how to check our own certificates has been applied successfully?

[barryzhounb]

I have followed instructions from https://strimzi.io/docs/operators/latest/full/using.html#installing-your-own-ca-certificates-str to install our own client-ca certificate.

After it is done installing, how to check client-ca has applied our certificates (including our certificate and our key)? I try to create a topic and user, then download secret, then extract it with command: oc extract secret my-user. Now I have user.crt and user.key.

Any ideas how to check our own certificates has been applied?

[scholzj]

I'm not sure what do you mean applied your certificates. You mean that it uses them? You can probably get it for example with openssl s_client. openssl x509 can probably also decode the public key and show the issuer. Another thing might to just use a certificate signed by the new CA and use it.

[barryzhounb]

We provide our own client-ca-cert (it is a certificate) and client-ca ( it is a key), when we replace existing client-ca-cert and client-ca with ours, I understand they are root CA. When creating a new user, user's certificate should be signed by our own root CA. Is my understand correct?

If it is correct, I am thinking how to check whether user's certificate is signed by our root CA?

[scholzj]

You can extract the user.crt file from the user secret and do something like this ... openssl x509 -in user.crt -text ... not sure about the command out of my head ... so you might need to google it or check help. That should list the issue I think which you can check whether it is your CA or not.

[barryzhounb]

Hi @scholzj please correct me if the above is wrong.

[scholzj]

Yes, your understanding should be coreect. Try the command to verify it.