Kubernetes TLS Certificates Basic

CozyFex included in kubernetes k8s orchestration

2021-05-19 325 words 2 minutes

Symmetric Encryption

Plain Text Transport

Data

1
2
User: John
Password: Pass123

Plain Text

This is very weak for security.
There’s no encryption.
It’s easy to hijack the data.

Encryption Transport

Data

1
2
User: John
Password: Pass123

Key

1
XKSDJ39K34KJSDF0934JHSDFSDF3DKSDG

Encrypted Data

1
2
XCVB: DKSJD
LKJSDFK: XZKJSDFL

Symmetric Encryption

This is encrypted, but it’s still weak for security.
It’s still easy to hijack data including the key.
So they can decrypt the data with key.

Asymmetric Encryption

Mechanism

Theory

Split the key to Public Key and Private Key.
Public Key is used to encrypt, Private Key is used to decrypt.
So it’s an easy way to remember Public Key as Public Lock.

SSH

Generate Client User’s `Private Key` and `Public Key`

1
2
3
4
ssh-keygen

id_rsa # Private Key
id_rsa.pub # Public Key

Register User’s `id_rsa.pub` to the Server

1
vi ~/.ssh/authorized_keys

_{Public Key List}

1
2
ssh-rsa AAAAB3NzaC1yc...KhtUBfoTzlBqRV1NThvOo4opzEwRQo1mWx user1
ssh-rsa AAAXCVJSDFDF...SLKJSDLKFw23423xckjSDFDFLKJLSDFKJLx user2

Connect to the Server

1
ssh -i id_rsa user1@server

Process Summary

Personal Asymmetric Encryption in Web

Personal Problem

It can be hijacked by DNS spoofing and copy the website that has their RSA.

Generate RSA

_{Private Key}

1
openssl genrsa -out private.key 1024

_{Public Key}

1
openssl rsa -in private.key -pubout > public.pem

Process

CA(Certificate Authority)

Certificate Authority

When you use personal RSA asymmetric encryption, there’s security problems that I talked above.
For security, you need to use certificate authority services.

CSR

Certificate Signing Request

Browser and CA

All browsers are built in certificate validation mechanism.
The browsers have public keys of well known certificate authority organizations.

1
openssl req -new -key private.key -out private.csr -subj "/C=US/ST=CA/O=MyOrg./CN=my-domain.com"

_private.csr

1
2
3
4
5
6
7
-----BEGIN CERTIFICATE REQUEST-----
MIICjDCCAXQCAQAwRzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQK
DAtNeU9yZywgSW5jLjEVMBMGA1UEAwwMbXlkb21haW4uY29tMIIBIjANBgkqhkiG
....
mDJep5YY92JxtAKZZt52wsj8MeUwTUjn6eDuz5NhpoKuiWMf9LoxGFYrgAGi2x1o
Fkse6Zr6zaB/cNdm6daW8m6qVs9hKpudTiqgD3g4MEuLLPK7VNxfFTMoSIfkLUui
-----END CERTIFICATE REQUEST-----

Process

PKI(Public Key Infrastructure)

PKI

Above whole structure is called PKI.

	Certificate(Public Key)	Private Key
Purpose	Encrypt(Lock)	Decrypt
Extension Type	*.crt	*.key
	*.pem	*-key.pem
Examples	server.crt	server.key
	server.pem	server-key.pem
	client.crt	client.key
	client.pem	client-key.pem

Contents

Kubernetes TLS Certificates Basic

Symmetric Encryption

Plain Text Transport

Data

Encryption Transport

Data

Key

Encrypted Data

Asymmetric Encryption

Mechanism

SSH

Generate Client User’s Private Key and Public Key

Register User’s id_rsa.pub to the Server

Connect to the Server

Process Summary

Personal Asymmetric Encryption in Web

Generate RSA

Process

CA(Certificate Authority)

Process

PKI(Public Key Infrastructure)

Generate Client User’s `Private Key` and `Public Key`

Register User’s `id_rsa.pub` to the Server