How to get CA certificate for Jaeger over gRCP (TLS)

[BenElferink]

I'm using the new version of Jaeger (2.1.0), here is the deployment:
https://github.com/odigos-io/simple-demo/blob/main/kubernetes/jaeger.yaml

I've no problem sending traces over gRCP with insecure: true, see code here:
https://github.com/BenElferink/odigos/blob/gen-2012/common/config/jaeger.go

I'm trying to get a CA certificate to test the connection with TLS, please help me.
All I could find was "generate a certificate for Jaeger with Elasticsearch as backend". I do not need a 3rd party backend.

[dosubot[bot]]

Hey @BenElferink! I'm here to help you with your Jaeger TLS setup. Let's get this sorted out together! 🤖

To generate a CA certificate for Jaeger over gRPC (TLS) without using a third-party backend, you can use a shell script like gen-certs.sh from the Jaeger repository, which utilizes OpenSSL. Here’s a brief overview of the steps involved:

1. Generate a CA Key and Certificate:

   openssl genrsa -out example-CA-key.pem 2048
   openssl req -new -key example-CA-key.pem -x509 -days 3650 -out example-CA-cert.pem -config ssl.conf

2. Create Server and Client Keys:

   openssl genrsa -out example-server-key.pem 2048
   openssl genrsa -out example-client-key.pem 2048

3. Create Certificate Signing Requests (CSRs):

   openssl req -new -nodes -key example-server-key.pem -out example-server.csr -config ssl.conf
   openssl req -new -nodes -key example-client-key.pem -out example-client.csr -config ssl.conf

4. Sign the CSRs with the CA Certificate:

   openssl x509 -req -sha256 -days 3650 -in example-server.csr -out example-server-cert.pem -extensions req_ext -CA example-CA-cert.pem -CAkey example-CA-key.pem -CAcreateserial -extfile ssl.conf
   openssl x509 -req -sha256 -days 3650 -in example-client.csr -out example-client-cert.pem -extensions req_ext -CA example-CA-cert.pem -CAkey example-CA-key.pem -CAcreateserial -extfile ssl.conf

This process will generate the necessary CA, server, and client certificates and keys for use with Jaeger over gRPC (TLS) ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}