====== TLS ======

==== ВВЕДЕНИЕ ====

В TLS используются два типа ключей - ''public'' и ''private''.


''private'' ключ всегда остается у владельца и не разглашается.
==== KEYS ====

  * Certificate (Public Key): *.crt, *.pem
  * Private Key: *.key, *-key.pem


==== OPENSSL ====

Generate a private key:
<code bash>
$ openssl genrsa -out my-bank.key 2048
</code>

Generate a public key (lock):
<code bash>
$ openssl rsa -in my-bank.key -pubout > mybank.pem
</code>

Request CSR (CSR is like a certificate but without a signature):
<code bash>
$ openssl req -new -key my-bank.key \ 
-out my-bank.csr -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=mydomain.com"
</code>

==== GENERATING CERTIFICATES FOR K8S ====

''CA''
<code bash>
$ openssl genrsa -out ca.key 2048     # Generate private key for CA
$ openssl req -new -key ca.key -subj "/CN=KUBERNETES-CA" -out ca.csr # Generate CSR
$ openssl x509 -req -in ca.csr -signkey ca.key -days 365 -out ca.crt    # Self sign using priv key
</code>


''Admin user''
<code bash>
$ openssl genrsa -out admin.key 2048 # Private key for Admin user
$ openssl req -new -key admin.key -subj "/CN=kube-admin" -out admin.csr # Generate CSR
$ openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key \ 
-set_serial 1000 -out admin.crt     # Sign using CA 
</code>

==== CHECKING CERTIFICATES ====
<code bash>
$ openssl x509 -noout -subject -in ca.crt      # Check CN in certificate
$ openssl req -text -noout -verify -in ca.csr  # Check CSR details 
$ openssl x509 -text -noout -in ca.crt         # Check certificate details
</code>