openssl req -x509 -new -nodes \
|
||
|
|
-key "$OUTPUT_DIR/ca/ca.key" \
|
||
|
|
-sha256 \
|
||
|
|
-days $DAYS_VALID \
|
||
|
|
-out "$OUTPUT_DIR/ca/ca.crt" \
|
||
|
|
-subj "/C=US/ST=California/O=TradingPlatform/CN=Trading Platform Root CA"
|
||
|
|
|
||
|
|
# ── Generate Service Certificates ────────────────────────────────────────────
|
||
|
|
for SERVICE in "${SERVICES[@]}"; do
|
||
|
|
echo "Generating certificate for $SERVICE..."
|
||
|
|
|
||
|
|
# Generate private key
|
||
|
|
openssl genrsa \
|
||
|
|
-out "$OUTPUT_DIR/certs/${SERVICE}.key" 2048 2>/dev/null
|
||
|
|
|
||
|
|
# Generate CSR
|
||
|
|
openssl req -new \
|
||
|
|
-key "$OUTPUT_DIR/certs/${SERVICE}.key" \
|
||
|
|
-out "$OUTPUT_DIR/certs/${SERVICE}.csr" \
|
||
|
|
-subj "/C=US/ST=California/O=TradingPlatform/CN=${SERVICE}.customer1.svc.cluster.local" \
|
||
|
|
-addext "subjectAltName=DNS:${SERVICE},DNS:${SERVICE}.customer1,DNS:${SERVICE}.customer1.svc.cluster.local"
|
||
|
|
|
||
|
|
# Sign with CA
|
||
|
|
openssl x509 -req \
|
||
|
|
-in "$OUTPUT_DIR/certs/${SERVICE}.csr" \
|
||
|
|
-CA "$OUTPUT_DIR/ca/ca.crt" \
|
||
|
|
-CAkey "$OUTPUT_DIR/ca/ca.key" \
|
||
|
|
-CAcreateserial \
|
||
|
|
-out "$OUTPUT_DIR/certs/${SERVICE}.crt" \
|
||
|
|
-days $DAYS_VALID \
|
||
|
|
-sha256 \
|
||
|
|
-extfile <(printf "subjectAltName=DNS:${SERVICE},DNS:${SERVICE}.customer1,DNS:${SERVICE}.customer1.svc.cluster.local")
|
||
|
|
|
||
|
|
# Clean up CSR
|
||
|
|
rm "$OUTPUT_DIR/certs/${SERVICE}.csr"
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "Done! All certificates generated in $OUTPUT_DIR/certs/"
|
||
|
|
echo "CA certificate: $OUTPUT_DIR/ca/ca.crt"
|
||
|
|
echo ""
|
||
|
|
echo "To verify a certificate:"
|
||
|
|
echo " openssl verify -CAfile $OUTPUT_DIR/ca/ca.crt $OUTPUT_DIR/certs/<service>.crt"
|