harbor使用自签名证书实现https登录

1
2
3
4

mkdir /root/ca -p
cd /root/ca
#以下命令创建CA证书
openssl req  -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt

1

Common Name (eg, your name or your server's hostname) []:harbor.lhp.com

1
2
3

openssl req  -newkey rsa:4096 -nodes -sha256 -keyout harbor.lhp.com.key
一路回车出现Common Name 输入IP或域名
Common Name (eg, your name or your server's hostname) []:harbor.lhp.com

1
2
3
4
5
6
7

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:harbor.lhp.com
EOF

1
2
3
4
5

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.lhp.com.csr \
    -out harbor.lhp.com.crt

1
2
3
4
5

openssl x509 -inform PEM -in harbor.lhp.com.crt -out harbor.lhp.com.cert
mkdir -p /etc/docker/certs.d/
cp harbor.lhp.com.cert /etc/docker/certs.d/harbor.lhp.com/
cp harbor.lhp.com.key /etc/docker/certs.d/harbor.lhp.com/
cp ca.crt /etc/docker/certs.d/harbor.lhp.com/

1

/etc/init.d/docker restart 

1
2
3
4
5
6
7
8

#set hostname
hostname = harbor.lhp.com     #域名或ip
#set ui_url_protocol
uiurlprotocol = https    #这里改为https****
......
#The path of cert and key files for nginx, they are applied only the protocol is set to https
ssl_cert = /root/ca/harbor.lhp.com.crt     #crt位置
ssl_cert_key = /root/ca/harbor.lhp.com.key  #key的位置

1
2
3
4

#到harbor安装目录下更新配置文件
./prepare 
#启动harbor
docker-compose -f docker-compose.yml up -d

1
2
3
4

{
  "registry-mirrors": ["https://jliunkl7.mirror.aliyuncs.com"],
  "insecure-registries": ["harbor.lhp.com"]
}