Modify the source code and replace the certificate for up to 100 years

[clywm520]

How to Modify the source code and replace the certificate for up to 100 years? please

[sainath40]

If you are trying to extend ca-certs, you can try below

In vendor/github.com/rancher/dynamiclistener/cert/cert.go and vendor/github.com/rancher/dynamiclistener/factory/cert_utils.go files modify below

In NewSelfSignedCACert function,

NotAfter: now.Add(time.Hour * 24 * 365 * 100).UTC()

[brandond]

You don't need to modify the code to do this. A better choice would be to use the instructions and example script at https://docs.k3s.io/cli/certificate#using-custom-ca-certificates to generate your own certs with whatever length you want.

[clywm520]

in master branch , i can not find that code cert_utils.go. 　Please tell me how to modify the new master branch code　　

[carlvine500]

https://github.com/rancher/dynamiclistener search NewSelfSignedCACert:

func NewSelfSignedCACert(key crypto.Signer, cn string, org ...string) (*x509.Certificate, error) {
	now := time.Now()
	tmpl := x509.Certificate{
		BasicConstraintsValid: true,
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
		NotAfter:              now.Add(time.Hour * 24 * 365 * 10).UTC(),
		NotBefore:             now.UTC(),
		SerialNumber:          new(big.Int).SetInt64(0),
		Subject: pkix.Name{
			CommonName:   cn,
			Organization: org,
		},
	}

	certDERBytes, err := x509.CreateCertificate(rand.Reader, &tmpl, &tmpl, key.Public(), key)
	if err != nil {
		return nil, err
	}

	logrus.Infof("generated self-signed CA certificate %s: notBefore=%s notAfter=%s",
		tmpl.Subject, tmpl.NotBefore, tmpl.NotAfter)

	return x509.ParseCertificate(certDERBytes)
}

[clywm520]

@brandond 大哥，请告诉我怎么修改哈。生产环境需要他哈、必竟重启K3S，会影响集群。如果禁用kube-proxy，只用cilium情况下，会有严重影响的

[clywm520]

How to modify this code ........