怎么样分配公网证书基于负载均衡-Keepalived-Haproxy

下文给大家带来怎么样分配公网证书基于负载均衡-Keepalived-Haproxy，希望能够给大家在实际运用中带来一定的帮助，负载均衡涉及的东西比较多，理论也不多，网上有很多书籍，今天我们就用亿速云在行业内累计的经验来做一个解答。

241-HaproxyKA01

242-HaproxyKA02

同样配置。

// 0. 删除文件

//删除旧证书:

ll certificates/

rm -f certificates/*.* //删除所有

ll certificates/

//删除证书

ll /etc/ssl/certs/

rm -f /etc/ssl/certs/exchange_certificate_and_key_nopassword.pem //删除此文件

ll /etc/ssl/certs/

// 1.下载 CA 证书（根证书）

root_i-x-Cloud.cer

上传到 /root/

ls *.cer -l

mv *.cer certificates/

cd certificates

ll

[root@241-HaproxyKA01 ~]# ll

total 1660

-rw-------. 1 root root 1030 Dec 13 2015 anaconda-ks.cfg

drwxr-xr-x 2 root root 6 Feb 24 17:18 certificates

drwxrwxr-x 9 root root 4096 Oct 6 2016 haproxy-1.5.4

-rw-r--r-- 1 root root 1336140 May 12 2016 haproxy-1.5.4.tar.gz

drwxr-xr-x 7 1000 1000 4096 Oct 7 2016 keepalived-1.2.13

-rw-r--r-- 1 root root 341956 May 13 2014 keepalived-1.2.13.tar.gz

-rw-r--r-- 1 root root 1174 Feb 24 16:02 root_i_x_Cloud.cer

[root@241-HaproxyKA01 ~]# mv *.cer certificates/

[root@241-HaproxyKA01 ~]# cd certificates/

[root@241-HaproxyKA01 certificates]# ll

total 4

-rw-r--r-- 1 root root 1174 Feb 24 16:02 root_i_x_Cloud.cer

// 2. 将cer转为pem (根证书)

openssl x509 -in root_i-x-Cloud.cer -inform der -outform pem -out root_i-x-Cloud.pem

ll

[root@241-HaproxyKA01 certificates]# openssl x509 -in root_i-x-Cloud.cer -inform der -outform pem -out root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]# ll

total 8

-rw-r--r-- 1 root root 1174 Feb 24 16:02 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1647 Feb 24 17:21 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 3. 重新生成hash

[root@241-HaproxyKA01 certificates]# c_rehash .

Doing .

root_i-x-Cloud.pem => 2e5ac55d.0

[root@241-HaproxyKA01 certificates]# ll

total 8

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]# ll /etc/pki/tls/certs/

total 12

lrwxrwxrwx 1 root root 49 May 10 2016 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

lrwxrwxrwx 1 root root 55 May 10 2016 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

-rwxr-xr-x 1 root root 610 May 9 2016 make-dummy-cert

-rw-r--r-- 1 root root 2388 May 9 2016 Makefile

-rwxr-xr-x 1 root root 829 May 9 2016 renew-dummy-cert

[root@241-HaproxyKA01 certificates]#

// 4. 导出证书（设置密码：Aa123456）//密码不能为1.

i-x-Cloud.com.pfx

上传证书:/root/certificates/

[root@241-HaproxyKA01 certificates]# ll

total 12

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 3869 Feb 28 22:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 5. 将pfx转为pem

openssl pkcs12 -in i-x-Cloud.com.pfx -nocerts -out exchange_private_key_passwordprotected.pem

Aa123456

[root@241-HaproxyKA01 certificates]# ll

total 12

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 3869 Feb 28 22:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]# openssl pkcs12 -in i-x-Cloud.com.pfx -nocerts -out exchange_private_key_passwordprotected.pem

Enter Import Password:

MAC verified OK

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

[root@241-HaproxyKA01 certificates]# ll

total 16

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 2088 Mar 1 20:34 exchange_private_key_passwordprotected.pem

-rw-r--r-- 1 root root 3913 Mar 1 20:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 6. 移出密码保护

openssl rsa -in exchange_private_key_passwordprotected.pem -out exchange_private_key_nopassword.pem

[root@241-HaproxyKA01 certificates]# openssl rsa -in exchange_private_key_passwordprotected.pem -out exchange_private_key_nopassword.pem

Enter pass phrase for exchange_private_key_passwordprotected.pem:

writing RSA key

[root@241-HaproxyKA01 certificates]# ll

total 20

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 1679 Mar 1 20:36 exchange_private_key_nopassword.pem

-rw-r--r-- 1 root root 2088 Mar 1 20:34 exchange_private_key_passwordprotected.pem

-rw-r--r-- 1 root root 3913 Mar 1 20:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 7. 解压这个pfx文件，我们需要提供凭证。

openssl pkcs12 -in i-x-Cloud.com.pfx -clcerts -nokeys -out exchange_certificate.pem

ll

[root@241-HaproxyKA01 certificates]# openssl pkcs12 -in i-x-Cloud.com.pfx -clcerts -nokeys -out exchange_certificate.pem

Enter Import Password:

MAC verified OK

[root@241-HaproxyKA01 certificates]# ll

total 24

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 3040 Mar 1 20:38 exchange_certificate.pem

-rw-r--r-- 1 root root 1679 Mar 1 20:36 exchange_private_key_nopassword.pem

-rw-r--r-- 1 root root 2088 Mar 1 20:34 exchange_private_key_passwordprotected.pem

-rw-r--r-- 1 root root 3913 Mar 1 20:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 8. 通过将exchange_certificate.pem和exchange_private_key_nopassword.pem产生exchange_certificate_and_key_nopassword.pem。

cat exchange_certificate.pem exchange_private_key_nopassword.pem > exchange_certificate_and_key_nopassword.pem

ll

[root@241-HaproxyKA01 certificates]# cat exchange_certificate.pem exchange_private_key_nopassword.pem > exchange_certificate_and_key_nopassword.pem

[root@241-HaproxyKA01 certificates]# ll

total 32

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 4719 Mar 1 20:40 exchange_certificate_and_key_nopassword.pem

-rw-r--r-- 1 root root 3040 Mar 1 20:38 exchange_certificate.pem

-rw-r--r-- 1 root root 1679 Mar 1 20:36 exchange_private_key_nopassword.pem

-rw-r--r-- 1 root root 2088 Mar 1 20:34 exchange_private_key_passwordprotected.pem

-rw-r--r-- 1 root root 3913 Mar 1 20:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 9. 复制到文件夹中

ll /etc/ssl/certs/

rm -f /etc/ssl/certs/exchange_certificate_and_key_nopassword.pem

mv exchange_certificate_and_key_nopassword.pem /etc/ssl/certs/

ll /etc/ssl/certs/

ll

[root@241-HaproxyKA01 certificates]# ll /etc/ssl/certs/

total 12

lrwxrwxrwx 1 root root 49 May 10 2016 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

lrwxrwxrwx 1 root root 55 May 10 2016 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

-rwxr-xr-x 1 root root 610 May 9 2016 make-dummy-cert

-rw-r--r-- 1 root root 2388 May 9 2016 Makefile

-rwxr-xr-x 1 root root 829 May 9 2016 renew-dummy-cert

[root@241-HaproxyKA01 certificates]# mv exchange_certificate_and_key_nopassword.pem /etc/ssl/certs/

[root@241-HaproxyKA01 certificates]# ll /etc/ssl/certs/

total 20

lrwxrwxrwx 1 root root 49 May 10 2016 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

lrwxrwxrwx 1 root root 55 May 10 2016 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

-rw-r--r-- 1 root root 4719 Mar 1 20:40 exchange_certificate_and_key_nopassword.pem

-rwxr-xr-x 1 root root 610 May 9 2016 make-dummy-cert

-rw-r--r-- 1 root root 2388 May 9 2016 Makefile

-rwxr-xr-x 1 root root 829 May 9 2016 renew-dummy-cert

[root@241-HaproxyKA01 certificates]# ll

total 24

lrwxrwxrwx 1 root root 18 Mar 1 20:23 2e5ac55d.0 -> root_i-x-Cloud.pem

-rw-r--r-- 1 root root 3040 Mar 1 20:38 exchange_certificate.pem

-rw-r--r-- 1 root root 1679 Mar 1 20:36 exchange_private_key_nopassword.pem

-rw-r--r-- 1 root root 2088 Mar 1 20:34 exchange_private_key_passwordprotected.pem

-rw-r--r-- 1 root root 3913 Mar 1 20:33 i-x-Cloud.com.pfx

-rw-r--r-- 1 root root 846 Mar 1 12:48 root_i-x-Cloud.cer

-rw-r--r-- 1 root root 1200 Mar 1 20:19 root_i-x-Cloud.pem

[root@241-HaproxyKA01 certificates]#

// 10. 测试

[root@241-HaproxyKA01 ~]# ip a | grep "inet 10"

inet 10.1.1.241/24 brd 10.1.1.255 scope global eth0

inet 10.1.1.135/32 scope global eth0

inet 10.1.1.150/32 scope global eth0

inet 10.1.1.120/32 scope global eth0

[root@241-HaproxyKA01 ~]#

[root@242-HaproxyKA02 ~]# ip a | grep "inet 10"

inet 10.1.1.242/24 brd 10.1.1.255 scope global eth0

[root@242-HaproxyKA02 ~]#

[root@241-HaproxyKA01 ~]# ip a | grep "inet 10"

inet 10.1.1.241/24 brd 10.1.1.255 scope global eth0

[root@241-HaproxyKA01 ~]#

[root@242-HaproxyKA02 ~]# ip a | grep "inet 10"

inet 10.1.1.242/24 brd 10.1.1.255 scope global eth0

[root@242-HaproxyKA02 ~]# ip a | grep "inet 10"

inet 10.1.1.242/24 brd 10.1.1.255 scope global eth0

inet 10.1.1.135/32 scope global eth0

inet 10.1.1.150/32 scope global eth0

inet 10.1.1.120/32 scope global eth0

[root@242-HaproxyKA02 ~]#

看了以上关于怎么样分配公网证书基于负载均衡-Keepalived-Haproxy，如果大家还有什么地方需要了解的可以在亿速云行业资讯里查找自己感兴趣的或者找我们的专业技术工程师解答的，亿速云技术工程师在行业内拥有十几年的经验了。亿速云官网链接www.yisu.com