# 고객사 설치용 leaf 인증서 생성

## 1) leaf 개인키 생성

```bash
mkdir -p pki/leaf-kdn
cd pki/leaf-kdn
openssl genrsa -out dfxagent-kdn.key 2048
```

---

## 2) CSR 생성 + SAN(도메인/IP) 넣기

### 2-1) CSR용 설정 파일 만들기: `dfxagent-kdn-req.cnf`

```ini
[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
req_extensions     = req_ext

[ dn ]
C  = KR
O  = KDN
OU = DFX
CN = dfxagent-kdn-01

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
IP.1  = 10.100.12.86
```

### 2-2) CSR 생성

```bash
openssl req -new -key dfxagent-kdn.key -out dfxagent-kdn.csr -config dfxagent-kdn-req.cnf
```

---

## 3) Intermediate로 leaf 인증서 서명(발급)

### 3-1) leaf 확장 파일 만들기: `dfxagent-kdn-leaf-ext.cnf`

#### ✅ 서버용(HTTPS), mTLS 클라이언트 겸용

```ini
[ v3_server ]
basicConstraints = critical, CA:false
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = @alt_names

[ alt_names ]
IP.1  = 10.10.10.11
```

### 3-2) Intermediate로 서명

```bash
openssl x509 -req -in dfxagent-kdn.csr -CA ../intermediate/intermediate-kdn.crt -CAkey ../intermediate/intermediate-kdn.key -CAcreateserial -out dfxagent-kdn.crt -days 825 -sha256 -extfile dfxagent-kdn-leaf-ext.cnf -extensions v3_server
```

> `-days`는 운영 정책에 맞춰 조정(예: 365, 730 등).

---

## 4) 체인 검증(중요)

```bash
openssl verify -CAfile ca-chain.crt dfxagent-kdn.crt
```

`OK`가 나오는지 확인

---

## 5) (Java/톰캣용) PKCS12 keystore(p12) 만들기

DFXAgent가 Spring Boot(내장 톰캣)이므로 `p12`를 keystore로 사용

```bash
openssl pkcs12 -export -inkey dfxagent-kdn.key -in dfxagent-kdn.crt -certfile ca-chain-kdn.crt -out dfxagent-kdn.p12 -name dfxagent-kdn-01
```

---

## 6) (클라이언트 검증용) truststore 만들기 - JKS truststore (Java에서 흔함)

```bash
keytool -importcert -alias bsm-ca-chain -file ../intermediate/ca-chain-kdn.crt -keystore truststore-kdn.jks -storepass changeit -noprompt
```

---

## settings.json 구조 예시

```json
{
  "tls": {
    "enabled": true,
    "port": 8443,
    "keyStorePath": "cert/dfxagent-kdn.p12",
    "keyStorePassword": "qortpals1!",
    "keyStoreType": "PKCS12",
    "trustStorePath": "cert/truststore-kdn.jks",
    "trustStorePassword": "qortpals1!",
    "trustStoreType": "JKS",
    "clientAuth": "none"
  },
  "outboundTls": {
    "enabled": true,
    "useClientCert": false
  }
}
```