keshavab

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

keshavab

Moved to git-repository: https://github.com/denji/awesome-http-benchmark

Tools

Located in alphabetical order (not prefer)

• ab – slow and single threaded, written in C
• apib – most of the features of ApacheBench (ab), also designed as a more modern replacement, written in C
• baloo – Expressive end-to-end HTTP API testing made easy, written in Go (golang)
• bombardier – Fast crossplatform HTTP benchmarking tool, written in Go (golang)

keshavab

#! /usr/bin/env bash

# Install any build dependencies needed for curl
sudo apt-get build-dep curl

# Get latest (as of Feb 25, 2016) libcurl
mkdir ~/curl
cd ~/curl
wget http://curl.haxx.se/download/curl-7.50.2.tar.bz2
tar -xvjf curl-7.50.2.tar.bz2

keshavab

• Open a webpage that uses the CA with Firefox
• Click the lock-icon in the addressbar -> show information -> show certificate
• the certificate viewer will open
• click details and choose the certificate of the certificate-chain, you want to import to CentOS
• click "Export..." and save it as .crt file
• Copy the .crt file to /etc/pki/ca-trust/source/anchors on your CentOS machine
• run update-ca-trust extract
• test it with wget https://thewebsite.org

keshavab

Trusting custom root CA certificate in docker containers

Most large enterprises run their own PKI infrastructure and it’s common to issue internal CA signed certificate to services - The Root CA certificate is pushed to domain-joined workstations with group policy etc.

For non-domain joined services (like linux hosts etc.) it’s common to manually trust root CA cert.

Docker deamon automatically picks up the trusted root CA list from the host and use it as it's trusted CA list... Following commands can be used to add a custom CA certficate as trusted CA in Ubuntu

• Go to /usr/share/ca-certificates/
• Add your custom CA cert to this folder as PEM encoded file with .crt extension

keshavab

[[local|localrc]]

# Credentials
OS_PASSWORD=password
ADMIN_USER=stack
ADMIN_PASSWORD=$OS_PASSWORD
DATABASE_PASSWORD=$OS_PASSWORD
SERVICE_PASSWORD=$OS_PASSWORD
SERVICE_TOKEN=$OS_PASSWORD
RABBIT_PASSWORD=$OS_PASSWORD