django - 为要在 Docker 容器中使用的 SSL 证书生成私钥

Question

我正在开发一个运行 Docker 并拥有 3 个容器的项目:

Django

PostgreSQL

交易
现在我要生成一个私钥来将 SSL 证书添加到我的网站，问题是我应该在哪里生成私钥？
在运行 Docker 的主服务器内部？
还是在 Django 容器内？
还是在 Traefik 容器内？
我正在使用 交通: Alpine 用于交通和 python :3.6- Alpine 对于 Django
如果它是我应该生成私钥的容器，
我应该在容器内使用什么命令行来生成私钥？
实际上我已经构建了 private.key 和 certificate.crt 文件，在 traefik.toml 文件中引用了它们，我得到了这个错误:

failed to load X509 key pair: tls: failed to find any PEM data in certificate input

这就是为什么我认为问题出在我在主服务器内而不是在任何容器内生成的 private.key 上。
这是我在 内部使用的配置traefik.toml 如果您想了解更多信息，请提交文件:

logLevel = "INFO"
defaultEntryPoints = ["http", "https"]
# Entrypoints, http and https
[entryPoints]
  # http should be redirected to https
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  # https is the default
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
    [[entryPoints.https.tls.certificates]]
    certFile = "/certs/ new_cert_v2.chained.crt"
    keyFile = "/certs/hrattendence_gs-group_nl.key"
    
[file]
[backends]
  [backends.django]
    [backends.django.servers.server1]
      url = "http://django:5000"
[frontends]
  [frontends.django]
    backend = "django"
    passHostHeader = true
    [frontends.django.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.django.routes.dr1]
      rule = "Host:IP here"

这是完整的错误消息:

traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Using TOML configuration file /etc/traefik/traefik.toml"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="No tls.defaultCertificate given for https: using the first item in tls.certificates as a fallback."
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Traefik version v1.7.16 built on 2019-09-13_01:12:20PM"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://docs.traefik.io/basics/#collected-data\n"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=error msg="failed to load X509 key pair: tls: failed to find any PEM data in certificate input"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Preparing server http &{Address::80 TLS:<nil> Redirect:0xc000b04b40 Auth:<nil> WhitelistSourceRange:[] WhiteList:<nil> Compress:false ProxyProtocol:<nil> ForwardedHeaders:0xc0008fba60} with readTimeout=0s writeTimeout=0s idleTimeout=3m0s"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Preparing server https &{Address::443 TLS:0xc0007797a0 Redirect:<nil> Auth:<nil> WhitelistSourceRange:[] WhiteList:<nil> Compress:false ProxyProtocol:<nil> ForwardedHeaders:0xc0008fba80} with readTimeout=0s writeTimeout=0s idleTimeout=3m0s"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=error msg="Unable to add a certificate to the entryPoint \"https\" : unable to generate TLS certificate : tls: failed to find any PEM data in certificate input"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Starting provider configuration.ProviderAggregator {}"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Starting server on :443"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Starting server on :80"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Starting provider *file.Provider {\"Watch\":true,\"Filename\":\"\",\"Constraints\":null,\"Trace\":false,\"TemplateVersion\":0,\"DebugLogGeneratedTemplate\":false,\"Directory\":\"\",\"TraefikFile\":\"/etc/traefik/traefik.toml\"}"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=error msg="failed to load X509 key pair: tls: failed to find any PEM data in certificate input"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Server configuration reloaded on :80"
traefik_1_623bf12389b8 | time="2020-09-19T14:24:35Z" level=info msg="Server configuration reloaded on :443"

Answer 1

您应该使用通常使用的任何工具在 Docker 之外生成 TLS 证书和私钥。这可能是 openssl命令行工具，或托管工具，如 Amazon 的 Certificate Manager，或 LetsEncrypt，或更广泛的凭证管理工具，如 Hashicorp 的 Vault。您可能没有工具来创建和正确签署镜像中的证书，这没关系。
获得(签名的)证书和私钥后，您可以在启动容器时使用 Docker 绑定(bind)挂载将它们注入(inject)容器。例如，如果您使用 Docker Compose 启动三个容器，并且 PEM 文件和私钥位于同一目录中，则可以设置

services:
  traefik:
    volumes:
      - ./certs:/certs

安装 certs当前目录的子目录到 /certs在容器中。