Skip to content

Generate certificates

For the complete documentation index see: llms.txt

All documentation pages available in markdown.

Use mkcert to create the certificates for this tutorial.

Terminal
mkcert -install


mkdir -p security
cp "$(mkcert -CAROOT)/rootCA.pem" security/ca.crt


mkcert -client \
  -cert-file security/asd.aerospike.com.crt \
  -key-file security/asd.aerospike.com.key \
  asd.aerospike.com aerospike localhost 127.0.0.1


mkcert \
  -cert-file security/connector.aerospike.com.crt \
  -key-file security/connector.aerospike.com.key \
  connector.aerospike.com aerospike-elasticsearch-outbound localhost 127.0.0.1


mkcert \
  -cert-file security/elasticsearch.local.crt \
  -key-file security/elasticsearch.local.key \
  elasticsearch.local elasticsearch localhost 127.0.0.1


printf 'HOST_GID=%s\n' "$(id -g)" > .env
chmod 0750 security
chmod 0640 security/*.key

The -client flag on the Aerospike certificate adds client-auth usage for the mTLS handshake to the Elasticsearch connector. These commands write seven files into security/: ca.crt plus a key-and-certificate pair for each of the three services. mkcert keeps the CA private key in its own local CA directory, so the tutorial project only needs the CA certificate and the service cert/key pairs. The .env file records your host group ID. The Compose services join that group so their non-root users can read the private keys without making the keys world-readable on Linux. This group-based permission model assumes a single-user development host on Linux. On Docker Desktop for macOS, file permissions on bind-mounted keys may differ. If a container cannot read a private key, verify ownership and permissions on the host before changing group_add.

Checkpoint

Your project directory now contains the generated certificates, private keys, and host group ID:

  • Directoryaerospike-elastic-tls/
    • .env
    • Directorysecurity/
      • asd.aerospike.com.crt
      • asd.aerospike.com.key
      • ca.crt
      • connector.aerospike.com.crt
      • connector.aerospike.com.key
      • elasticsearch.local.crt
      • elasticsearch.local.key