How to generate an SSL certificate

Sometimes we need tools that are not available in a pre-built image, such as the openssl command. In this article, I will quickly show how to build an image with openssl to generate a domain certificate running on our Kubernetes/OpenShift platform

First, let's create an image with the openssl package installed. Create the Dockerfile file anywhere and build the image:

FROM openshift/base-centos7
USER root
RUN yum install -y openssl && yum clean all
USER 1001

Now let's generate the image and push it to Docker Hub.

Note that you must be logged into your Docker Hub account. If you don't have one, create it at https://hub.docker.com/

Change the account name to your username — mine is "caruccio":

$ sudo docker build -t caruccio/openssl .
$ sudo docker push caruccio/openssl

Now we just need to create a Pod from this image. For this, we will use the "oc run" command and create a temporary Pod from the new container :

If you don't have a Getup account, create yours for free at https://getupcloud.com/pt-br/signup/ and configure your "oc" command-line client at https://ajuda.getupcloud.com/hc/pt-br/articles/221403968

$ oc run openssl --image=caruccio/openssl --stdin --tty --restart=Never --rm -- /bin/bash

This command drops us inside the container, running a bash shell where we can generate our certificate!

bash-4.2$ cd /tmp
bash-4.2$ openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

### Answer the questions...

bash-4.2$ ls -la yourdomain.*
-rw-r--r--. 1 1003910000 root 1110 Jan 23 17:24 yourdomain.csr
-rw-r--r--. 1 1003910000 root 1704 Jan 23 17:24 yourdomain.key

### To view the files:

bash-4.2$ cat yourdomain.csr
bash-4.2$ cat yourdomain.key

To exit the container, just run exit . This will delete the Pod automatically:

bash-4.2$ exit
exit
pod "openssl" deleted
$

Done! Now just submit the CSR to your certificate authority.