[tidb@vm10-2-103-12 ~]$ tiup cluster display tidb-test1Cluster type:       tidbCluster name:       tidb-test1Cluster version:    v6.5.6Deploy user:        tidbSSH type:           builtinTLS encryption:     enabledCA certificate:     /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/ca.crtClient private key: /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.pemClient certificate: /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.crtDashboard URL:      https://10.2.103.12:2479/dashboardGrafana URL:        http://10.2.103.64:3100ID                  Role          Host          Ports        OS/Arch       Status   Data Dir                            Deploy Dir--                  ----          ----          -----        -------       ------   --------                            ----------10.2.103.64:9193    alertmanager  10.2.103.64   9193/9194    linux/x86_64  Up       /tidb-data-test1/alertmanager-9193  /tidb-deploy-test1/alertmanager-919310.2.103.64:3100    grafana       10.2.103.64   3100         linux/x86_64  Up       -                                   /tidb-deploy-test1/grafana-310010.2.103.12:2479    pd            10.2.103.12   2479/2480    linux/x86_64  Up|L|UI  /tidb-data-test1/pd-2479            /tidb-deploy-test1/pd-247910.2.103.64:9290    prometheus    10.2.103.64   9290/12220   linux/x86_64  Up       /tidb-data-test1/prometheus-9290    /tidb-deploy-test1/prometheus-929010.2.103.12:4100    tidb          10.2.103.12   4100/11080   linux/x86_64  Up       -                                   /tidb-deploy-test1/tidb-410010.2.103.28:4100    tidb          10.2.103.28   4100/11080   linux/x86_64  Up       -                                   /tidb-deploy-test1/tidb-410010.2.103.147:21160  tikv          10.2.103.147  21160/21180  linux/x86_64  Up       /tidb-data-test1/tikv-21160         /tidb-deploy-test1/tikv-2116010.2.103.202:21160  tikv          10.2.103.202  21160/21180  linux/x86_64  Up       /tidb-data-test1/tikv-21160         /tidb-deploy-test1/tikv-2116010.2.103.92:21160   tikv          10.2.103.92   21160/21180  linux/x86_64  Up       /tidb-data-test1/tikv-21160         /tidb-deploy-test1/tikv-21160

[tidb@vm10-2-103-12 ~]$ md5sum  /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/ca.crt97eb790c1e0299fb1ffb7346f71e9fde  /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/ca.crt[tidb@vm10-2-103-12 ~]$ md5sum  /tidb-deploy-test1/pd-2479/tls/ca.crt 97eb790c1e0299fb1ffb7346f71e9fde  /tidb-deploy-test1/pd-2479/tls/ca.crt[tidb@vm10-2-103-12 ~]$ md5sum  /tidb-deploy-test1/tidb-4100/tls/ca.crt 97eb790c1e0299fb1ffb7346f71e9fde  /tidb-deploy-test1/tidb-4100/tls/ca.crt

[tidb@vm10-2-103-12 ~]$ openssl x509 -noout -subject -in /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.crtsubject= /O=PingCAP/OU=TiUP/OU=tiup-cluster-client/CN=tidb-test1-client[tidb@vm10-2-103-12 ~]$ openssl x509 -text -in /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/ca.crt -nooutCertificate:    Data:        Version: 3 (0x2)        Serial Number:            7b:22:10:dc:75:17:cb:29:ff:bc:b0:28:60:a0:9d:16    Signature Algorithm: sha256WithRSAEncryption        Issuer: O=PingCAP, OU=TiUP        Validity            Not Before: May  5 06:46:18 2024 GMT            Not After : Apr 23 06:46:18 2074 GMT        Subject: O=PingCAP, OU=TiUP        Subject Public Key Info:            Public Key Algorithm: rsaEncryption                Public-Key: (2048 bit)                Modulus:                    00:e8:c7:f2:bf:7c:8d:81:76:cd:07:05:b0:00:19:...                Exponent: 65537 (0x10001)        X509v3 extensions:            X509v3 Key Usage: critical                Digital Signature, Certificate Sign            X509v3 Extended Key Usage:                 TLS Web Client Authentication, TLS Web Server Authentication            X509v3 Basic Constraints: critical                CA:TRUE            X509v3 Subject Key Identifier:                 65:AA:D3:27:5D:EC:F3:53:C4:AE:46:8A:F1:E4:22:D1:A9:E8:DF:ED    Signature Algorithm: sha256WithRSAEncryption         53:58:49:d7:7c:67:ec:30:d5:59:5b:58:76:19:3c:90:58:ba:...

[tidb@vm10-2-103-12 ~]$ md5sum  /tidb-deploy-test1/pd-2479/tls/pd.crt470ab67dc5b9d1f3d4f530a2467f02d3  /tidb-deploy-test1/pd-2479/tls/pd.crt[tidb@vm10-2-103-12 ~]$ md5sum  /tidb-deploy-test1/tidb-4100/tls/tidb.crt 5c6ef0c2bf996231cccb22e6c3505b8f  /tidb-deploy-test1/tidb-4100/tls/tidb.crt[tidb@vm10-2-103-12 ~]$ md5sum /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.crt07caa98266a24ba42828f0f01217b659  /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.crt
[tidb@vm10-2-103-12 ~]$ openssl x509 -noout -subject -in /tidb-deploy-test1/pd-2479/tls/pd.crtsubject= /O=PingCAP/OU=pd/OU=TiUP/CN=pd[tidb@vm10-2-103-12 ~]$ openssl x509 -noout -subject -in /tidb-deploy-test1/tidb-4100/tls/tidb.crtsubject= /O=PingCAP/OU=TiUP/OU=tidb/CN=tidb[tidb@vm10-2-103-12 ~]$ openssl x509 -noout -subject -in /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.crtsubject= /O=PingCAP/OU=TiUP/OU=tiup-cluster-client/CN=tidb-test1-client
[tidb@vm10-2-103-12 tlsold]$ openssl x509 -text -in tidb.crt -noout |grep -A 1 Alternative            X509v3 Subject Alternative Name:                 DNS:localhost, IP Address:127.0.0.1, IP Address:10.2.103.12[tidb@vm10-2-103-12 tlsold]$  openssl x509 -text -in pd.crt -noout |grep -A 1 Alternative            X509v3 Subject Alternative Name:                 DNS:localhost, IP Address:127.0.0.1, IP Address:10.2.103.12

[tidb@vm10-2-103-12 ~]$ cd  /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/[tidb@vm10-2-103-12 tls]$ lsca.crt  ca.pem  client.crt  client.pem  client.pfx[tidb@vm10-2-103-12 tls]$ mkdir ~/tidbcrt[tidb@vm10-2-103-12 tls]$ cp ca.crt   ~/tidbcrt/[tidb@vm10-2-103-12 tls]$ cp ca.pem  ~/tidbcrt/[tidb@vm10-2-103-12 tls]$ cd  ~/tidbcrt/[tidb@vm10-2-103-12 tidbcrt]$ lsca.crt  ca.pem[tidb@vm10-2-103-12 crt]$ cp /etc/pki/tls/openssl.cnf openssl_tidb.cnf[tidb@vm10-2-103-12 crt]$ vi openssl_tidb.cnf

[tidb@vm10-2-103-12 tidbcrt]$ cat openssl_tidb.cnf   |grep -v ^$|grep -v ^#HOME                    = .RANDFILE                = $ENV::HOME/.rndoid_section             = new_oids[ new_oids ]tsa_policy1 = 1.2.3.4.1tsa_policy2 = 1.2.3.4.5.6tsa_policy3 = 1.2.3.4.5.7[ ca ]default_ca      = CA_default            # The default ca section[ CA_default ]dir             = /etc/pki/CA           # Where everything is keptcerts           = $dir/certs            # Where the issued certs are keptcrl_dir         = $dir/crl              # Where the issued crl are keptdatabase        = $dir/index.txt        # database index file.                                        # several ctificates with same subject.new_certs_dir   = $dir/newcerts         # default place for new certs.certificate     = $dir/cacert.pem       # The CA certificateserial          = $dir/serial           # The current serial numbercrlnumber       = $dir/crlnumber        # the current crl number                                        # must be commented out to leave a V1 CRLcrl             = $dir/crl.pem          # The current CRLprivate_key     = $dir/private/cakey.pem# The private keyRANDFILE        = $dir/private/.rand    # private random number filex509_extensions = usr_cert              # The extentions to add to the certname_opt        = ca_default            # Subject Name optionscert_opt        = ca_default            # Certificate field optionsdefault_days    = 365                   # how long to certify fordefault_crl_days= 30                    # how long before next CRLdefault_md      = sha256                # use SHA-256 by defaultpreserve        = no                    # keep passed DN orderingpolicy          = policy_match[ policy_match ]countryName             = matchstateOrProvinceName     = matchorganizationName        = matchorganizationalUnitName  = optionalcommonName              = suppliedemailAddress            = optional[ policy_anything ]countryName             = optionalstateOrProvinceName     = optionallocalityName            = optionalorganizationName        = optionalorganizationalUnitName  = optionalcommonName              = suppliedemailAddress            = optional[ req ]default_bits            = 2048default_md              = sha256default_keyfile         = privkey.pemdistinguished_name      = req_distinguished_nameattributes              = req_attributesx509_extensions = v3_ca # The extentions to add to the self signed certstring_mask = utf8onlyreq_extensions = v3_req # The extensions to add to a certificate request[ req_distinguished_name ]0.organizationName              = Organization Name (eg, company)0.organizationName_default      = PingCAPorganizationalUnitName          = Organizational Unit Name (eg, section)organizationalUnitName_default  = TiUPcommonName                      = Common Name (eg, your name or your server\'s hostname)commonName_default              = TiDBcommonName_max                  = 64[ req_attributes ]challengePassword               = A challenge passwordchallengePassword_min           = 4challengePassword_max           = 20unstructuredName                = An optional company name[ usr_cert ]basicConstraints=CA:FALSEnsComment                       = "OpenSSL Generated Certificate"subjectKeyIdentifier=hashauthorityKeyIdentifier=keyid,issuer[ v3_req ]keyUsage = critical, digitalSignature, keyEnciphermentextendedKeyUsage = clientAuth, serverAuthsubjectAltName = @alt_names[ alt_names ]DNS.1 = localhostIP.1 = 127.0.0.1IP.2 = 10.2.103.64IP.3 = 10.2.103.12IP.4 = 10.2.103.28IP.5 = 10.2.103.147IP.6 = 10.2.103.202IP.7 = 10.2.103.92[ v3_ca ]subjectKeyIdentifier=hashauthorityKeyIdentifier = keyid:alwaysbasicConstraints = CA:true[ crl_ext ]authorityKeyIdentifier=keyid:always[ proxy_cert_ext ]basicConstraints=CA:FALSEnsComment                       = "OpenSSL Generated Certificate"subjectKeyIdentifier=hashauthorityKeyIdentifier=keyid,issuerproxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo[ tsa ]default_tsa = tsa_config1       # the default TSA section[ tsa_config1 ]dir             = ./demoCA              # TSA root directoryserial          = $dir/tsaserial        # The current serial number (mandatory)crypto_device   = builtin               # OpenSSL engine to use for signingsigner_cert     = $dir/tsacert.pem      # The TSA signing certificate                                        # (optional)certs           = $dir/cacert.pem       # Certificate chain to include in reply                                        # (optional)signer_key      = $dir/private/tsakey.pem # The TSA private key (optional)default_policy  = tsa_policy1           # Policy if request did not specify it                                        # (optional)other_policies  = tsa_policy2, tsa_policy3      # acceptable policies (optional)digests         = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)accuracy        = secs:1, millisecs:500, microsecs:100  # (optional)clock_precision_digits  = 0     # number of digits after dot. (optional)ordering                = yes   # Is ordering defined for timestamps?                                # (optional, default: no)tsa_name                = yes   # Must the TSA name be included in the reply?                                # (optional, default: no)ess_cert_id_chain       = no    # Must the ESS cert id chain be included?                                # (optional, default: no)

[tidb@vm10-2-103-12 tidbcrt]$ openssl genrsa -out tidb.key 2048[tidb@vm10-2-103-12 tidbcrt]$ openssl req -new -key tidb.key -out tidb.csr -config openssl_tidb.cnfYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Organization Name (eg, company) [PingCAP]:Organizational Unit Name (eg, section) [TiUP]:Common Name (eg, your name or your server's hostname) [TiDB]:
Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:[tidb@vm10-2-103-12 tidbcrt]$ lsca.crt  ca.pem  openssl.cnf  openssl_tidb.cnf  tidb.csr  tidb.key[tidb@vm10-2-103-12 tidbcrt]$ openssl x509 -req -days 3650 -CA ca.crt -CAkey ca.pem -CAcreateserial -in tidb.csr -out tidb.crt -extensions v3_req -extfile openssl_tidb.cnfSignature oksubject=/O=PingCAP/OU=TiUP/CN=TiDBGetting CA Private Key

[tidb@vm10-2-103-12 tidbcrt]$ openssl x509 -text -in /home/tidb/tidbcrt/tidb.crt -nooutCertificate:    Data:        Version: 3 (0x2)        Serial Number:            f8:01:3b:c4:c4:d8:7a:30    Signature Algorithm: sha256WithRSAEncryption        Issuer: O=PingCAP, OU=TiUP        Validity            Not Before: May  5 08:50:09 2024 GMT            Not After : May  3 08:50:09 2034 GMT        Subject: O=PingCAP, OU=TiUP, CN=TiDB        Subject Public Key Info:            Public Key Algorithm: rsaEncryption                Public-Key: (2048 bit)                Modulus:                    00:cf:e5:80:03:4c:6e:e8:1f:e6:67:46:ab:88:de:...                Exponent: 65537 (0x10001)        X509v3 extensions:            X509v3 Key Usage: critical                Digital Signature, Key Encipherment            X509v3 Extended Key Usage:                 TLS Web Client Authentication, TLS Web Server Authentication            X509v3 Subject Alternative Name:                 DNS:localhost, IP Address:127.0.0.1, IP Address:10.2.103.64, IP Address:10.2.103.12, IP Address:10.2.103.28, IP Address:10.2.103.147, IP Address:10.2.103.202, IP Address:10.2.103.92    Signature Algorithm: sha256WithRSAEncryption         26:d1:f7:37:76:fc:c0:f1:e9:89:a3:c6:a9:b3:de:85:e8:19:...

[tidb@vm10-2-103-12 crt]$ openssl x509 -text -in /tidb-deploy-test1/tidb-4100/tls/tidb.crt -nooutCertificate:    Data:        Version: 3 (0x2)        Serial Number:            d7:b3:af:df:e3:b1:8e:2e:3f:b2:f7:de:14:ba:c1:1e    Signature Algorithm: sha256WithRSAEncryption        Issuer: O=PingCAP, OU=TiUP        Validity            Not Before: May  5 06:46:19 2024 GMT            Not After : May  3 06:46:19 2034 GMT        Subject: O=PingCAP, OU=TiUP, OU=tidb, CN=tidb        Subject Public Key Info:            Public Key Algorithm: rsaEncryption                Public-Key: (2048 bit)                Modulus:                    00:d8:fe:3a:b6:c1:b2:bd:e9:05:05:5c:55:b0:0e:...                Exponent: 65537 (0x10001)        X509v3 extensions:            X509v3 Key Usage: critical                Digital Signature, Key Encipherment            X509v3 Extended Key Usage:                 TLS Web Client Authentication, TLS Web Server Authentication            X509v3 Authority Key Identifier:                 keyid:65:AA:D3:27:5D:EC:F3:53:C4:AE:46:8A:F1:E4:22:D1:A9:E8:DF:ED
            X509v3 Subject Alternative Name:                 DNS:localhost, IP Address:127.0.0.1, IP Address:10.2.103.12    Signature Algorithm: sha256WithRSAEncryption         1d:7f:30:96:dd:07:05:4a:0c:c4:53:5a:42:95:cf:f3:52:d8:...

tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/tidb-4100/tls" -R tidbtiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/tidb-4100/tls /tidb-deploy-test1/tidb-4100/tlsold" -R tidbtiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/tidb-4100/tlsold" -R tidbtiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/tidb-4100/tls/tidb.pem -R tidbtiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/tidb-4100/tls/tidb.crt -R tidb
tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/tikv-21160/tls" -R tikvtiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/tikv-21160/tls /tidb-deploy-test1/tikv-21160/tlsold" -R tikvtiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/tikv-21160/tlsold" -R tikvtiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/tikv-21160/tls/tikv.pem -R tikvtiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/tikv-21160/tls/tikv.crt -R tikv
tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/pd-2479/tls" -R pdtiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/pd-2479/tls /tidb-deploy-test1/pd-2479/tlsold" -R pdtiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/pd-2479/tlsold" -R pdtiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/pd-2479/tls/pd.pem -R pdtiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/pd-2479/tls/pd.crt -R pd
tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/prometheus-9290/tls" -R prometheustiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/prometheus-9290/tls /tidb-deploy-test1/prometheus-9290/tlsold" -R prometheustiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/prometheus-9290/tlsold" -R prometheustiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/prometheus-9290/tls/prometheus.pem -R prometheustiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/prometheus-9290/tls/prometheus.crt -R prometheus
tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/grafana-3100/tls" -R grafanatiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/grafana-3100/tls /tidb-deploy-test1/grafana-3100/tlsold" -R grafanatiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/grafana-3100/tlsold" -R grafanatiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/grafana-3100/tls/grafana.pem -R grafanatiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/grafana-3100/tls/grafana.crt -R grafana
tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/alertmanager-9193/tls" -R alertmanagertiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/alertmanager-9193/tls /tidb-deploy-test1/alertmanager-9193/tlsold" -R alertmanagertiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/alertmanager-9193/tlsold" -R alertmanagertiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/alertmanager-9193/tls/alertmanager.pem -R alertmanagertiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/alertmanager-9193/tls/alertmanager.crt -R alertmanager
tiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/cdc-8400/tls" -R cdctiup cluster exec tidb-test1 --command "cp -rp /tidb-deploy-test1/cdc-8400/tls /tidb-deploy-test1/cdc-8400/tlsold" -R cdctiup cluster exec tidb-test1 --command "ls /tidb-deploy-test1/cdc-8400/tlsold" -R cdctiup cluster push tidb-test1 tidb.key /tidb-deploy-test1/cdc-8400/tls/cdc.pem -R cdctiup cluster push tidb-test1 tidb.crt /tidb-deploy-test1/cdc-8400/tls/cdc.crt -R cdc
cp tidb.key  /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.pemcp tidb.crt /home/tidb/.tiup/storage/cluster/clusters/tidb-test1/tls/client.crt

[tidb@vm10-2-103-12 tidbcrt]$ tiup cluster edit-config  tidb-test1 global:  user: tidb  ssh_port: 22  ssh_type: builtin  enable_tls: true  deploy_dir: /tidb-deploy-test1  data_dir: /tidb-data-test1  os: linux  systemd_mode: systemmonitored:  node_exporter_port: 9200  blackbox_exporter_port: 9215  deploy_dir: /tidb-deploy-test1/monitor-9200  data_dir: /tidb-data-test1/monitor-9200  log_dir: /tidb-deploy-test1/monitor-9200/logserver_configs:  tidb:    security.cluster-verify-cn:    - TiDB  tikv:    security.cert-allowed-cn:    - TiDB  pd:    security.cert-allowed-cn:    - TiDB    replication.location-labels:    - zone    - host  tidb_dashboard: {}  tiflash: {}  tiproxy: {}  tiflash-learner: {}  pump: {}  drainer: {}  cdc:    security.cert-allowed-cn:    - TiDB  kvcdc: {}  grafana: {}tidb_servers:
[tidb@vm10-2-103-12 tidbcrt]$ tiup cluster reload  tidb-test1