How to use the certificate and private key created by Docker's BASIC authentication with AWS ALB

at first

Follow the steps below.

  1. Create BASIC authentication on Amazon Linux with docker installed
  2. Start ALB using the private key and certificate issued by BASIC authentication

I would appreciate it if you could let me know if there are any mistakes in terms or recognition.

Step 1 Create BASIC authentication

First of all, rewrite subjectAltName on line 253 of openssl.cnf to the private address of the instance.

[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ sudoedit /etc/pki/tls/openssl.cnf

The following is what was displayed with cat after rewriting.

[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ cat -n /etc/pki/tls/openssl.cnf | head -n 255 | tail -n 5
   252  # Include email address in subject alt name: another PKIX recommendation
   254  # Copy issuer details
   255  # issuerAltName=issuer:copy

After that, create the following directories.

[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ mkdir certs

Create the above certificate (domain.crt) and private key (domain.key) in the above directory.

You will be prompted to enter your passphrase.

#### **`You will be prompted for a second time. Enter the same value.`**
```verifying - enter pem pass phrase

 This passphrase will no longer be used.

[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ openssl req -newkey rsa:2048 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt Generating a 2048 bit RSA private key ........................................................................................+++ ........+++ writing new private key to 'certs/domain.key' Enter PEM pass phrase: Verifying - Enter PEM pass phrase:

 The following are all blank and press enter.

Country Name (2 letter code) [XX]: State or Province Name (full name) []: Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []: Email Address []:

 In the following, go to the certs directory and delete the passphrase.
 If you do not do this, docker will fail to start with the following error: ``` msg =" tls: failed to parse private key "``` `

#### **`Now enter the passphrase.`**
```enter pass phrase for domain.key

[ec2-user@ip-xxx-xxx-xxx-xxx certs]$ openssl rsa -in domain.key -out new.key Enter pass phrase for domain.key: writing RSA key

 Copy the certificate.

[ec2-user@ip-xxx-xxx-xxx-xxx certs]$ sudo cp certs/domain.crt /etc/pki/ca-trust/source/anchors/


[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ sudo update-ca-trust enable [ec2-user@ip-xxx-xxx-xxx-xxx ~]$ sudo update-ca-trust [ec2-user@ip-xxx-xxx-xxx-xxx ~]$ sudo service docker restart

 Create a password.
 Enter the user name and password in username and password, respectively.

[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ docker run --entrypoint htpasswd registry:2.6.2 -Bbn username password > auth/htpasswd

 Start the container for the private registry.

[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ docker run -d -p 5000:5000
--name registry
-v pwd/auth:/auth
-v pwd/certs:/certs
-e "REGISTRY_AUTH=htpasswd"
-e "REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt"
-e "REGISTRY_HTTP_TLS_KEY=/certs/new.key"

 Make sure you can log in.

[ec2-user@ip-xxx-xxx-xxx-xxx certs]$ docker login Username: testuser Password: WARNING! Your password will be stored unencrypted in /home/ec2-user/.docker/config.json. Configure a credential helper to remove this warning. See

Login Succeeded

## Step 2 Start ALB

 Log in using aws-cli.
 The parts with the following access key XXX and secret access key YYY are
 You can check by clicking IAM → user → click authentication information.

[ec2-user@ip-xxx-xxx-xxx-xxx certs]$ aws configure AWS Access Key ID [None]: XXX AWS Secret Access Key [None]: YYY Default region name [None]: ap-northeast-1 Default output format [None]: json

 Go to the certs directory and upload your certificate to IAM.
 my-secret-sert will be the name of the certificate.

[ec2-user@ip-xxx-xxx-xxx-xxx certs]$ aws iam upload-server-certificate --server-certificate-name my-server-cert
--certificate-body file://domain.crt --private-key file://new.key

 ALB requires two subnets in your VPC. Once you've created them, go to the EC2 console screen and click on your load balancer.

 Select ALB.


 Select HTTPS.

 In the VPC selection, select the VPC and subnet created earlier.
 In the default certificate selection, select the uploaded certificate.


 Set the routing as follows.

 Registering a target allows you to register EC2 in the selected subnet with the target group.
 Check if it was created normally by the following message.


## Reference article
 --Creating a server certificate with OpenSSL
 --The story of uploading an SSL certificate to ELB while struggling

Recommended Posts

How to use the certificate and private key created by Docker's BASIC authentication with AWS ALB
How to use Java framework with AWS Lambda! ??
How to write test code with Basic authentication
[Java] How to get the key and value stored in Map by iterative processing
[ruby] How to assign a value to a hash by referring to the value and key of another hash
How to use RealSense with ubuntu 20.04 and ROS Noetic
[Ruby] How to get the value by specifying the key. Differences between hashes, symbols and fetch
How to use a foreign key with FactoryBot ~ Another solution
Uppercase only the specified range with substring. (How to use substring)
How to use PlantUML with Visual Studio Code (created on October 30, 2020)
[Rails] How to introduce kaminari with Slim and change the design
How to use MinIO with the same function as S3 Use docker-compose
How to encrypt and decrypt with RSA public key in Java
How to use the link_to method
How to use StringBurrer and Arrays.toString.
How to use the include? method
How to use the form_with method
How to use EventBus3 and ThreadMode
How to use the wrapper class
How to use equality and equality (how to use equals)
How to use mssql-tools with alpine
twitter-4 selections of certain errors with Twitter login function created by omniauth gem and how to deal with them
How to deploy to AWS using NUXTJS official S3 and CloudFront? With docker-compose
How to use args :, environment :, env_file: and .env files with docker-compose command
How to SSH into Ubuntu from a terminal with public key authentication
Use MyBatis to get Map with key as identifier and value as Entity
How to set tabs and spaces to be visible by using the tab key to insert spaces in Java files in Eclipse
How to use OrientJS and OrientDB together
[Java] How to use the File class
[Java] How to use the hasNext function
How to use BootStrap with Play Framework
[Rails] How to use rails console with docker
[Java] How to use the HashMap class
[Rails] How to use the map method
[Java] How to use the toString () method
Studying how to use the constructor (java)
[Processing × Java] How to use the loop
How to set up and use kapt
[Processing × Java] How to use the class
How to find the tens and ones
[Processing × Java] How to use the function
How to delete data with foreign key
How to test private scope with JUnit
How to use substring and substr methods
[Java] How to use the Calendar class
How to use @Builder and @NoArgsConstructor together
How to connect to lcalhost from your smartphone and use the app under development
How to use ToolBar with super margin Part1 Set characters and change colors
[Ruby] Learn how to use odd? Even? And count the even and odd numbers in the array!
[Rails6] How to connect the posting function generated by Scaffold with the user function generated by devise
How to use Eclipse on my PC with 32bit and 2GB of memory
How to share on the host side (windows) and guest side (CentOS 7) with VirtualBox
[Ruby] How to use the map method. How to process the value of an object and get it by hash or symbol.