解决ssl certificates updated-生成环境中的实例

一个在高校打杂的2024-08-27 16:19

应原来小伙伴的要求，生产环境出错了，是harbor的ssl cert过期了，也因为使用的是免费的ssl证书，现在无法正常使用harbor，所以贴来了2023年1月曾经搭建的文档，希望能解决问题。^v^.

以下是历史正文记录：

最近发现其中一个域名的证书到期了，无赖，现在行情不好，所以没准备续费购买商用版的证书，自己搭建把。好几个ssl证书都颁发使用（如下域名服务），域名为阿里购买的，所以原来的证书也是阿里的。

写个docs，就是update harbor的ssh crt把。

0、登录：https://harbortest.ihlt.com即出现以下界面，配置了ssl证书想通过IP也访问不了！

登录aliyun申请免费的证书把，需要购买证书服务，用了公司的企业账号，一次性可以免费申请20个，但是并非是根证书哦。截图记录把。

这里我看了harbor原来的证书格式为crt，密钥为key

所以我下载了对应的nginx的

应该harbor的证书也是通过nginx来写的

harbor@uat-harbor01:~$ sudo -i

[sudo] password for harbor:

root@uat-harbor01:~# cd /root/harbor/

root@uat-harbor01:~/harbor# ls

common common.sh docker-compose.yml harbor.v2.6.0.tar.gz harbor.yml harbor.yml.tmpl install.sh LICENSE prepare

root@uat-harbor01:~/harbor# ls

common common.sh docker-compose.yml harbor.v2.6.0.tar.gz harbor.yml harbor.yml.tmpl install.sh LICENSE prepare

root@uat-harbor01:~/harbor# cd /data/cert/

root@uat-harbor01:/data/cert# ls

harbortest.ihlt.com.crt harbortest.ihlt.com.key

root@uat-harbor01:/data/cert#

root@uat-harbor01:~/harbor# cat harbor.yml

Configuration file of Harbor

The IP address or hostname to access admin UI and registry service.

DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.

hostname: harbortest.ihlt.com

http related config

http:

port for http, default is 80. If https enabled, this port will redirect to https port

port: 80

https related config

https:

https port for harbor, default is 443

port: 443

The path of cert and key files for nginx

certificate: /data/cert/harbortest.ihlt.com.crt

private_key: /data/cert/harbortest.ihlt.com.key

依次操作如下图，

2、更新证书：

把下载的证书拷贝到对应的目录

通过finnalshell的sftp来直接拉传

root@uat-harbor01:/data/cert# ls

harbortest.ihlt.com.crt harbortest.ihlt.com.key

root@uat-harbor01:/data/cert# mv harbortest.ihlt.com.crt harbortest.ihlt.com.crt0

root@uat-harbor01:/data/cert# mv harbortest.ihlt.com.key harbortest.ihlt.com.key0

root@uat-harbor01:/data/cert# mv /tmp/harbortest.ihlt.com.* ./

root@uat-harbor01:/data/cert# ls

harbortest.ihlt.com.crt0 harbortest.ihlt.com.key harbortest.ihlt.com.key0 harbortest.ihlt.com.pem

root@uat-harbor01:/data/cert# ls -al

total 24

drwxr-xr-x 2 root root 4096 Sep 1 09:19 .

drwxr-xr-x 4 root root 4096 Oct 11 2022 ..

-rw-r--r-- 1 harbor harbor 3805 Oct 11 2022 harbortest.ihlt.com.crt0

-rw-rw-r-- 1 harbor harbor 1675 Sep 1 09:13 harbortest.ihlt.com.key

-rw-r--r-- 1 harbor harbor 1675 Oct 11 2022 harbortest.ihlt.com.key0

-rw-rw-r-- 1 harbor harbor 3813 Sep 1 09:13 harbortest.ihlt.com.pem

root@uat-harbor01:/data/cert#

3、重启harbor

停止docker-compose down

重新执行./prepare

启动docker-compose up -d

root@uat-harbor01:~/harbor# ./prepare

prepare base dir is set to /root/harbor

Clearing the configuration file: /config/portal/nginx.conf

Clearing the configuration file: /config/log/rsyslog_docker.conf

Clearing the configuration file: /config/log/logrotate.conf

Generated configuration file: /config/portal/nginx.conf

Generated configuration file: /config/log/logrotate.conf

Generated configuration file: /config/log/rsyslog_docker.conf

Traceback (most recent call last):

File "/usr/src/app/main.py", line 15, in <module>

cli()

File "/usr/lib/python3.10/site-packages/click/core.py", line 1137, in call

return self.main(*args, **kwargs)

File "/usr/lib/python3.10/site-packages/click/core.py", line 1062, in main

rv = self.invoke(ctx)

File "/usr/lib/python3.10/site-packages/click/core.py", line 1668, in invoke

return _process_result(sub_ctx.command.invoke(sub_ctx))

File "/usr/lib/python3.10/site-packages/click/core.py", line 1404, in invoke

return ctx.invoke(self.callback, **ctx.params)

File "/usr/lib/python3.10/site-packages/click/core.py", line 763, in invoke

return __callback(*args, **kwargs)

File "/usr/src/app/commands/prepare.py", line 47, in prepare

prepare_nginx(config_dict)

File "/usr/src/app/utils/nginx.py", line 23, in prepare_nginx

render_nginx_template(config_dict)

File "/usr/src/app/utils/nginx.py", line 56, in render_nginx_template

prepare_nginx_certs(config_dict['cert_key_path'], config_dict['cert_path'])

File "/usr/src/app/utils/nginx.py", line 43, in prepare_nginx_certs

shutil.copy2(host_ngx_cert_path, real_crt_path)

File "/usr/lib/python3.10/shutil.py", line 434, in copy2

copyfile(src, dst, follow_symlinks=follow_symlinks)

File "/usr/lib/python3.10/shutil.py", line 254, in copyfile

with open(src, 'rb') as fsrc:

FileNotFoundError: [Errno 2] No such file or directory: '/hostfs/data/cert/harbortest.ihlt.com.crt'

//马虎，提示没有这个文件，所以去看了下，忘记了上面的harbor.yml的crt而不是拷贝进来的pem，所以进入目录可以直接修改即可。

root@uat-harbor01:~/harbor# cd /data/cert/

root@uat-harbor01:/data/cert# ls

harbortest.ihlt.com.crt0 harbortest.ihlt.com.key harbortest.ihlt.com.key0 harbortest.ihlt.com.pem

root@uat-harbor01:/data/cert# mv harbortest.ihlt.com.pem harbortest.ihlt.com.crt

root@uat-harbor01:~/harbor# ./prepare

prepare base dir is set to /root/harbor

Clearing the configuration file: /config/portal/nginx.conf

Clearing the configuration file: /config/log/rsyslog_docker.conf

Clearing the configuration file: /config/log/logrotate.conf

Generated configuration file: /config/portal/nginx.conf

Generated configuration file: /config/log/logrotate.conf

Generated configuration file: /config/log/rsyslog_docker.conf

Generated configuration file: /config/nginx/nginx.conf

Generated configuration file: /config/core/env

Generated configuration file: /config/core/app.conf

Generated configuration file: /config/registry/config.yml

Generated configuration file: /config/registryctl/env

Generated configuration file: /config/registryctl/config.yml

Generated configuration file: /config/db/env

Generated configuration file: /config/jobservice/env

Generated configuration file: /config/jobservice/config.yml

loaded secret from file: /data/secret/keys/secretkey

Generated configuration file: /compose_location/docker-compose.yml

Clean up the input dir

root@uat-harbor01:~/harbor# docker-compose up -d

[+] Running 10/10

⠿ Network harbor_harbor Created 0.2s

⠿ Container harbor-log Started 0.8s

⠿ Container registryctl Started 1.4s

⠿ Container harbor-portal Started 1.7s

⠿ Container redis Started 1.8s

⠿ Container registry Started 1.7s

⠿ Container harbor-db Started 1.3s

⠿ Container harbor-core Started 1.9s

⠿ Container nginx Started 2.3s

⠿ Container harbor-jobservice Started 2.2s

root@uat-harbor01:~/harbor#

再次访问：恢复正常了！

nginx更新证书-2023/10/19

公司的holitech.net的证书过期了，阿里云上购买了根证书。首先上传服务，然后替换对应的路径，可以查看nginx.conf的配置：路径，然后必须重启nginx服务。后端测试OK。。。。！

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [root@k8s-ng2 paas]# scp holitech.net.* root@10.6.200.223:/root/ ssh: connect to host 10.6.200.223 port 22: Connection refused lost connection [root@k8s-ng2 paas]# scp holitech.net.* root@10.0.200.223:/data/cert root@10.0.200.223's password: holitech.net.key 100% 1679 18.3KB/s 00:00 holitech.net.pem 100% 3822 987.3KB/s 00:00 [root@k8s-ng1 data]# cd cert/ [root@k8s-ng1 cert]# ls 8631154__holitech.net.key holitech.net.key 8631154__holitech.net.pem holitech.net.pem [root@k8s-ng1 cert]# mv holitech.net.key 8631154__holitech.net.key mv：是否覆盖"8631154__holitech.net.key"？ y [root@k8s-ng1 cert]# mv holitech.net.pem 8631154__holitech.net.pem mv：是否覆盖"8631154__holitech.net.pem"？ y [root@k8s-ng1 cert]# whereis ngix ngix:[root@k8s-ng1 cert]# whereis nginx nginx: /usr/local/nginx [root@k8s-ng1 cert]# cd /usr/local/nginx/ [root@k8s-ng1 nginx]# ls client_body_temp fastcgi_temp logs sbin uwsgi_temp conf html proxy_temp scgi_temp [root@k8s-ng1 nginx]# cd sbin/ [root@k8s-ng1 sbin]# ls nginx [root@k8s-ng1 sbin]# ./nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@k8s-ng1 sbin]# systemctl restart nginx [root@k8s-ng2 paas]# systemctl restart nginx |

crt证书信息：

Harbor.ihlt.com_chain的证书

详细信息如下：

版本 ：V3

序列号：0de0ffb5ee62cb61109f608c9ced5ed3

签名算法： sha256RSA

签名哈希算法： sha256

颁发者：

CN = DigiCert Global Root G2

OU = www.digicert.com

O = DigiCert Inc

C = US

有效期从： Monday, ‎November ‎27, ‎2017 8:46:40 PM

到： ‎Saturday, ‎November ‎27, ‎2027 8:46:40 PM

使用者：

CN = Encryption Everywhere DV TLS CA - G2

OU = www.digicert.com

O = DigiCert Inc

C = US

公钥：

30 82 01 0a 02 82 01 01 00 ef 14 7f 8e a2 fe 7a fb a6 48 13 0e a9 c4 79 22 1f 08 5a af 3e 75 2a dd a1 75 b4 c2 79 86 1f 4c 9c ee 8b 9a de 54 74 77 c1 1b 00 bd 4a 2f 97 8c ad 76 72 36 60 c4 e6 ec 2f a4 60 d6 78 ef 36 10 0c 27 82 6e 9c dd 09 18 64 49 19 27 af 6c 9b 00 de c7 3a f2 76 cf 43 3b 8a a7 92 5c f2 fa 6b ca 9d a6 b6 cd fc a5 20 97 a2 b3 d1 fa c7 21 42 2b 0a 03 b3 92 43 53 23 70 53 74 77 bb 5b ad c7 96 14 d6 f3 80 bd 9c b0 95 50 7a 88 0e 04 64 9e fc a6 44 21 9c 3a 81 72 ca 78 57 bb 9a ea 67 35 82 51 3a 2d a2 0b 5d 7e 1e e1 7b f6 20 2d b4 c7 37 d8 2b fa 50 ec 62 c5 8f f7 65 5f 8b ce 92 e7 92 51 6a f7 c5 ce 46 0c 24 20 92 f5 1e eb cf 85 af 32 bd bf 96 e8 98 ac 95 92 4b f8 72 c5 b6 27 68 c6 62 3b 42 6d d9 c8 85 7a e9 6e 77 dc 3b 06 16 29 85 26 4c f7 cb 41 9e 1d 6b 92 54 c6 c8 95 fb 02 03 01 00 01

公钥参数： 05 00

使用者密钥标识符：78df91905feedeacf6c575ebd54c5553ef244ab6

授权密钥标识符： KeyID=4e2254201895e6e36ee60ffafab912ed06178f39

增强型密钥用法：

服务器身份验证 (1.3.6.1.5.5.7.3.1)

客户端身份验证 (1.3.6.1.5.5.7.3.2)

授权信息访问：

[1]Authority Info Access

Access Method=联机证书状态协议 (1.3.6.1.5.5.7.48.1)

Alternative Name:

URL=http://ocsp.digicert.com

CRL分发点：

[1]CRL Distribution Point

Distribution Point Name:

Full Name:

URL=http://crl3.digicert.com/DigiCertGlobalRootG2.crl

证书策略：

[1]Certificate Policy:

Policy Identifier=2.16.840.1.114412.1.2

[1,1]Policy Qualifier Info:

Policy Qualifier Id=CPS

Qualifier:

Legal Repository | DigiCert.com

[2]Certificate Policy:

Policy Identifier=2.23.140.1.2.1

密钥用法： Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)

基本约束：

Subject Type=CA

Path Length Constraint=0

指纹： ed6302684a3259aa04f10fe9a97a8fd30b965d26

常规信息：

颁发给： Encryption Everywhere DV TLS CA - G2

颁发者： DigiCert Global Root G2

Harbor.ihlt.com_public的证书

常规信息：

颁发给： harbor.ihlt.com

颁发者： Encryption Everywhere DV TLS CA - G2

相关推荐
内核程序员kevin3 小时前
TCP Listen 队列详解与优化指南
linux·网络·tcp/ip
朝九晚五ฺ7 小时前
【Linux探索学习】第十四弹——进程优先级：深入理解操作系统中的进程优先级
linux·运维·学习
自由的dream7 小时前
Linux的桌面
linux
xiaozhiwise8 小时前
Makefile 之 自动化变量
linux
意疏10 小时前
【Linux 篇】Docker 的容器之海与镜像之岛：于 Linux 系统内探索容器化的奇妙航行
linux·docker
BLEACH－heiqiyihu10 小时前
RedHat7—Linux中kickstart自动安装脚本制作
linux·运维·服务器
一只爱撸猫的程序猿10 小时前
一个简单的Linux 服务器性能优化案例
linux·mysql·nginx
我的K840911 小时前
Flink整合Hudi及使用
linux·服务器·flink
19004312 小时前
linux6:常见命令介绍
linux·运维·服务器
热门推荐
01(欧拉)openEuler系统添加网卡文件配置流程、(欧拉)openEuler系统手动配置ipv6地址流程、(欧拉)openEuler系统网络管理说明02PyTorch机器学习实现液态神经网络03【HarmonyOS】HUAWEI DevEco Studio 下载地址汇总04玄机平台应急响应—webshell查杀05Coze扣子平台完整体验和实践（附国内和国际版对比）06Ubuntu 20.04使用Livox mid 360 测试 FAST_LIO07【目标跟踪】相机运动补偿08Unity中PICO实现 隔空取物 和 接触抓取物体09RAG 实践- Ollama+RagFlow 部署本地知识库10怎样让音频速度变慢？请跟随以下方法进行操作