# nginxコンテナを起動してOpenSSLを使う
$ docker container run --rm -it -v="$PWD:/workdir" -w="/workdir" --entrypoint=/bin/bash nginx:1.21.0

# サーバー用のオレオレ証明書を作成
# ホスト名はprometheus.hogehoge.comとしてSANsの設定もしておく(Chromeで開くため)
$ openssl genpkey -algorithm RSA -out server-private-key.pem
$ openssl req -x509 -key server-private-key.pem -out server-cert.pem -addext 'subjectAltName = DNS:prometheus.hogehoge.com'
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:prometheus.hogehoge.com
Email Address []:

# クライアント認証局の証明書を作成(オレオレ認証局)
$ openssl genpkey -algorithm RSA -out client-ca-private-key.pem
$ openssl req -x509 -key client-ca-private-key.pem -out client-ca-cert.pem -days 365
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:client-ca
Email Address []:

# 署名のための準備
$ mkdir -p demoCA/newcerts && touch demoCA/index.txt
$ echo 01 > ./demoCA/serial

# クライアント証明書を作成(クライアント認証局で署名する)
# PKCS#12形式のものも作成しておく
$ openssl genpkey -algorithm RSA -out client-private-key.pem
$ openssl req -new -key client-private-key.pem -out client-csr.pem
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:client
Email Address []:
A challenge password []:
An optional company name []:

$ openssl ca -in client-csr.pem -out client-cert.pem -keyfile client-ca-private-key.pem -cert client-ca-cert.pem -days 365
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y

$ openssl pkcs12 -export -clcerts -in client-cert.pem -inkey client-private-key.pem -out client-cert.p12
Enter Export Password: fugafuga
Verifying - Enter Export Password: fugafuga

# コンテナから出ると鍵と証明書が作成されている
$ exit
$ ls -1
client-ca-cert.pem
client-ca-private-key.pem
client-cert.p12
client-cert.pem
client-csr.pem
client-private-key.pem
demoCA
server-cert.pem
server-private-key.pem

# /etc/hostsにprometheus.hogehoge.com(localhostに飛ばす)を追加
$ echo "127.0.0.1 prometheus.hogehoge.com" | sudo tee -a /etc/hosts

# ディレクトリの状態(使わないものは消している)
$ ls -1
client-ca-cert.pem
client-cert.pem
client-private-key.pem
docker-compose.yml
prometheus.yml
server-cert.pem
server-private-key.pem
web-config.yml

# コンテナを起動する
$ docker compose up -d --force-recreate --remove-orphans

# コンテナを終了しておく
$ docker compose down

# ディレクトリの状態(使わないものを消している)
$ ls -1
client-ca-cert.pem
docker-compose.yml
https.conf
server-cert.pem
server-private-key.pem

# コンテナを起動する
$ docker compose up -d --force-recreate --remove-orphans

# コンテナを終了しておく
$ docker compose down