Certificate test

nginx.conf

events {
    worker_connections  1024;
}

http {
  server {
    listen 443 ssl;
    server_name harbor.welkin.test;
    ssl_certificate /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;
  }
}

test-me.sh

#!/bin/bash

set -eo pipefail

#CA_KEYTYPE=ED25519 # Does not work with Chrome
CA_KEYTYPE=rsa:4096 # Works with Chrome

#SERVER_KEYTYPE=ED25519 # Does not work with Chrome. Gives ERR_SSL_VERSION_OR_CIPHER_MISMATCH
SERVER_KEYTYPE=rsa:2048 # Works with Chrome

if [ ! -e ca.key ]; then
  openssl req -x509 \
    -newkey "$CA_KEYTYPE" \
    -days 3650 \
    -nodes \
    -keyout "ca.key" \
    -out "ca.crt" \
    -subj "/CN=welkin-local-cluster-ca"
fi

echo ">>> CA certificate BEGIN <<<"
openssl x509 -in ca.crt -text -noout
echo ">>> CA certificate END <<<"

if [ ! -e server.key ]; then
  openssl req -new -newkey "$SERVER_KEYTYPE" -nodes \
    -subj "/CN=harbor.welkin.test" \
    -keyout server.key \
    -out server.csr

  openssl x509 -req \
    -in server.csr \
    -CA ca.crt \
    -CAkey ca.key \
    -out server.crt \
    -extfile <(printf "subjectAltName=DNS:harbor.welkin.test") \
    -days 365
fi

echo ">>> Server certificate BEGIN <<<"
openssl x509 -in server.crt -text -noout
echo ">>> Server certificate END <<<"

echo ">>> Check DNS record START <<<"
echo ">>> You should see harbor.welkin.test pointing to localhost. <<<"
echo ">>> If not, edit /etc/hosts accordingly <<<"
host harbor.welkin.test
echo ">>> Check DNS record END <<<"

cat <<EOF
>>> Launching NGINX <<<

Try pointing your browser to https://harbor.welkin.test:8443

or

curl --cacert ca.crt https://harbor.welkin.test:8443

You will get a 404, but that's fine. We really want to check SSL certificate issues here.

EOF

docker run \
  --rm \
  -ti \
  --name nginx-test \
  -p 8443:443 \
  -v "$PWD/nginx.conf:/etc/nginx/nginx.conf:ro" \
  -v "$PWD/server.crt:/etc/nginx/certs/server.crt:ro" \
  -v "$PWD/server.key:/etc/nginx/certs/server.key:ro" \
  nginx:alpine