Documentation and examples

[michael-px]

I'm looking at cfssl and using it to deliver a secure etcd cluster. I've been able, through much experimentation, to find the right combo of stuff to create certificates for peers. However, if I try to connect to a single etcd node with etcdctl, I need that node's cert, key, and the CA cert.

This is unworkable and won't scale for our application using etcd which will have to use these three files.

mkbundle is mentioned in the README here and my hope is that it will combine all the certs and keys plus the CA and create a single PEM file that can be used from anywhere to access any node in the cluster.

There's an example in the README and it seems straightforward. Is that all there is to it?

[kaarolch]

@kisom probably there is not only documentation problem. I just plan to create doc PR with cfsslbare example. O I create certs/root-ca.pem, request for test1234 cert and get cert (test1234.pem) and key (test123-key.pem) and after I run:

cfssl bundle -ca-bundle certs/root-ca.pem -cert test1234.pem -key test1234-key.pem -flavor force | cfssljson -stdout -bare

2018/07/18 22:03:00 [INFO] bundling certificate for {Country:[] Organization:[] OrganizationalUnit:[] Locality:[] Province:[] StreetAddress:[] PostalCode:[] SerialNumber: CommonName:test123 Names:[{Type:2.5.4.3 Value:test123}] ExtraNames:[]}
-----BEGIN RSA PRIVATE KEY-----
....
-----END RSA PRIVATE KEY-----

without stdout result are save to cert-key.pem.
When skip cfssljson certificate is bundling correctly:

2018/07/18 22:07:07 [INFO] bundling certificate for {Country:[] Organization:[] OrganizationalUnit:[] Locality:[] Province:[] StreetAddress:[] PostalCode:[] SerialNumber: CommonName:test123 Names:[{Type:2.5.4.3 Value:test123}] ExtraNames:[]}
{"bundle":"-----BEGIN CERTIFICATE-----\nMIIFcDCCA1igAwIBAgIUR....==\n-----END CERTIFICATE-----","crl_support":false,"crt":"-----BEGIN CERTIFICATE-----\nMIIFcDCCA.....-----END CERTIFICATE-----","expires":"2020-07-16T20:21:00Z","hostnames":["test123"],"issuer":"/Country=PL/Locality=Krakow/Organization=Example Company/OrganizationalUnit=Private PKI/CommonName=CA","key":"-----BEGIN RSA PRIVATE KEY-----\nMIIJKAIBAAKCAg.....-----END RSA PRIVATE KEY-----","key_size":4096,"key_type":"4096-bit RSA","leaf_expires":"2020-07-16T20:21:00Z","ocsp":null,"ocsp_support":false,"root":"","signature":"SHA512WithRSA","status":{"rebundled":false,"expiring_SKIs":null,"untrusted_root_stores":null,"messages":["The bundle contains certificates signed with advanced hash functions such as SHA2, which are problematic for certain operating systems, e.g. Windows XP SP2."],"code":2},"subject":"/CommonName=test123"}%                                         

Also I'm not sure why is % in the end.

@michael-px as I understand the first command provide result that you would like to get if it works?