2.1 KiB
How to secure access to your Minio server with TLS 
In this document, we will show how to configure your Minio servers with TLS certificates.
1. Prerequisites
- Download Minio server from here
2. Generate TLS certificate
Minio supports only key/certificate in PEM format.
With Letsencrypt
Please explore here
With generate_cert.go (self-signed certificate)
You need to download generate_cert.go which is a simple go tool for generating self-signed certificates but works for the most of cases.
generate_cert.go already provides SAN certificates with DNS and IP entries:
go run generate_cert.go -ca --host "10.10.0.3"
With OpenSSL:
Generate the private key:
openssl genrsa -out private.key 1024
Generate the self-signed certificate:
openssl req -new -x509 -days 3650 -key private.key -out public.crt -subj "/C=country/ST=state/L=location/O=organization/CN=domain"
3. Configure Minio with the generated certificate
To make Minio aware about your generated key and certificate, you will need to put them under certs directory in your Minio config path (usually ~/.minio) using the names of private.key and public.crt for key and certificate files respectively.
4. Install third parties CAs
Minio can be configured to connect to other servers, whether Minio nodes or servers like NATs, Redis. If these servers use certificates that are not registered in one of the known certificates authorities, you can make Minio server trust these CAs by dropping these certificates under ~/.minio/certs/CAs/ in your Minio config path.