用shell手撸容器实现批量用openssl签证书

最新推荐文章于 2026-06-20 09:27:50 发布
原创最新推荐文章于 2026-06-20 09:27:50 发布 · 519 阅读
0 ·
本内容遵循CC 4.0 BY-SA版权协议
容器同时被 2 个专栏收录
2 篇文章
订阅专栏
bash
2 篇文章
订阅专栏
这是一个bash脚本，用于在Docker环境中并发处理多个证书签名请求。脚本首先检查输入文件夹中的CSR文件，然后根据CPU数量创建并行处理的openssl环境，最后将处理结果输出到指定目录。此脚本展示了如何在不使用Docker的情况下模拟容器化的任务执行。
以前写的一个用脚本模拟docker用容器并发签证书的脚本，现在不用了，放出来吧。
演示一下docker其实有多简单吧~~
#!/bin/bash
##
################################################################
# design:
#
#
#                                   out
#                +-------------------------------------------------------------------------------------------------------------------------------------+
#                |                                                                                                                                     v
#+-------+     +------------------+  in   +------------------+  le 50   +-------------+     +-------------------+     +------------------+  return   +--------+
#| start | --> | create container | ----> | check csr count  | -------> | processes=1 | --> | setup virtual env | --> | parallel openssl | --------> | output |
#+-------+     +------------------+       +------------------+          +-------------+     +-------------------+     +------------------+           +--------+
#                                           |                                                 ^
#                                           | gt 50                                           |
#                                           v                                                 |
#                                         +------------------+                                |
#                                         | processes=cpus+1 | -------------------------------+
#                                         +------------------+
#
#
################################################################

# example:
#
# ./pca.sh sign_dir
#
# sign_dir should contain a in.txt file and this prog output a out.txt file
#
################################################################
# example in.txt:
#
# ============
# DID:0000000001
# -----BEGIN CERTIFICATE REQUEST-----
# MIICXjCCAUYCAQAwGTEXMBUGA1UEAwwORElEOjAwMDAwMDAwMDEwggEiMA0GCSqG
# SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtXsEJ+Kyg1YnmapX7Fe3vpUSaQLaV6HDS
# nnHbgXEAZNUfgWi5LdEhNYozARDyA1VeM702l1VuCi29Sp4HUUc7Qf+oHSxOEhKl
# SXebaswNy5qyKxVLejLUiYnjFpiSqBZzYUUMNaTjuAmX9tRR+cVPzLGMUloCeTfS
# vdYL3IRNAWT0CEfK99o3Adk3rz0uzsh+G95uTqV97mcy7ZDVkeY1R5Yxao5ExniM
# O+qd3abM+hed7gN6u79IEMCOCbOiAG9gQtiPNJaXXiC4yehTk/H07p2/MVE9MAVA
# tbRhlAYWm/ON1XwQOtGvFMSivKDB+kJFtEJp9WOiOjD5dCr5eB1NAgMBAAGgADAN
# BgkqhkiG9w0BAQsFAAOCAQEAXUnTfoMQ3bX4AnV1jURjCbipgib6mB04vYOcicNx
# zlp6sjdWYXFwhwbtCVFnqYza4Fyo0vnYW7vSKjJxRo1DHhYNV6CqrlLjC38GlHS6
# qiJtcO0qXjtrDCFCi6cQXez05jJhwpRVy+CDxqCoDdwMy5vpjdOwzBpLewOX6VkP
# Atb0nmgzkQdOkDr4t+U5HdskQGU65C8tFYdmhHh8xWqCl131eTO/oMxhTS09FVf/
# G6TWXVHB+ue11DYHgTmSzHJTPaWbjk234xy5ZqWk0FHKCxrOxiZyM7hXGg8LFgyr
# 4iWT5wOICM4G3ZGq/lGoOFdbe0FyrZVu6VEWeFxxxAkYHw==
# -----END CERTIFICATE REQUEST-----
# ============
# DID:0000000002
# -----BEGIN CERTIFICATE REQUEST-----
# RnBkduyF7eugoajoq9ys4LlRPtF6f1Er4f/rUwE1Z4+s1RyEAqJVZQlP1o7V414e
# NCV1Z+1Dcjxb9EWPBqcQsgdeOau4v/xK432HEEs+wb5I1ncmLOCPNKw6Rr9SdMby
# lW38DwtBvVlOgdh6URn6RYS7zSZOsGyTxvDjUtwuq/tQTK3cQXeU+Y5gMVwC69ly
# 1xTtumwLGKXBeXMsZR9YVieu1PaATtw3a9NuuvScCdrbxDd3yr6xEngynX1ponIR
# sDgCrHYTeIzgnvE0KDbxWmpPLb9Dxm4y5iLGpewwdmBfdqx1sqwbAgMBAAGgADAN
# BgkqhkiG9w0BAQsFAAOCAQEAI9p+spefX1IYmuorriE4EtvAIWiPI3B8CpNq5v0Y
# Op18X5IQXG6XV5BJPNpOuxXjV5XgQZfPiqbTEcOA4OuOEoD5LTbSFXYe8nfBXvUe
# L5M7Jybnko8qnvm23sRNZex8+ONQb1x+oudXbrZuQuhFeI75adyc/9pKYVvfTxnw
# vK3gPbbpgH7Lx5zuaNjbPXWugV/T5DVXjNHoMMrdSzfRBOy+ivp8GNbP6L075xb6
# G+VSro6hdOHgzBxDx/pd++M27eMLEchaQatezuKjlBJz+xVa/LTABxSfzJSo+rXp
# 8sGzIjOJkd7Q46KiNeG8MsjPvsd1S3nlgQbjmINChLiG0Q==
# -----END CERTIFICATE REQUEST-----
#
################################################################
# example out.txt:
#
# ============
# DID:0000000001
# -----BEGIN CERTIFICATE-----
# MIIDXjCCAsegAwIBAgIDAy/mMA0GCSqGSIb3DQEBCwUAMGcxCzAJBgNVBAYTAkNO
# MRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFu
# eSBMdGQxIzAhBgNVBAMMGsOCwqBodS11YXQubW9zYy5mYXctdncuY29tMCAXDTIw
# MDIyNjA4MDgxNVoYDzIxMjAwMjAyMDgwODE1WjAZMRcwFQYDVQQDDA5ESUQ6MDAw
# MDAwMDAwMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK1ewQn4rKDV
# ieZqlfsV7e+lRJpAtpXocNKecduBcQBk1R+BaLkt0SE1ijMBEPIDVV4zvTaXVW4K
# Lb1KngdRRztB/6gdLE4SEqVJd5tqzA3LmrIrFUt6MtSJieMWmJKoFnNhRQw1pOO4
# CZf21FH5xU/MsYxSWgJ5N9K91gvchE0BZPQIR8r32jcB2TevPS7OyH4b3m5OpX3u
# ZzLtkNWR5jVHljFqjkTGeIw76p3dpsz6F53uA3q7v0gQwI4Js6IAb2BC2I80lpde
# ILjJ6FOT8fTunb8xUT0wBUC1tGGUBhab843VfBA60a8UxKK8oMH6QkW0Qmn1Y6I6
# MPl0Kvl4HU0CAwEAAaOB3zCB3DAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1P
# cGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUosy3X62pkvlc
# vGeWHtE3jY+3Qr0wgYEGA1UdIwR6MHiha6RpMGcxCzAJBgNVBAYTAkNOMRUwEwYD
# VQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFueSBMdGQx
# IzAhBgNVBAMMGsOCwqBodS11YXQubW9zYy5mYXctdncuY29tggkAnDrmM+VGedww
# DQYJKoZIhvcNAQELBQADgYEAVVEj8ZatHu9RfMSNyIKIJmFGE3QIlfJ+xYOaKDre
# 5cO8+ahqQg7fOoDtiGdsftJPsCsQy8nsvbjkxPw/dFH9iVA6avqmRhRcScZm8j16
# ut0pu5wmJJu2LmjbWPFb2gaHMW7VSdrj2vr5bONTKgW+F1EBciuoXN4tOWHupDse
# jyY=
# -----END CERTIFICATE-----
# ============
# DID:0000000002
# -----BEGIN CERTIFICATE-----
# MIIDXjCCAsegAwIBAgIDAy/mMA0GCSqGSIb3DQEBCwUAMGcxCzAJBgNVBAYTAkNO
# MRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFu
# eSBMdGQxIzAhBgNVBAMMGsOCwqBodS11YXQubW9zYy5mYXctdncuY29tMCAXDTIw
# MDIyNjA4MDgxNVoYDzIxMjAwMjAyMDgwODE1WjAZMRcwFQYDVQQDDA5ESUQ6MDAw
# MDAwMDAwMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPdt+3I/7QOM
# WgP702B+R/MvzCYCDyztCDhGcGR27IXt66ChqOir3KzguVE+0Xp/USvh/+tTATVn
# j6zVHIQColVlCU/WjtXjXh40JXVn7UNyPFv0RY8GpxCyB145q7i//ErjfYcQSz7B
# vkjWdyYs4I80rDpGv1J0xvKVbfwPC0G9WU6B2HpRGfpFhLvNJk6wbJPG8ONS3C6r
# +1BMrdxBd5T5jmAxXALr2XLXFO26bAsYpcF5cyxlH1hWJ67U9oBO3Ddr02669JwJ
# 2tvEN3fKvrESeDKdfWmichGwOAKsdhN4jOCe8TQoNvFaak8tv0PGbjLmIsal7DB2
# YF92rHWyrBsCAwEAAaOB3zCB3DAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1P
# VQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFueSBMdGQx
# IzAhBgNVBAMMGsOCwqBodS11YXQubW9zYy5mYXctdncuY29tggkAnDrmM+VGedww
# DQYJKoZIhvcNAQELBQADgYEAKgfxtyzoOFeDf060QjPumKbfnnCmAY9fRh6k+E6H
# XGzQIXwa8yTLZLvLxMJs2hefbvEwZEoNEb54yxmN1M8Xt1n0i90tRkonnmNlmub+
# /03XmfYdhMkg+eSAHIBx6EJeg2x4V2PNPVVPRSjC8lLI+r69o1+cJP/YlwpGg4Rb
# K0k=
# -----END CERTIFICATE-----
function err_handler(){
echo `date +%Y:%m:%d %H:%M%S`: \[ERROR\] parallel generate ca failed: $(caller)
>>/var/log/createca.log
exit 1
}
trap err_handler ERR
me=$(basename $0)
#fork
if [[ $$ != 1 ]]
then
#容器外
#basedir放一套rootfs
basedir=/Tima/certificateFile
rm -rf /Tima/certificateFile/clientCa/CA/index.txt;touch
/Tima/certificateFile/clientCa/CA/index.txt
sign_dir=$1
#山寨docker，封存bash脚本运行环境
#如果要完全复制docker，这里就应该这么写：
#diff=${workdir_base}/diff
#work=${workdir_base}/work
#merge=${workdir_base}/merge
#mkdir -p $diff $work $merge
#mount -t overlay overlay -o lowerdir=$basedir,upperdir=$diff,workdir=$work $merge
#unshare -m -p -f --mount-proc --kill-child chroot ${workdir_base}
#但因为再overlayfs的基础上不能叠加overlayfs，所以后面根据cpu数量建openssl虚拟环境的
#时候必须拷贝文件付出更大的性能代价，所以放弃
#在我们这个场景，推迟使用overlayfs比docker的实现更优
unshare -m -p -f chroot $basedir /clientCa/${me} <$sign_dir/in.txt >$sign_dir/out.txt
if [[ $? = 0 ]];then
echo SUCCESS >$sign_dir/STATUS
else
echo FAIL >$sign_dir/STATUS
fi
else
#容器内
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
. /etc/profile
mount -t proc proc /proc
mount -t tmpfs tmpfs /dev/shm
[[ -f /root/.rnd ]]||openssl rand -writerand /root/.rnd
#将格式转换成***给我的csv格式
cat /dev/stdin |awk '{if($0=="============")
{
getline;did=$0;
getline;csr=$0;
while(getline){
csr=csr"\\n"$0;
if($0=="-----END CERTIFICATE REQUEST-----")
{
break;
}
}
print did","csr;
}
}' >${workdir_base}/csr.csv
csr_count=`wc -l ${workdir_base}/csr.csv|cut -d " " -f1`
#证书请求数量少于50则单进程运行，否则取cpu数+1
cpus=1
if [ ${csr_count} -gt 50 ];then
cpus=$((`cat /proc/cpuinfo | grep process| wc -l|cut -d " " -f1` + 1))
fi
#workdirs[...]是按照并发数量建立的openssl工作环境
declare -a workdirs
for i in `seq 1 $cpus`;do
workdirs[${i}]=${workdir_base}/p_${i}
diff=${workdirs[${i}]}/diff
work=${workdirs[${i}]}/work
merge=${workdirs[${i}]}/merge
src=${workdirs[${i}]}/src
mkdir -p $diff $work $merge $src
mount -t overlay overlay -o lowerdir=${basedir}/clientCa,upperdir=$diff,workdir=$work
$merge
rm -rf ${workdirs[$i]}/merge/CA/index.txt;touch ${workdirs[${i}]}/merge/CA/index.txt
done
#do it
parallel --link --rpl "{did} 1 s:,.*::" --rpl "{csr} 1 s:.*,::;" -j $cpus 'echo -e {csr} >
{2}/src/{did}.csr ; echo -e ============\\n{did} ;' CLIENTCA_WORKDIR={2}/merge openssl ca -
batch -md sha256 -config {2}/merge/CA/openssl.cnf -in {2}/src/{did}.csr -cert
{2}/merge/sha256ca.crt -keyfile {2}/merge/sha256ca.key -notext -days 36500 -passin
pass:tima123 :::: ${workdir_base}/csr.csv :::+ ${workdirs[*]} 2>/dev/null
exit 0
fi