Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Script to generate Kafka keystores for SSL #955

Closed
wants to merge 2 commits into from
Closed

Script to generate Kafka keystores for SSL #955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
504c330
add script to generate kafka keystores
nasark Apr 9, 2023
7b8780a
remove kafka cert generation from cert_generator script
nasark Apr 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion tools/cert_generator.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,6 @@ def generate_cert(dest, *sans)

c = CertGenerator.new
c.generate_cert("httpd")
c.generate_cert("kafka")
c.generate_cert("memcached")
c.generate_cert("postgresql")

Expand Down
51 changes: 51 additions & 0 deletions tools/keystore_generator.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
#!/usr/bin/env bash

set -e

echo "Enter CA cert path:"
read CA_CERT_PATH

echo "Enter CA key path:"
read CA_KEY_PATH

echo "Set Keystore password:"
read KEYSTORE_PASS

if [ ! -e "$CA_CERT_PATH" ] || [ ! -e "$CA_KEY_PATH" ]; then
echo "CA does not exist, please provide the corrrect paths in CA_CERT_PATH and CA_KEY_PATH"
exit 1
fi

if [ -z "$KEYSTORE_PASS" ]; then
echo "Please provide a keystore password in KEYSTORE_PASS"
exit 1
fi
Comment on lines +19 to +22
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For security reasons we may want to read the password from STDIN.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated the script to now use read


# Generate truststore containing CA
keytool -keystore ./kafka.truststore.jks \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where does keytool come from?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

keytool comes with any Java distribution. I guess this means that the script assumes the user has Java on their system. Would this be an issue?

-alias CARoot -import -file $CA_CERT_PATH \
-noprompt -dname "CN=kafka" -keypass $KEYSTORE_PASS -storepass $KEYSTORE_PASS

# Generate keystore
keytool -keystore ./kafka.keystore.jks \
-alias kafka -validity 365 -genkey -keyalg RSA \
-noprompt -dname "CN=kafka" -keypass $KEYSTORE_PASS -storepass $KEYSTORE_PASS

# Create certificate signing request to keystore
keytool -keystore ./kafka.keystore.jks -alias kafka \
-certreq -file cert-sign-req -keypass $KEYSTORE_PASS -storepass $KEYSTORE_PASS

# Sign keystore's certificate using CA key
openssl x509 -req -CA $CA_CERT_PATH -CAkey $CA_KEY_PATH \
-in ./cert-sign-req -out cert-sign \
-days 365 -CAcreateserial

# Import CA into keystore
keytool -keystore ./kafka.keystore.jks -alias CARoot \
-import -file $CA_CERT_PATH -keypass $KEYSTORE_PASS -storepass $KEYSTORE_PASS -noprompt

# Import signed certificate back into keystore
keytool -keystore ./kafka.keystore.jks -alias kafka -import \
-file ./cert-sign -keypass $KEYSTORE_PASS -storepass $KEYSTORE_PASS

echo "Truststore and keystore have been successfully created"
Loading