说明：

1、信息来源：

Harbor docs | Configure HTTPS Access to Harbor

为了方便操作，我把配置过程做成脚本，如有需要可自行下载调试。

2、默认在当前目录下新建cert并把文件都放在里面，如果想自定义，可将路径作为参数传入：

make_cert.sh you_cert_path

3、qqy.com是我自己的，需要替换为您自己的，可参考命令：

sed -ri 's/qqy.com/XXXXXXC.com/g'  make_cert.sh

4、下面脚本拷贝保存成make_cert.sh(或别的)，赋予执行权限就可以执行了。或者：

sh ./make_cert.sh

#/usr/bin/bash

_Dir_Path=$1
mkdir ${_Dir_Path:-cert}
cd ${_Dir_Path:-cert}

#Generate a CA certificate private key
openssl genrsa -out ca.key 4096

#Generate the CA certificate
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=MyPersonal Root CA" \
 -key ca.key \
 -out ca.crt

#Generate a private key
openssl genrsa -out qqy.com.key 4096

#Generate a certificate signing request (CSR)
openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=qqy.com" \
    -key qqy.com.key \
    -out qqy.com.csr

#Generate an x509 v3 extension file
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=qqy.com
DNS.2=qqy
DNS.3=k8s-harbor
EOF

#Use the v3.ext file to generate a certificate for your Harbor host
openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in qqy.com.csr \
    -out qqy.com.crt

#Create the Certificate Directory for Harbor
mkdir -p /data/cert/

#Copy the Server Certificate and Key to the Harbor Directory
cp qqy.com.crt /data/cert/
cp qqy.com.key /data/cert/

#Configure the Docker Daemon to Trust the Certificate
openssl x509 -inform PEM -in qqy.com.crt -out qqy.com.cert

#create a dedicated directory for your Harbor domain and copy all three certificate files into it
mkdir -p /etc/docker/certs.d/qqy.com/
cp qqy.com.cert /etc/docker/certs.d/qqy.com/
cp qqy.com.key /etc/docker/certs.d/qqy.com/
cp ca.crt /etc/docker/certs.d/qqy.com/

#Restart Docker Engine
systemctl restart docker && systemctl status docker