Сгенерить ключ в openssl и вообще в этом разобраться

encrypted_cifer = key.public_encrypt(cifer)
cifer = key.private_decrypt(encrypted_cifer)

encrypted_hash = key.private_encrypt(hash)
hash = key.public_decrypt(encrypted_hash)

#Создаешь CA:
openssl genrsa -aes256 -out yourawesomeCA.key 4096
openssl req -x509 -new -nodes -key yourawesomeCA.key -out yourawesomeCA.pem -days 3650

#RSA (серьезно 2048?, ну окей):
openssl genrsa -aes256 -out secretlorclub.key 2048
openssl req -new -key secretlorclub.key -out secretlorclub.csr
cp secretlorclub.key secretlorclub.key.org; openssl rsa -in secretlorclub.key.org -out secretlorclub.key
Подписываешь:
openssl x509 -req -days 666 -in secretlorclub.csr -CA yourawesomeCA.pem -CAkey yourawesomeCA.key -set_serial yourawesomeserial -out secretlorclub.crt

#ECDSA:
openssl ecparam -genkey -name secp384r1 | openssl ec -out secretlorclubecdsa.key -aes256
openssl req -new -sha256 -key secretlorclubecdsa.key -out secretlorclubecdsa.csr -config fastuser.cnf
cp secretlorclubecdsa.key secretlorclubecdsa.key.org; openssl ec -in secretlorclubecdsa.key.org -out secretlorclubecdsa.key
Подписываешь:
openssl x509 -req -days 666 -in secretlorclubecdsa.csr -CA yourawesomeCA.pem -CAkey yourawesomeCA.key -set_serial yourawesomeserial -out secretlorclubecdsa.crt

#Без паролей:
#RSA:
openssl genrsa > secretlorclub.key 2048
#ECDSA:
openssl ecparam -genkey -name secp384r1 > secretlorclubecdsa.key

-----BEGIN RSA PRIVATE KEY-----
MIIJJwIBAAKCAgEA1WEAswmZdPrWdWeCRcmyaDqti3oGjGnYAo8ZWMtvm0s99FhI
ji2ZvJYCYJHJSdrInHaEG0P3yUNeL6aaUKPVgONx27u/6yU9SmP6bTIUbkWFupuy
p+mrLqujZw903jWLz7RRdQJ+8wLyjwGoeaBsVw1JkfOH1VLN7X1BHdJRYTupWCnW
PdwFigQN8WpEbJp4IoPukgoHK08A6P7LxmcXt6IUxje1Y0P6c3hrL6tGhCuZbU6c
F0NbmdDrHzdDVr32PxI9Sy7UUqQNT1Xo4uB4i6DE+4zM5Suljp0kMcqSdNDYHeRS
15MHAwftPVQavNQ2yh9vPJasN/Wm6tFgRD0QOYgV+BItbG8bYmLNDZnGbsrDAGdy
I9mAdbLuPhBS2EwgRctawmhZp0acvAPeIDtrAKiGX6tnhN0DTravUWGKx8/qvLdk
AXuxndkCGLNcgH5V+GXhwQjLXJQwas9Yd8Z2QkKReJw/x42EhLoY9g/5qNLWB0gK
UPxzgq6+bkeI7K0Txi+jTOsZRPwY33fkC1+yuab5bJq8V9ZX/QqJd3ycJ2UmLT1j
GR/YIWthCTTLe2+eHPdi4gN3MQAM9BuZc/psc0mhKuNKUSCyIL/q0Dn2GR3fhZVA
eSbik18hyc0XiyAYigu2lXu54fpOUuwFdbQv4qQaIH5vNJRiWTS9k3/X0eUCAwEA
AQKCAgAm5c8F1EsoOw3bSypBZJpkS8YVNgJ5mFXraYC6YiOPULETmQBpAsES0tnO
FuV11C9b7nL4sXQ7OU+zKhDZgHRMUaoQ33IGALzikcU2ILn+vCe7s+Rmnb85+8oG
4JdyZpp9G6b5yKGx1Si4jxnSSj9VwzNVKurpJXYqw/mZ4Rw6uHCPhNjsX+6WkVSl
XLTqg2JBEIHuF2vlJjrJPqGRInv9WsukssUbOmouoJYRk4yATZ5jgcAMsZfCO4aR
IzbgWjLInp+T1A6anhNbEhMpQLhY487k+G7lnAZLMDRH62C1cNjk4hmD+OZ/U/OY
iXtyTtFKGV7i0ajFbr+l8NM2vVb2gHObYFa8JxCDvCsHTOQjWv7c3Z6tQq1gNxDL
q0juVcgeTRRZ80p7BJJ6H/ZCBX5clqI5u4LO9wP0xFhbLIUFd+SaNO4wonaRG/Wm
LJZTqpUG0KYSMnuA3EpBxZD+vyXh/NA/D8bmUFJars7A9/IhnddCMCfaFBAlTYHt
/BeqDfJcAUCeZ7OlGEMpCQmoRxaIp0otAuuePwWIpgwnjK5SGpFUKd1DP0EuFpjd
fhWkoB+CwCqqamGhsGbxijiLoeN2torlg96FPvaMpW6fjP03T+47+B2LxMkSsjDh
AzBpTkVFNQpWyE/vwhvmXLQuCdCQ/cUS5zd19g9omqjjd+9LRQKCAQEA/INLiJvs
LHl9pCL5JsmApOWYNzt2gKUU72KcvGlvy0NxejWCSj2TeVMm3ijqOWtZfeJilq73
yKFgfh/zSbKrEJhwxiu4PbI7dIVNjr37kgcWsxdGKmKx25vaMCAII2SlJE/cIHeK
aBbxXaZpY6/Hd1BVmDJV/oCc9L4JgVEv5c5fTjq9+fkQhYY+K9cYZCFJtVYgpnpZ
FRrtDuz0+OdoA7YTL8M/l6V63m2MpouJbEQrZD8e27Nr5KXaQFnZMbuJDBRcK7v1
pMDOf2CYJZi7xSYDjHd271aECZ/yQ8xwp7xfj6ae7Au/1OsiPgWazpV0OOW0SwI5
crqsVt6wYwsXfwKCAQEA2FNbpd9RH39mF0Cv47CTvYx/eF8SSWTMQi89Cws1UW7L
gX6VQjTiY0tIKynt82teogqOdDa68HMT3QncMw20M7z2hNmgaynXopdGkCfNheOV
UIvOcov+h75TpEhOuHY8kfvYLm2TPTLiYk8yuYzlG6Xrz+YpJlB3KmhfgKYLpEU1
xqGr12PFjdEQlvgoQhH3whfF0B3iq6TS4RZ3DdVjEkCUjYTToNSz+CKE3uxW8aCj
IkUHCcO5v97MhPTIAlSMK+bYupkcmqdAz2T6RKWdAYXC9B4aBDAJsVtJ5Vw8NGDO
OwRJ5vDhSFgEHjTEKXPi9VP+Oe6YUN/S4OGmC+tomwKCAQBpcc5N6oaR/92md/BA
8S4mLbYFgnA2wjjeyfgXeZP0dmJhnQyeQd5ecImvhbhhZ+GD/tAaik/wWOs5X9Ax
O0nR8UZOip0yLkZDnxLHA7CUxx8EhDiJpJMO2KMhK48acIHBixOp/yEt3D7IU6B4
v0N1IHfNyV89mqlwThccCDIPLcGAomkIhKgQigFWP0jxLzFfZurVegvPE2JgtDSL
5934hsS2Ujsw8SpAzdBJD8XADytrfiw9pEvuvA9Khfp7mQtenvXqUV//f3/7kvOV
55Spe/lJY+2nfiI+/qqlAy8b7D6fdv2wJiviFppC+gYuNBzHUaybEf+5WBh1YiKY
CV6zAoIBAD45Q/xjTu9TcucvWSiSKvzzw9q45gascsB63AEoOS7yQqE96ur/UTsk
dV7NEb/Z23+ar70n3P+66jTDWE5rG7FiIjq2aplIkNkY0Fg4yro/azye6kQyloUv
LtnrXpFamTOYkGdSZ27MCygiBcIvj9szD7BeUOnPbWeKXCYiHOkka0J2UHqFHVcc
krwKJ3JRvsValzC01/VtVKcgEiCth3DBmLlYQpNZe2bdbwC8VInuHd6Gom6hmPVi
vctkqX9aGHOsVBzgW8T0ZQUC06YZSR8d/aTAX9Vih/c2/ft2W27phYieRC+ki/iG
MLELln0h81+DyHWbdr6UkxDSdzOohA8CggEAF+zJTo5w9KxicwucgwI3wEpdTR+9
VAZgkcw4d+dmRSoYZVsX9Ze8/IJxH7eIJ+KTz2/Is9UTCWx02b2neWTTDgxvDPNb
kMWchTQdiUFQk0UDPUOy+PZUsCEmtgEplldCnJzWdGEamEGVozFH89L82Z1zKHdq
wtoByLzUWkdXnMJnHN78fbiQHXsQe9/hMVgJJb8z0ozENgMK/bcJSj/0n1uPAvSc
PHOEVnQHC2Az2n7Tef4IpLvb+yElcINkXWLeBKZeXjCeD8NJgE+Oi4hE2SB5BlXe
+M4iXKOvvZCczO00q9SFrXlW5bOksQHKrOq25kZlUV5fN1WU2zZDEMw86A==
-----END RSA PRIVATE KEY-----

openssl genpkey -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out mykey.pem
openssl pkey -inform PEM -in mykey.pem -pubout -out mykey_pub.pem

[ req ]
default_bits = 2048
distinguished_name = req_dn
x509_extensions = v3_ca

[ req_dn ]
commonName = Имя пользователя
commonName_default = CA

[ v3_ca ]
basicConstraints = CA:true

openssl genrsa -rand /dev/urandom -out CA_key_priv.pem 2048
openssl req -new -x509 -key CA_key_priv.pem -config CA.cnf -days 3650 -out CA_cert.pem

[ req ]
default_bits = 2048
distinguished_name = req_dn
x509_extensions = v3_ca

[ req_dn ]
commonName = Имя пользователя
commonName_default = User

[ v3_ca ]
basicConstraints = CA:false

openssl genrsa -rand /dev/urandom -out user_key_priv.pem
openssl pkey -in user_key_priv.pem -pubout -out user_key_pub.pem
openssl req -new -key user_key_priv.pem -config req.cnf -out user_req.pem

$ openssl x509 -req -in user_req.pem -CA CA_cert.pem -CAkey CA_key_priv.pem -days 3650 -out user_cert.pem
Signature ok
subject=/CN=User
Getting CA Private Key
CA_cert.srl: No such file or directory
139653248415648:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('CA_cert.srl','r')
139653248415648:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:

ROOT_DIR = $(shell pwd)

CA_DIR = ca
CA_DB = index.db
CA_SERIAL = serial

ETCD_DIR = etcd
KUBEAPI_DIR = api-server
KUBEAPI_CLIENT_DIR = api-client
FLANNEL_DIR = flannel
USER_DIR = user
SCHEDULER_DIR = scheduler
CONTROLLER_DIR = controller

OPENSSL_CFG_FILE = /tmp/openssl.cfg

define OPENSSL_CFG
[ca]
default_ca = CA_default

[CA_default]
dir = $(ROOT_DIR)/$(CA_DIR)
database = $$dir/$(CA_DB)
private_key = $$dir/key.pem
certificate = $$dir/crt.pem
new_certs_dir = $$dir
default_md = sha256
policy = policy_strict
serial = $$dir/$(CA_SERIAL)

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName  = optional
commonName = supplied
emailAddress = optional

[req]
default_bits = 4096
distinguished_name = req_distinguished_name
string_mask = utf8only

default_md = sha256
x509_extensions = v3_ca
req_extensions = v3_req

[req_distinguished_name]
countryName = AU
stateOrProvinceName = New South Wales
localityName = Sydney
0.organizationName = N/A
organizationUnitName = N/A
commonName = MyApp Cluster
emailAddress = aner@fastmail.com

countryName_default = AU
stateOrProvinceName_default = New South Wales
localityName_default = Sydney
0.organizationName_default = N/A
organizationUnitName_default = N/A
commonName_default = MyApp Cluster
emailAddress_default = aner@fastmail.com

[v3_ca]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = master.local
DNS.2 = master.myapp
DNS.3 = api.myapp
DNS.4 = scheduler.myapp
DNS.5 = controller.myapp
DNS.6 = etcd.myapp
IP.1 = 10.0.0.1

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

endef

define gen-key
	openssl genrsa \
		-out key.pem \
		4096
endef

define gen-csr
	openssl req \
		-new \
		-key  key.pem \
		-out csr.pem \
		-config $(OPENSSL_CFG_FILE)
endef

define sign-csr
	openssl ca  \
		-extensions $(1) \
		-days 10000 \
		-notext \
		-cert ../$(CA_DIR)/crt.pem \
		-keyfile ../$(CA_DIR)/key.pem \
		-in csr.pem \
		-out crt.pem \
		-config $(OPENSSL_CFG_FILE)
endef

define gen-crt
	@mkdir -p $(1)
	cd $(1) && \
	$(call gen-key) && \
	$(call gen-csr) && \
	$(call sign-csr,$(2))
endef

define gen-srv-crt
	$(call gen-crt,$(1),server_cert)
endef

define gen-usr-crt
	$(call gen-crt,$(1),usr_cert)
endef


define msg
	@echo "---------- $(1) ----------"
endef

clean:
	@ls | grep -v Makefile | xargs rm -rf

all: etcd kubeapi user flannel scheduler

controller: create-ca-crt
	@$(call gen-usr-crt,$(CONTROLLER_DIR))

scheduler: create-ca-crt
	@$(call gen-usr-crt,$(SCHEDULER_DIR))

flannel: create-ca-crt
	$(call msg,FLANNEL CERTIFICATE)
	@$(call gen-usr-crt,$(FLANNEL_DIR))

user: create-ca-crt
	$(call msg,USER CERTIFICATE)
	@$(call gen-usr-crt,$(USER_DIR))
	@openssl pkcs12 \
		-export \
		-out $(USER_DIR)/user.pfx \
		-inkey $(USER_DIR)/key.pem \
		-in $(USER_DIR)/crt.pem

kubeapi: create-ca-crt
	$(call msg,API SERVER CERTIFICATE)
	@$(call gen-srv-crt,$(KUBEAPI_DIR))
	$(call msg,API SERVER CLIENT CERTIFICATE)
	@$(call gen-usr-crt,$(KUBEAPI_CLIENT_DIR))

etcd: create-ca-crt
	$(call msg,ETCD CERTIFICATE)
	@$(call gen-srv-crt,$(ETCD_DIR))

create-ca-crt: prepare-openssl-cfg create-ca-key create-ca-dir
	$(call msg,ROOT CERTIFICATE)
	@cd $(CA_DIR) && \
	openssl req \
		-x509 \
		-new \
		-nodes \
		-key key.pem \
		-days 10000 \
		-out crt.pem \
		-config $(OPENSSL_CFG_FILE)

create-ca-key:  create-ca-dir
	@cd $(CA_DIR) && \
		$(call gen-key)
	
create-ca-dir:
	@mkdir -p $(CA_DIR) && \
		touch $(CA_DIR)/$(CA_DB) && \
		touch $(CA_DIR)/$(CA_SERIAL) && \
		echo 1000 > $(CA_DIR)/$(CA_SERIAL) 


prepare-openssl-cfg: export OPENSSL_CFG_CONTENT:=$(OPENSSL_CFG)
prepare-openssl-cfg:
	@echo "$${OPENSSL_CFG_CONTENT}" > $(OPENSSL_CFG_FILE)