Attachment 22180 Details for Bug 60521 – Инструкция по серверу и клиенту, писал для себя.

Инструкция по серверу и клиенту, писал для себя.

step-ca_0.30.6_setup_ALT.md (text/markdown), 15.89 KB, created by Anton Shevtsov on 2026-09-14 11:45:58 MSK

(hide)

Description:

Filename:

MIME Type:

Creator: Anton Shevtsov

Created: 2026-09-14 11:45:58 MSK

Size: 15.89 KB

patch

obsolete

># ÐÐ°ÑÑÑÐ¾Ð¹ÐºÐ° Ð²Ð½ÑÑÑÐµÐ½Ð½ÐµÐ³Ð¾ CA Ð½Ð° step-ca 0.30.6
>
>## ÐÑÑÐ¾Ð´Ð½ÑÐµ Ð´Ð°Ð½Ð½ÑÐµ
>
>- CA: `ca.iac.sud.rf`
>- IP CA: `192.168.250.10`
>- API CA: `https://ca.iac.sud.rf:9000`
>- DNS-Ð·Ð¾Ð½Ð°: `iac.sud.rf`
>- ÐÐ»Ð¸ÐµÐ½Ñ: `web01.iac.sud.rf`
>- `step-ca`: 0.30.6
>- `step-cli`: 0.30.6
>- ÐÐ¡: ALT Linux
>- ACME provisioner: `acme`
>
>Ð¦ÐµÐ»Ñ: ÑÐ°Ð·Ð²ÐµÑÐ½ÑÑÑ Ð²Ð½ÑÑÑÐµÐ½Ð½Ð¸Ð¹ CA Ð´Ð»Ñ ÑÐµÐ½ÑÑÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð½Ð¾Ð¹ Ð²ÑÐ´Ð°ÑÐ¸ TLS-ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¾Ð² Ð²ÐµÐ±-ÑÐµÑÐ²ÐµÑÐ°Ð¼.
>
>ACME challenge Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½ Ð´Ð²ÑÐ¼Ñ ÑÐ¿Ð¾ÑÐ¾Ð±Ð°Ð¼Ð¸ 
>
>1. HTTP-01
>
>ÐÐ»Ð¸ÐµÐ½Ñ ÑÐ¾Ð·Ð´Ð°ÐµÑ /.well-known/acme-challenge/... Ð¸ CA ÑÐµÑÐ²ÐµÑ ÑÐ°Ð¼ Ð¾Ð±ÑÐ°ÑÐ°ÐµÑÑÑ Ðº ÐºÐ»Ð¸ÐµÐ½ÑÑ Ð¿Ð¾ http Ð´Ð»Ñ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ¸
>
>2. DNS
>
>Ð dns ÑÐ¾Ð·Ð´Ð°ÐµÑÑÑ TXT Ð·Ð°Ð¿Ð¸ÑÑ Ð²Ð¸Ð´Ð° _acme-challenge.web01.iac.sud.rf Ð² ÐºÐ¾ÑÐ¾ÑÐ¾Ð¼ Ð±ÑÐ´ÐµÑ ÑÐ¾ÐºÐµÐ½ Ð´Ð»Ñ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ¸ Ð¿ÑÐ°Ð² Ð½Ð° Ð¸Ð¼Ñ. Ð¢ÑÐµÐ±ÑÐµÑÑÑ Ð¿Ð¾Ð»Ð½Ð¾ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»ÑÐ½ÑÐ¹ ACME ÐºÐ»Ð¸ÐµÐ½Ñ. 
>
>ÐÐ¾ÐºÐ° Ð¾Ð¿Ð¸ÑÑ http-01.
> 
>
>## ÐÑÐµÐ´Ð²Ð°ÑÐ¸ÑÐµÐ»ÑÐ½ÑÐµ ÑÐ°Ð³Ð¸
>
>Ð£ÑÑÐ°Ð½Ð¾Ð²Ð¸ÑÑ Ð½Ð° CA ÑÐµÑÐ²ÐµÑÐ° rpm
>
>```
>[root@ca ~]# wget {https://dl.smallstep.com/gh-release/cli/gh-release-header/v0.30.6/step-cli-0.30.6-1.x86_64.rpm,https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca-0.30.2-1.x86_64.rpm}
>```
>
>rpm Ð½Ðµ Ð¸Ð¼ÐµÑÑ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼ Ð² ÐÐ¡ Ð°Ð»ÑÑ, ÐºÑÐ¾Ð¼Ðµ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ "ÑÑÐ¶Ð´Ð¾Ð³Ð¾" Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° Ð°Ð»ÑÑÐµÑÐ½Ð°ÑÐ¸Ð². ÐÐ¾Ð¶Ð½Ð¾ ÑÐ¾Ð·Ð´Ð°ÑÑ ÑÑÐºÐ°Ð¼Ð¸ ÑÐ¸Ð¼Ð»Ð¸Ð½Ðº, Ð¿Ð¾ÑÐ»Ðµ ÑÑÑÐ°Ð½Ð¾Ð²ÐºÐ¸
>
>```
>[root@ca ~]# ln -s /usr/bin/step-cli /usr/bin/step
>```
>
>ÐÐ° ÐºÐ»Ð¸ÐµÐ½ÑÐ°Ñ Ð´Ð¾ÑÑÐ°ÑÐ¾ÑÐ½Ð¾ Ð¿Ð°ÐºÐµÑÐ° ÑÐ¾Ð»ÑÐºÐ¾ `step-cli` (Ð»Ð¸Ð±Ð¾ Ð»ÑÐ±Ð¾Ð³Ð¾ Ð´ÑÑÐ³Ð¾Ð³Ð¾ `ACME` ÐºÐ»Ð¸ÐµÐ½ÑÐ° - `certbot`, `acme.sh` Ð¸ Ñ.Ð´.)
>
>---
>
># Ð§Ð°ÑÑÑ 1. Ð£ÑÑÐ°Ð½Ð¾Ð²ÐºÐ° Ð¸ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ° CA
>
>## 1. ÐÐ°ÑÑÑÐ¾Ð¸ÑÑ DNS
>
>Ð DNS ÑÐ¾Ð·Ð´Ð°ÑÑ Ð·Ð°Ð¿Ð¸ÑÑ:
>
>```text
>ca.iac.sud.rf.    A    192.168.250.10
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>getent hosts ca.iac.sud.rf
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ:
>
>```text
>192.168.250.10 ca.iac.sud.rf
>```
>
>---
>
>## 2. Ð¡Ð¾Ð·Ð´Ð°ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ð³Ð¾ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ Ð¸ ÐºÐ°ÑÐ°Ð»Ð¾Ð³ CA
>
>Ð¡Ð¾Ð·Ð´Ð°ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ð³Ð¾ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ:
>
>```bash
>useradd --system \
>    --home-dir /etc/step-ca \
>    --shell /usr/sbin/nologin \
>    step
>```
>
>Ð¡Ð¾Ð·Ð´Ð°ÑÑ ÐºÐ°ÑÐ°Ð»Ð¾Ð³:
>
>```bash
>mkdir -p /etc/step-ca
>```
>
>ÐÐ°Ð·Ð½Ð°ÑÐ¸ÑÑ Ð²Ð»Ð°Ð´ÐµÐ»ÑÑÐ°:
>
>```bash
>chown step:step /etc/step-ca
>chmod 700 /etc/step-ca
>```
>
>ÐÐ»Ñ ÑÐ°Ð±Ð¾ÑÑ Ð¾Ñ Ð¸Ð¼ÐµÐ½Ð¸ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ `step` Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÑ Ð¸Ð¼ÐµÐ½Ð½Ð¾:
>
>```bash
>su - -s /bin/bash step
>```
>
>ÐÐ°Ð¶Ð½Ð¾: Ð½ÑÐ¶ÐµÐ½ `-`, ÑÑÐ¾Ð±Ñ Ð¿Ð¾Ð»ÑÑÐ¸ÑÑ Ð¾ÐºÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ `step`, Ð² ÑÐ°ÑÑÐ½Ð¾ÑÑÐ¸ ÐºÐ¾ÑÑÐµÐºÑÐ½ÑÐ¹ `HOME=/etc/step-ca`.
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>echo "$HOME"
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ:
>
>```text
>/etc/step-ca
>```
>
>---
>
>## 3. Ð¡Ð¾Ð·Ð´Ð°ÑÑ ÑÐ°Ð¹Ð»Ñ Ð¿Ð°ÑÐ¾Ð»ÐµÐ¹ Ð´Ð»Ñ ÑÐ»ÑÐ¶Ð±Ñ CA
>
>Ð¡Ð¾Ð·Ð´Ð°ÑÑ ÑÐ°Ð¹Ð»Ñ:
>
>```bash
>install -o step -g step -m 600 /dev/null /etc/step-ca/password
>install -o step -g step -m 600 /dev/null /etc/step-ca/provisioner-password
>```
>
>Ð¡Ð³ÐµÐ½ÐµÑÐ¸ÑÐ¾Ð²Ð°ÑÑ ÑÐ»ÑÑÐ°Ð¹Ð½ÑÐµ Ð¿Ð°ÑÐ¾Ð»Ð¸:
>
>```bash
>openssl rand -base64 32 > /etc/step-ca/password
>openssl rand -base64 32 > /etc/step-ca/provisioner-password
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ Ð¿ÑÐ°Ð²Ð°:
>
>```bash
>ls -l /etc/step-ca/password /etc/step-ca/provisioner-password
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ:
>
>```text
>-rw------- 1 step step ...
>```
>
>---
>
>## 4. ÐÐ½Ð¸ÑÐ¸Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ CA
>
>ÐÐµÑÐµÐºÐ»ÑÑÐ¸ÑÑÑÑ Ð½Ð° Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ `step`:
>
>```bash
>su - -s /bin/bash step
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ HOME:
>
>```bash
>echo "$HOME"
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ:
>
>```text
>/etc/step-ca
>```
>
>ÐÐ°Ð´Ð°ÑÑ `STEPPATH`:
>
>```bash
>export STEPPATH=/etc/step-ca
>```
>
>ÐÐ°Ð¿ÑÑÑÐ¸ÑÑ Ð¸Ð½Ð¸ÑÐ¸Ð°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ:
>
>```bash
>step ca init \
>    --name "SUD Internal CA" \
>    --dns ca.iac.sud.rf \
>    --address :9000 \
>    --provisioner admin \
>    --password-file /etc/step-ca/password \
>    --provisioner-password-file /etc/step-ca/provisioner-password \
>    --acme
>```
>
>Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð´Ð¾Ð»Ð¶Ð½Ñ Ð±ÑÑÑ ÑÐ¾Ð·Ð´Ð°Ð½Ñ:
>
>```text
>/etc/step-ca/certs/root_ca.crt
>/etc/step-ca/certs/intermediate_ca.crt
>/etc/step-ca/config/ca.json
>/etc/step-ca/config/defaults.json
>/etc/step-ca/db/
>/etc/step-ca/secrets/root_ca_key
>/etc/step-ca/secrets/intermediate_ca_key
>/etc/step-ca/password
>/etc/step-ca/provisioner-password
>```
>
>ÐÑÐ¸ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ð¸ `--acme` ÑÐ¾Ð·Ð´Ð°ÑÑÑÑ ACME provisioner Ñ Ð¸Ð¼ÐµÐ½ÐµÐ¼ `acme`. ÐÐ°Ð¼ ÑÑÐ¾ Ð²Ð°Ð¶Ð½Ð¾!
>
>---
>
>## 5. ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÑÐ¾Ð·Ð´Ð°Ð½Ð½ÑÐµ ÑÐ°Ð¹Ð»Ñ
>
>ÐÐ°ÑÐ¾Ð´ÑÑÑ Ð¿Ð¾Ð´ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¼ `step`:
>
>```bash
>ls -l /etc/step-ca/config/
>ls -l /etc/step-ca/certs/
>```
>
>ÐÐ¾Ð»Ð¶Ð½Ñ Ð¿ÑÐ¸ÑÑÑÑÑÐ²Ð¾Ð²Ð°ÑÑ ÐºÐ°Ðº Ð¼Ð¸Ð½Ð¸Ð¼ÑÐ¼:
>
>```text
>ca.json
>defaults.json
>root_ca.crt
>intermediate_ca.crt
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÐºÐ°ÑÐ°Ð»Ð¾Ð³ Ð±Ð°Ð·Ñ:
>
>```bash
>ls -ld /etc/step-ca/db
>```
>
>---
>
>## 6. ÐÐ¾Ð»ÑÑÐ¸ÑÑ fingerprint ÐºÐ¾ÑÐ½ÐµÐ²Ð¾Ð³Ð¾ CA
>
>```bash
>step certificate fingerprint /etc/step-ca/certs/root_ca.crt
>```
>
>**ÐÐ°Ð¶Ð½Ð¾! Ð¡Ð¾ÑÑÐ°Ð½Ð¸ÑÑ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð½ÑÐ¹ fingerprint. ÐÐ½ Ð¿Ð¾ÑÑÐµÐ±ÑÐµÑÑÑ Ð¿ÑÐ¸ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐµ ÐºÐ»Ð¸ÐµÐ½ÑÐ¾Ð².**
>
>ÐÑÐ¸Ð¼ÐµÑ:
>
>```text
>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>```
>
>---
>
>## 7. ÐÐµÑÐ²ÑÐ¹ ÑÑÑÐ½Ð¾Ð¹ Ð·Ð°Ð¿ÑÑÐº CA
>
>ÐÐ° CA-ÑÐµÑÐ²ÐµÑÐµ, Ð¾Ñ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ `step`:
>
>```bash
>export STEPPATH=/etc/step-ca
>```
>
>ÐÐ°Ð¿ÑÑÑÐ¸ÑÑ:
>
>```bash
>step-ca \
>    /etc/step-ca/config/ca.json \
>    --password-file /etc/step-ca/password
>```
>
>ÐÑÐ¾ÑÐµÑÑ Ð±ÑÐ´ÐµÑ ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð² ÑÐµÐºÑÑÐµÐ¼ ÑÐµÑÐ¼Ð¸Ð½Ð°Ð»Ðµ.
>
>Ð Ð´ÑÑÐ³Ð¾Ð¼ ÑÐµÑÐ¼Ð¸Ð½Ð°Ð»Ðµ Ð¿ÑÐ¾Ð²ÐµÑÐ¸ÑÑ API:
>
>```bash
>curl -k https://ca.iac.sud.rf:9000/health
>```
>
>Ð¢Ð°ÐºÐ¶Ðµ Ð¼Ð¾Ð¶Ð½Ð¾ Ð¿ÑÐ¾Ð²ÐµÑÐ¸ÑÑ root endpoint:
>
>```bash
>curl -k https://ca.iac.sud.rf:9000/roots
>```
>
>ÐÑÐ»Ð¸ API Ð´Ð¾ÑÑÑÐ¿ÐµÐ½, Ð¿ÐµÑÐµÑÐ¾Ð´Ð¸ÑÑ Ð´Ð°Ð»ÑÑÐµ.
>
>ÐÐ°Ð¶Ð½Ð¾: ÐÐ»ÑÑ `-k` Ð³Ð¾Ð²Ð¾ÑÐ¸Ñ **Ð¸Ð³Ð½Ð¾ÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ð¸** Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼ ÑÐ²ÑÐ·Ð°Ð½Ð½ÑÑ Ñ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¾Ð¼, Ð½Ðµ Ð¿ÑÐ¾Ð²ÐµÑÑÑÑ ÐºÑÐ¾ ÐµÐ³Ð¾ Ð²ÑÐ´Ð°Ð».
>
>---
>
>## 8. ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ provisioner'Ñ
>
>ÐÑÐ¾Ñ Ð¿ÑÐ½ÐºÑ Ð²ÑÐ¿Ð¾Ð»Ð½ÑÐµÑÑÑ ÑÐ¾Ð»ÑÐºÐ¾ Ð¿Ð¾ÑÐ»Ðµ Ð·Ð°Ð¿ÑÑÐºÐ° CA.
>
>Ð Ð´ÑÑÐ³Ð¾Ð¼ ÑÐµÑÐ¼Ð¸Ð½Ð°Ð»Ðµ:
>
>```bash
>STEPPATH=/etc/step-ca step ca provisioner list
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ Ð½Ð°Ð»Ð¸ÑÐ¸Ðµ Ð´Ð²ÑÑ provisioner'Ð¾Ð²:
>
>```text
>admin
>acme
>```
>
>ÐÑÐ¸Ð¼ÐµÑ:
>
>```json
>[
>  {
>    "type": "JWK",
>    "name": "admin"
>  },
>  {
>    "type": "ACME",
>    "name": "acme"
>  }
>]
>```
>
>ÐÐ°Ð¶Ð½Ð¾: Ð¾ÑÑÑÑÑÑÐ²Ð¸Ðµ ÑÑÑÐ¾ÐºÐ¸ `/acme/acme/directory` Ð² Ð²ÑÐ²Ð¾Ð´Ðµ ÑÑÐ¾Ð¹ ÐºÐ¾Ð¼Ð°Ð½Ð´Ñ ÑÐ²Ð»ÑÐµÑÑÑ Ð½Ð¾ÑÐ¼Ð°Ð»ÑÐ½ÑÐ¼. `step ca provisioner list` Ð¿Ð¾ÐºÐ°Ð·ÑÐ²Ð°ÐµÑ provisioner'Ñ, Ð° Ð½Ðµ URL ACME directory.
>
>---
>
>## 9. Ð¡Ð¾Ð·Ð´Ð°ÑÑ systemd unit
>
>ÐÑÑÐ°Ð½Ð¾Ð²Ð¸ÑÑ ÑÑÑÐ½Ð¾Ð¹ Ð·Ð°Ð¿ÑÑÐº `step-ca` Ð¿Ð¾ÑÐ»Ðµ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ¸.
>
>Ð¡Ð¾Ð·Ð´Ð°ÑÑ:
>
>```text
>/etc/systemd/system/step-ca.service
>```
>
>Ð¡Ð¾Ð´ÐµÑÐ¶Ð¸Ð¼Ð¾Ðµ:
>
>```ini
>[Unit]
>Description=step-ca Certificate Authority
>Documentation=https://smallstep.com/docs/step-ca/
>After=network-online.target
>Wants=network-online.target
>
>[Service]
>Type=simple
>User=step
>Group=step
>Environment=STEPPATH=/etc/step-ca
>
>ExecStart=/usr/bin/step-ca \
>    /etc/step-ca/config/ca.json \
>    --password-file /etc/step-ca/password
>
>Restart=on-failure
>RestartSec=5
>PrivateTmp=true
>
>[Install]
>WantedBy=multi-user.target
>```
>
>
>---
>
>## 10. ÐÐ°Ð¿ÑÑÑÐ¸ÑÑ CA ÑÐµÑÐµÐ· systemd
>
>```bash
>systemctl daemon-reload
>```
>
>ÐÐºÐ»ÑÑÐ¸ÑÑ Ð°Ð²ÑÐ¾Ð·Ð°Ð¿ÑÑÐº:
>
>```bash
>systemctl enable step-ca
>```
>
>ÐÐ°Ð¿ÑÑÑÐ¸ÑÑ:
>
>```bash
>systemctl start step-ca
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>systemctl status step-ca
>```
>
>ÐÑÑÐ½Ð°Ð»:
>
>```bash
>journalctl -u step-ca -b
>```
>
>Ð¡Ð»ÐµÐ´Ð¸ÑÑ Ð·Ð° Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð¼:
>
>```bash
>journalctl -u step-ca -f
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ API:
>
>```bash
>curl https://ca.iac.sud.rf:9000/health
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ ACME directory:
>
>```bash
>curl https://ca.iac.sud.rf:9000/acme/acme/directory
>```
>
>ÐÑÐ»Ð¸ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÐ¹ trust store ÐºÐ»Ð¸ÐµÐ½ÑÐ°/ÑÐµÑÐ²ÐµÑÐ° ÐµÑÑ Ð½Ðµ ÑÐ¾Ð´ÐµÑÐ¶Ð¸Ñ root CA, Ð´Ð»Ñ Ð²ÑÐµÐ¼ÐµÐ½Ð½Ð¾Ð¹ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ¸ Ð¼Ð¾Ð¶Ð½Ð¾ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÑ:
>
>```bash
>curl -k https://ca.iac.sud.rf:9000/acme/acme/directory
>```
>
>Ð Ð¾ÑÐ²ÐµÑ Ð´Ð¾Ð»Ð¶ÐµÐ½ Ð¿ÑÐ¸Ð¹ÑÐ¸ JSON ACME directory Ñ endpoint'Ð°Ð¼Ð¸ Ð²ÑÐ¾Ð´Ðµ `newNonce`, `newAccount`, `newOrder` Ð¸ Ñ. Ð¿.
>
>---
>
># Ð§Ð°ÑÑÑ 2. ÐÐ°ÑÑÑÐ¾Ð¹ÐºÐ° ÐºÐ»Ð¸ÐµÐ½ÑÐ° web01
>
>ÐÑÑÐ¾Ð´Ð½ÑÐµ Ð´Ð°Ð½Ð½ÑÐµ ÐºÐ»Ð¸ÐµÐ½ÑÐ°:
>
>```text
>[root@web01] hostname
>web01.iac.sud.rf
>```
>
>---
>
>## 11. ÐÐ¾Ð»ÑÑÐ¸ÑÑ fingerprint ÐºÐ¾ÑÐ½ÐµÐ²Ð¾Ð³Ð¾ CA
>
>Fingerprint ÑÐ¶Ðµ Ð±ÑÐ» Ð¿Ð¾Ð»ÑÑÐµÐ½ Ð½Ð° CA Ð² Ð¿ÑÐ½ÐºÑÐµ 6.
>
>ÐÑÐ»Ð¸ Ð½ÑÐ¶Ð½Ð¾ Ð¿Ð¾Ð»ÑÑÐ¸ÑÑ Ð¿Ð¾Ð²ÑÐ¾ÑÐ½Ð¾ Ð½Ð° CA:
>
>```bash
>step certificate fingerprint /etc/step-ca/certs/root_ca.crt
>```
>
>Ð¡Ð¾ÑÑÐ°Ð½Ð¸ÑÑ Ð·Ð½Ð°ÑÐµÐ½Ð¸Ðµ:
>
>```text
>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>```
>
>---
>
>## 12. ÐÐ¾Ð»ÑÑÐ¸ÑÑ root CA Ð½Ð° web01 Ð¸ ÑÑÑÐ°Ð½Ð¾Ð²Ð¸ÑÑ ÐµÐ³Ð¾ Ð² ALT Linux
>
>ÐÐ° `web01` Ð¿Ð¾Ð»ÑÑÐ¸ÑÑ root certificate Ð² ÑÐ°Ð¹Ð»:
>
>```bash
>step ca root /tmp/ca-root.crt \
>    --ca-url https://ca.iac.sud.rf:9000 \
>    --fingerprint 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ:
>
>```bash
>openssl x509 \
>    -in /tmp/ca-root.crt \
>    -noout \
>    -subject \
>    -issuer \
>    -fingerprint \
>    -sha256
>```
>
>ÐÐ»Ñ ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ð³Ð¾ trust store Ð² ÐÐ¡ ÐÐ»ÑÑ ÑÑÑÐ°Ð½Ð¾Ð²Ð¸ÑÑ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ:
>
>```bash
>cp /tmp/ca-root.crt /etc/pki/ca-trust/source/anchors/
>update-ca-trust
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>trust list | grep -A 5 -B 2 'SUD Internal CA'
>```
>
>---
>
>## 13. Bootstrap step-cli Ð½Ð° web01
>
>ÐÐ°ÑÑÑÐ¾Ð¸ÑÑ `step-cli` Ð´Ð»Ñ ÑÐ°Ð±Ð¾ÑÑ Ñ Ð½Ð°ÑÐ¸Ð¼ CA:
>
>```bash
>step ca bootstrap \
>    --ca-url https://ca.iac.sud.rf:9000 \
>    --fingerprint 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
>```
>
>ÐÐ¾ÑÐ»Ðµ ÑÑÐ¾Ð³Ð¾ Ð² Ð´Ð¾Ð¼Ð°ÑÐ½ÐµÐ¼ ÐºÐ°ÑÐ°Ð»Ð¾Ð³Ðµ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ Ð´Ð¾Ð»Ð¶ÐµÐ½ Ð¿Ð¾ÑÐ²Ð¸ÑÑÑÑ ÐºÐ°ÑÐ°Ð»Ð¾Ð³:
>
>```text
>~/.step/
>```
>
>Ð¡ÑÐµÐ´Ð¸ Ð¿ÑÐ¾ÑÐµÐ³Ð¾:
>
>```text
>~/.step/certs/root_ca.crt
>~/.step/config/defaults.json
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>cat ~/.step/config/defaults.json
>```
>
>Ð ÐºÐ¾Ð½ÑÐ¸Ð³ÑÑÐ°ÑÐ¸Ð¸ Ð´Ð¾Ð»Ð¶Ð½Ñ Ð±ÑÑÑ ÑÐºÐ°Ð·Ð°Ð½Ñ URL CA Ð¸ fingerprint ÐºÐ¾ÑÐ½ÐµÐ²Ð¾Ð³Ð¾ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ°.
>
>---
>
>## 14. ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ CA Ð¸ ACME provisioner
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ Ð´Ð¾ÑÑÑÐ¿Ð½Ð¾ÑÑÑ CA:
>
>```bash
>step ca health
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ provisioner'Ñ:
>
>```bash
>step ca provisioner list
>```
>
>ÐÐ¾Ð»Ð¶ÐµÐ½ Ð¿ÑÐ¸ÑÑÑÑÑÐ²Ð¾Ð²Ð°ÑÑ:
>
>```text
>admin
>acme
>```
>
>ÐÑÐ¸Ð¼ÐµÑ:
>
>```json
>[
>  {
>    "type": "JWK",
>    "name": "admin"
>  },
>  {
>    "type": "ACME",
>    "name": "acme"
>  }
>]
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ Ð½ÐµÐ¿Ð¾ÑÑÐµÐ´ÑÑÐ²ÐµÐ½Ð½Ð¾ ACME directory:
>
>```bash
>curl https://ca.iac.sud.rf:9000/acme/acme/directory
>```
>
>ÐÑÐ»Ð¸ Ð´Ð¾Ð²ÐµÑÐ¸Ðµ Ðº CA ÐµÑÑ Ð½Ðµ Ð½Ð°ÑÑÑÐ¾ÐµÐ½Ð¾, Ð²ÑÐµÐ¼ÐµÐ½Ð½Ð¾:
>
>```bash
>curl -k https://ca.iac.sud.rf:9000/acme/acme/directory
>```
>
>ÐÐ°Ð¶Ð½Ð¾: ÐºÐ¾Ð¼Ð°Ð½Ð´Ð°:
>
>```bash
>step ca provisioner list
>```
>
>ÑÐ°Ð¼Ð° Ð¿Ð¾ ÑÐµÐ±Ðµ Ð½Ðµ Ð´Ð¾Ð»Ð¶Ð½Ð° ÑÐ¾Ð´ÐµÑÐ¶Ð°ÑÑ ÑÑÑÐ¾ÐºÑ:
>
>```text
>/acme/acme/directory
>```
>
>ÐÑÐ¾ Ð¾ÑÐ´ÐµÐ»ÑÐ½ÑÐ¹ HTTP endpoint ACME.
>
>---
>
>## 15. ÐÐ¾Ð»ÑÑÐ¸ÑÑ Ð¿ÐµÑÐ²ÑÐ¹ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ ÑÐµÑÐµÐ· ACME
>
>ÐÐµÑÐµÐ´ Ð·Ð°Ð¿ÑÑÐºÐ¾Ð¼ ÑÐ±ÐµÐ´Ð¸ÑÑÑÑ, ÑÑÐ¾ DNS ÐºÐ»Ð¸ÐµÐ½ÑÐ° Ð½Ð°ÑÑÑÐ¾ÐµÐ½.
>
>ÐÐ° `web01`:
>
>```bash
>getent hosts web01.iac.sud.rf
>```
>
>ÐÐ¾Ð»Ð¶ÐµÐ½ Ð²Ð¾Ð·Ð²ÑÐ°ÑÐ°ÑÑÑÑ IP ÑÐ°Ð¼Ð¾Ð³Ð¾ `web01`.
>
>ÐÐ°Ð¿ÑÐ¸Ð¼ÐµÑ:
>
>```text
>192.168.250.20 web01.iac.sud.rf
>```
>
>ÐÐ°ÑÐµÐ¼ Ñ CA-ÑÐµÑÐ²ÐµÑÐ° ÑÐ°ÐºÐ¶Ðµ Ð¿ÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>getent hosts web01.iac.sud.rf
>```
>
>CA Ð´Ð¾Ð»Ð¶ÐµÐ½ ÑÐ°Ð·ÑÐµÑÐ°ÑÑ Ð¸Ð¼Ñ `web01.iac.sud.rf` Ð² Ð°Ð´ÑÐµÑ web01.
>
>### ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ Ð¿Ð¾ÑÑ 80
>
>ÐÐ° `web01`:
>
>```bash
>ss -lntp | grep ':80'
>```
>
>ÐÐ»Ñ Ð¿ÐµÑÐ²Ð¾Ð³Ð¾ ÑÐµÑÑÐ° Ð¿ÑÐµÐ´Ð¿Ð¾Ð»Ð°Ð³Ð°ÐµÑÑÑ, ÑÑÐ¾ Ð¿Ð¾ÑÑ 80 ÑÐ²Ð¾Ð±Ð¾Ð´ÐµÐ½.
>
>ÐÐ¾Ð»ÑÑÐ¸ÑÑ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ:
>
>```bash
>step ca certificate \
>    web01.iac.sud.rf \
>    web01-acme.crt \
>    web01-acme.key \
>    --provisioner acme \
>    --standalone
>```
>
>ÐÑÐ¸ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ð¸ standalone mode `step` Ð²ÑÐµÐ¼ÐµÐ½Ð½Ð¾ Ð¿Ð¾Ð´Ð½Ð¸Ð¼Ð°ÐµÑ HTTP-ÑÐµÑÐ²ÐµÑ Ð½Ð° TCP/80 Ð´Ð»Ñ ACME HTTP-01 challenge. 
>
>ÐÑÐ¾Ñ ÑÐµÑÑ Ð¸Ð¼ÐµÐ½Ð½Ð¾ Ð´Ð»Ñ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ¸ Ñ.Ðº. Ð¿ÑÐ¸ Ð½Ð°Ð»Ð¸ÑÐ¸Ð¸ ÑÐµÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ web ÑÐµÑÐ²ÐµÑÐ°, Ð±ÑÐ´ÐµÑ ÐºÐ¾Ð½ÑÐ»Ð¸ÐºÑ Ð¿Ð¾ÑÑÐ¾Ð².
>
>Ð ÐµÐ·ÑÐ»ÑÑÐ°Ñ Ð±ÑÐ´ÐµÑ Ð¿ÑÐ¸Ð¼ÐµÑÐ½Ð¾ ÑÐ°ÐºÐ¸Ð¼
>```
>[root@web01 anchors]# step ca certificate \
>    web01.iac.sud.rf \
>    web01-acme.crt \
>    web01-acme.key \
>    --standalone \
>    --provisioner acme
>â Provisioner: acme (ACME)
>Using Standalone Mode HTTP challenge to validate web01.iac.sud.rf . done!
>Waiting for Order to be 'ready' for finalization .. done!
>Finalizing Order .. done!
>â Certificate: web01-acme.crt
>â Private Key: web01-acme.key
>```
>
>Ð ÑÐµÐºÑÑÐµÐ¹ Ð¿Ð°Ð¿ÐºÐµ Ð±ÑÐ´ÑÑ ÑÐ¾Ð·Ð´Ð°Ð½Ñ ÑÐ°Ð¹Ð»Ñ `web01-acme.*`
>
>---
>
>## 16. ÐÑÐ»Ð¸ Ð½Ð° web01 ÑÐ¶Ðµ ÑÐ°Ð±Ð¾ÑÐ°ÐµÑ nginx/apache
>
>ÐÑÐ»Ð¸ Ð¿Ð¾ÑÑ 80 ÑÐ¶Ðµ Ð·Ð°Ð½ÑÑ Ð²ÐµÐ±-ÑÐµÑÐ²ÐµÑÐ¾Ð¼, standalone mode Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÑ **Ð½ÐµÐ»ÑÐ·Ñ**.
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>ss -lntp | grep ':80'
>```
>
>Ð ÑÑÐ¾Ð¼ ÑÐ»ÑÑÐ°Ðµ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÑÑÑ webroot - Ð»Ð¾ÐºÐ°Ð»ÑÐ½Ð°Ñ Ð¿Ð°Ð¿ÐºÐ° ÑÐµÑÐ²ÐµÑÐ° Ð´Ð¾ÑÑÑÐ¿Ð½Ð° Ð¿Ð¾ http, Ð¾Ð±ÑÑÐ½Ð¾ ÑÑÐ¾ ÐºÐ¾ÑÐµÐ½Ñ ÑÐ°Ð¹ÑÐ°.
>
>Ð¡Ð¾Ð·Ð´Ð°ÑÑ ÐºÐ°ÑÐ°Ð»Ð¾Ð³:
>
>```bash
>mkdir -p /var/www/acme/.well-known/acme-challenge
>```
>
>ÐÐ°ÑÑÑÐ¾Ð¸ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ð¹ Ð²ÐµÐ±-ÑÐµÑÐ²ÐµÑ ÑÐ°Ðº, ÑÑÐ¾Ð±Ñ URL:
>
>```text
>http://web01.iac.sud.rf/.well-known/acme-challenge/
>```
>
>Ð¾Ð±ÑÐ»ÑÐ¶Ð¸Ð²Ð°Ð»ÑÑ Ð¸Ð·:
>
>```text
>/var/www/acme/.well-known/acme-challenge/
>```
>
>ÐÐ¾ÑÐ»Ðµ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ¸ webroot Ð¿Ð¾Ð»ÑÑÐ¸ÑÑ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ:
>
>```bash
>step ca certificate \
>    web01.iac.sud.rf \
>    web01-acme.crt \
>    web01-acme.key \
>    --provisioner acme \
>    --webroot /var/www/acme
>```
>
>Ð ÑÑÐ¾Ð¼ ÑÐµÐ¶Ð¸Ð¼Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ð¹ nginx/apache Ð¾Ð±ÑÐ»ÑÐ¶Ð¸Ð²Ð°ÐµÑ ACME challenge, Ð° `step` Ð½Ðµ Ð¿ÑÑÐ°ÐµÑÑÑ Ð·Ð°Ð½ÑÑÑ Ð¿Ð¾ÑÑ 80.
>
>---
>
>## 17. ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ Ð²ÑÐ´Ð°Ð½Ð½ÑÐ¹ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ
>
>ÐÐ¾ÑÐ»Ðµ ÑÑÐ¿ÐµÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð¸Ñ Ð´Ð¾Ð»Ð¶Ð½Ñ Ð¿Ð¾ÑÐ²Ð¸ÑÑÑÑ:
>
>```text
>web01-acme.crt
>web01-acme.key
>```
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ:
>
>```bash
>ls -l web01-acme.crt web01-acme.key
>```
>
>ÐÐ¾ÑÐ¼Ð¾ÑÑÐµÑÑ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ:
>
>```bash
>step certificate inspect web01-acme.crt
>```
>
>ÐÐ»Ð¸:
>
>```bash
>openssl x509 \
>    -in web01-acme.crt \
>    -noout \
>    -subject \
>    -issuer \
>    -dates \
>    -ext subjectAltName
>```
>
>ÐÑÐ¶Ð½Ð¾ Ð¿ÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÐºÐ°Ðº Ð¼Ð¸Ð½Ð¸Ð¼ÑÐ¼:
>
>- Subject;
>- Issuer;
>- ÑÑÐ¾Ðº Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ;
>- SAN.
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ Ð½Ð°Ð»Ð¸ÑÐ¸Ðµ:
>
>```text
>DNS:web01.iac.sud.rf
>```
>
>---
>
>## 18. ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÑÐµÐ¿Ð¾ÑÐºÑ Ð´Ð¾Ð²ÐµÑÐ¸Ñ
>
>ÐÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°Ñ ÑÐµÑÐµÐ· `step`:
>
>```bash
>step certificate verify \
>    web01-acme.crt \
>    --roots /tmp/ca-root.crt
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ ÑÑÐ¿ÐµÑÐ½Ð°Ñ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ°.
>
>Ð¢Ð°ÐºÐ¶Ðµ Ð¼Ð¾Ð¶Ð½Ð¾ Ð¿ÑÐ¾Ð²ÐµÑÐ¸ÑÑ ÑÐµÑÐµÐ· OpenSSL:
>
>```bash
>openssl verify web01-acme.crt
>```
>
>ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ:
>
>```text
>web01-acme.crt: OK
>```
>
>ÐÑÐ¾ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ Ð¿Ð¾ÑÐ»Ðµ ÑÑÑÐ°Ð½Ð¾Ð²ÐºÐ¸ root CA Ð² ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ðµ ÑÑÐ°Ð½Ð¸Ð»Ð¸ÑÐµ ALT Linux:
>
>```bash
>cp /tmp/ca-root.crt /etc/pki/ca-trust/source/anchors/
>update-ca-trust
>```
>
>---
>
>
>## Ð§ÑÐ¾ Ð½Ð°ÑÑÑÐ¾ÐµÐ½Ð¾
>
>1. ÐÐ½ÑÑÑÐµÐ½Ð½Ð¸Ð¹ Root CA.
>2. Intermediate CA Ð´Ð»Ñ Ð²ÑÐ¿ÑÑÐºÐ° ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¾Ð².
>3. ACME provisioner `acme`.
>4. CA API Ð½Ð° `https://ca.iac.sud.rf:9000`.
>5. ÐÐ¾Ð²ÐµÑÐ¸Ðµ Ðº Root CA Ð² ALT Linux.
>6. ÐÐ»Ð¸ÐµÐ½Ñ `web01`, Ð½Ð°ÑÑÑÐ¾ÐµÐ½Ð½ÑÐ¹ ÑÐµÑÐµÐ· `step ca bootstrap`.
>7. ÐÑÐ´Ð°ÑÐ° TLS-ÑÐµÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ° ÑÐµÑÐµÐ· ACME.
>8. HTTP-01 challenge ÑÐµÑÐµÐ· Ð¿Ð¾ÑÑ 80.
>
>

Actions: View

Attachments on bug 60521: 22180