# Self-signed certificates

    openssl genrsa -out cert.key 2048
    openssl req -new -x509 -sha256 -key cert.key -out cert.crt -days 3650

For the common name, please type the following FQDN:

    - --listen-peer-urls=https://:2380
    - --name=
    - --peer-cert-file=etcd/peer.crt
    - --peer-client-cert-auth=true
    - --peer-key-file=etcd/peer.key
    - --peer-trusted-ca-file=etcd/ca.crt
    - --snapshot-count=10000
    - --trusted-ca-file=etcd/ca.crt
    image: /etcd:%s
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 8
      httpGet:

	// Additional encryptions are done based on
	// the key length, with the last key moved
	// to V23 for use with VCIPHERLAST.
	// CR2 = CMP key_len, $12
	XXLOR VS10, VS10, V23
	BLT	CR2, block128_last // key_len = 10
	VCIPHER_8X1_KEY(VS10)
	VCIPHER_8X1_KEY(VS11)
	XXLOR VS12,VS12,V23
	BEQ	CR2, block128_last // ken_len = 12
	VCIPHER_8X1_KEY(VS12)
	VCIPHER_8X1_KEY(VS13)
	XXLOR VS14,VS14,V23	// key_len = 14
block128_last:

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package x509

// Possible certificate files; stop after finding one.
var certFiles = []string{
	"/var/ssl/certs/ca-bundle.crt",
}

// Possible directories with certificate files; all will be read.
var certDirectories = []string{
	"/var/ssl/certs",

API_KEY=$(grep "API Key" <kes-server.log | awk -F" " '{print $3}')
(openssl s_client -connect 127.0.0.1:7373 2>/dev/null 1>public.crt)

export CI=true
export MINIO_KMS_KES_ENDPOINT=https://127.0.0.1:7373
export MINIO_KMS_KES_API_KEY="${API_KEY}"
export MINIO_KMS_KES_KEY_NAME=minio-default-key
export MINIO_KMS_KES_CAPATH=public.crt
export MC_HOST_myminio="http://minioadmin:minioadmin@localhost:9000/"

ABCDEFGHIJKLMNOPQRSTUVXxyz!"#¤%&/?"...

For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:

```
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
```

start:
	CMP	R9,$16,CR0
	CMP	R9,$32,CR1
	CMP	R9,$64,CR2
	MOVD	$16,R10
	BLT	cmp8
	BLT	CR1,cmp16
	BLT	CR2,cmp32

cmp64:	// >= 64B
	DCBT	(R5)		// optimize for size>=64
	DCBT	(R6)		// cache hint

	SRD	$6,R9,R14	// There is at least one iteration.
	MOVD	R14,CTR
	ANDCC   $63,R9,R9
	CMP	R9,$16,CR1	// Do setup for tail check early on.
	CMP	R9,$32,CR2
	CMP	R9,$48,CR3
	ADD	$-16,R9,R9

	uxName     string
}

// SharedCertificateExists verifies if the shared certificates exist and are still valid - the certificates must be
// equal across control-plane nodes: ca.key, ca.crt, sa.key, sa.pub, front-proxy-ca.key, front-proxy-ca.crt and etcd/ca.key, etcd/ca.crt if local/stacked etcd
// Missing private keys of CA are non-fatal and produce warnings.
func SharedCertificateExists(cfg *kubeadmapi.ClusterConfiguration) (bool, error) {
	var errs []error

    "${CERT_DIR}/pki/ca.crt" \
    "${CERT_DIR}/pki/issued/${MASTER_NAME}.crt" \
    "${CERT_DIR}/pki/private/${MASTER_NAME}.key" \
    "${CERT_DIR}/pki/issued/kubelet.crt" \
    "${CERT_DIR}/pki/private/kubelet.key" \
    "${CERT_DIR}/pki/issued/kubecfg.crt" \
    "${CERT_DIR}/pki/private/kubecfg.key" \
    "${CERT_DIR}/pki/issued/kube-apiserver.crt" \
    "${CERT_DIR}/pki/private/kube-apiserver.key"