Keshava keshavab

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

Moved to git-repository: https://github.com/denji/awesome-http-benchmark

Tools

Located in alphabetical order (not prefer)

ab – slow and single threaded, written in C
apib – most of the features of ApacheBench (ab), also designed as a more modern replacement, written in C
baloo – Expressive end-to-end HTTP API testing made easy, written in Go (golang)
bombardier – Fast crossplatform HTTP benchmarking tool, written in Go (golang)

Centos

Add the certificate to trust store

$cp root.crt /etc/pki/ca-trust/source/anchors

Update trust bundle

$update-ca-trust extract

Open a webpage that uses the CA with Firefox
Click the lock-icon in the addressbar -> show information -> show certificate
the certificate viewer will open
click details and choose the certificate of the certificate-chain, you want to import to CentOS
click "Export..." and save it as .crt file
Copy the .crt file to /etc/pki/ca-trust/source/anchors on your CentOS machine
run update-ca-trust extract
test it with wget https://thewebsite.org

Trusting custom root CA certificate in docker containers

Most large enterprises run their own PKI infrastructure and it’s common to issue internal CA signed certificate to services - The Root CA certificate is pushed to domain-joined workstations with group policy etc.

For non-domain joined services (like linux hosts etc.) it’s common to manually trust root CA cert.

Docker deamon automatically picks up the trusted root CA list from the host and use it as it's trusted CA list... Following commands can be used to add a custom CA certficate as trusted CA in Ubuntu

Go to /usr/share/ca-certificates/
Add your custom CA cert to this folder as PEM encoded file with .crt extension

	#! /usr/bin/env bash

	# Install any build dependencies needed for curl
	sudo apt-get build-dep curl

	# Get latest (as of Feb 25, 2016) libcurl
	mkdir ~/curl
	cd ~/curl
	wget http://curl.haxx.se/download/curl-7.50.2.tar.bz2
	tar -xvjf curl-7.50.2.tar.bz2

	FROM keshavab/systemd
	RUN yum -y install httpd; yum clean all
	RUN systemctl enable httpd.service
	# RUN systemctl restart httpd.service
	EXPOSE 80
	ENTRYPOINT ["/usr/sbin/init"]
	CMD systemctl restart httpd.service

	go test -cover
	go test -coverprofile=coverage.out
	go tool cover -html=coverage.out

	-- run a specific testcase
	go test -v -cover -run TestSubscriberStop

	-- run a specific file
	go test -v -cover context_messaging.go

	# All certs in pem format
	openssl verify -partial_chain -verbose -CAfile root.crt server.crt