| Eclipse Che Documentation

This section describes how to prepare self-signed TLS certificates to use with Che on different platforms.

Prerequisites

Find out expected domain name where Che deployment is planned

# default for minishift
$( minishift ip ).nip.io

# default for minikube
$( minikube ip ).nip.io

# default for crc
apps-crc.testing

Find out openssl.cnf file location on target machine
```
# Fedora 31
/etc/pki/tls/openssl.cnf
```

Procedure

Set necessary environment variables

$ CA_CN=eclipse-che-signer
$ DOMAIN=*.<expected.domain.com>
$ OPENSSL_CNF=<path_to_openssl.cnf>

# Example with minikube on Fedora 31
$ CA_CN=eclipse-che-signer
$ DOMAIN=*.$( minikube ip ).nip.io
$ OPENSSL_CNF=/etc/pki/tls/openssl.cnf

# Example with crc on OSX
$ export CA_CN=eclipse-che-signer
$ export DOMAIN=*.apps-crc.testing
$ export OPENSSL_CNF=/System/Library/OpenSSL/openssl.cnf

Generate root CA key. Add -des3 parameter if passphrase is needed
```
$ openssl genrsa -out rootCA.key 4096
```

Generate root certificate.

$ openssl req -x509 \
  -new -nodes \
  -key rootCA.key \
  -sha256 \
  -days 1024 \
  -out rootCA.crt \
  -subj /CN=${CA_CN} \
  -reqexts SAN \
  -extensions SAN \
  -config <(cat ${OPENSSL_CNF} \
      <(printf '[SAN]\nbasicConstraints=critical, CA:TRUE\nkeyUsage=keyCertSign, cRLSign, digitalSignature, keyEncipherment'))

Generate domain key.
```
$ openssl genrsa -out domain.key 2048
```

Generate domain csr.

$ openssl req -new -sha256 \
    -key domain.key \
    -subj "/O=EclipseChe/CN=${DOMAIN}" \
    -reqexts SAN \
    -config <(cat ${OPENSSL_CNF} \
        <(printf "\n[SAN]\nsubjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=keyCertSign, digitalSignature, keyEncipherment\nextendedKeyUsage=serverAuth")) \
    -out domain.csr

Generate domain certificate.

$ openssl x509 \
-req \
-sha256 \
-extfile <(printf "subjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=keyCertSign,                       digitalSignature, keyEncipherment\nextendedKeyUsage=serverAuth") \
-days 365 \
-in domain.csr \
-CA rootCA.crt \
-CAkey rootCA.key \
-CAcreateserial -out domain.crt

After executing those steps, it will be possible to use domain.crt and domain.key for Route/Ingress TLS and rootCA.crt for importing into browsers.