Build a certificate authority hierarchy with CFSSL

Thu, 12 Jan 2023 00:00:00 +0000

A server certificate is only one part of a trust chain. The server presents it, an intermediate CA signs it, and the client needs a trusted root to verify the chain.

This 2023 lab uses CFSSL, Cloudflare’s PKI toolkit, to create those three certificates. The example domain is example.com. Creating this private CA does not make browsers trust it, and generating the files does not configure a web server.

Example CA (root)
└── Example Intermediate CA
 └── example.com (server)

The original article did not record its CFSSL version. Keep that limit in mind when reproducing it. You’ll need cfssl and cfssljson; use the upstream installation instructions for your platform.

CI/CD for a Java project: manual installation

Sun, 12 Apr 2020 00:00:00 +0000

In this Java CI/CD lab, Jenkins runs the build jobs, Docker builds container images, and Nexus stores them. Nginx gives Jenkins and Nexus their own HTTPS addresses. Before connecting the pipeline, each service needs to work on its own.

I split the original project into two parts: install the components by hand first, then automate the setup with Terraform and Ansible. This page covers the manual installation recorded in 2020. It stops before the Java build job and Kubernetes deployment.

Nginx on Thalamus

Build a certificate authority hierarchy with CFSSL

CI/CD for a Java project: manual installation