Ambari Server 证书调试安装速记
### ambari-server 安装 也是前提。
dnf install -y ambari-server
### 生成 CSR
install -d -m 0755 /etc/pki/tls/certs /etc/pki/tls/private
chmod 0700 /etc/pki/tls/private
cat >/tmp/ambari-req.cnf <<'EOF'
[ req ]
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext
[ dn ]
CN = dev1.test.com
O = TEST.COM
[ req_ext ]
subjectAltName = @alt
[ alt ]
DNS.1 = dev1.test.com
EOF
### 生成私钥与 CSR
openssl req -new -nodes -newkey rsa:2048 \
-keyout /etc/pki/tls/private/ambari-server.key \
-out /tmp/ambari-server.csr \
-config /tmp/ambari-req.cnf
### 使用 FreeIPA 签发证书
ipa cert-request /tmp/ambari-server.csr \
--principal=HTTP/[email protected] \
--certificate-out=/etc/pki/tls/certs/ambari-server.crt
### 拼接 fullchain
cat /etc/pki/tls/certs/ambari-server.crt \
/etc/ipa/ca.crt \
> /etc/pki/tls/certs/ambari-server-fullchain.crt
ls -l /etc/pki/tls/certs/ambari-server-fullchain.crt
### 生成 keystore.p12
PASS="$(cat /var/lib/ambari-server/keys/pass.txt)"
openssl pkcs12 -export \
-in /etc/pki/tls/certs/ambari-server-fullchain.crt \
-inkey /etc/pki/tls/private/ambari-server.key \
-name ambari \
-out /var/lib/ambari-server/keys/keystore.p12 \
-passout pass:"$PASS"
cp -f /etc/ipa/ca.crt /var/lib/ambari-server/keys/ca.crt
chmod 0644 /var/lib/ambari-server/keys/ca.crt
### 重启服务
ambari-server restart
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66