Change:
Link to The secondary list elements in the page are all "1." , they are not in order, it looks weird
/sig docs
Hi can you please elaborate which page are you talking about?
Sorry, I forgot to check the link in my issue, the correct link is
/language zh /triage accepted /retitle [zh] Wrong list numbering in page FYI: Page to update: page: file:
/assign
/assign
This fixes this issue.
please avoid assigning yourself to a issue that is already assigned to somebody else.

Discussion:
cd easy-rsa-master/easyrsa3 ./easyrsa init-pki <del> <!-- 1.  Generate a new certificate authority (CA). `--batch` sets automatic mode; `--req-cn` specifies the Common Name (CN) for the CA's new root certificate. --> 1.  生成新的证书颁发机构（CA）。参数 `--batch` 用于设置自动模式； </del> <ins> <!-- 2.  Generate a new certificate authority (CA). `--batch` sets automatic mode; `--req-cn` specifies the Common Name (CN) for the CA's new root certificate. --> 2.  生成新的证书颁发机构（CA）。参数 `--batch` 用于设置自动模式； </ins> 参数 `--req-cn` 用于设置新的根证书的通用名称（CN）。 ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass <del> <!-- 1.  Generate server certificate and key. The argument `--subject-alt-name` sets the possible IPs and DNS names the API server will be accessed with. The `MASTER_CLUSTER_IP` is usually the first IP from the service CIDR that is specified as the `--service-cluster-ip-range` argument for both the API server and the controller manager component. The argument `--days` is used to set the number of days after which the certificate expires. The sample below also assumes that you are using `cluster.local` as the default DNS domain name. --> 1.  生成服务器证书和秘钥。 </del> <ins> <!-- 3.  Generate server certificate and key. The argument `--subject-alt-name` sets the possible IPs and DNS names the API server will be accessed with. The `MASTER_CLUSTER_IP` is usually the first IP from the service CIDR that is specified as the `--service-cluster-ip-range` argument for both the API server and the controller manager component. The argument `--days` is used to set the number of days after which the certificate expires. The sample below also assumes that you are using `cluster.local` as the default DNS domain name. --> 3.  生成服务器证书和秘钥。 </ins> 参数 `--subject-alt-name` 设置 API 服务器的 IP 和 DNS 名称。 `MASTER_CLUSTER_IP` 用于 API 服务器和控制管理器，通常取 CIDR 的第一个 IP，由 `--service-cluster-ip-range` 的参数提供。 参数 `--days` 用于设置证书的过期时间。

--days=10000  build-server-full server nopass <del> <!-- 1.  Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory. 1.  Fill in and add the following parameters into the API server start parameters: --> 1.  拷贝文件 `pki/ca.crt`、`pki/issued/server.crt` 和 `pki/private/server.key` 到你的目录中。 1.  在 API 服务器的启动参数中添加以下参数： </del> <ins> <!-- 4.  Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory. --> 4.  拷贝文件 `pki/ca.crt`、`pki/issued/server.crt` 和 `pki/private/server.key` 到你的目录中。 <!-- 5.  Fill in and add the following parameters into the API server start parameters: --> 5.  在 API 服务器的启动参数中添加以下参数： </ins> --client-ca-file=/yourdirectory/ca.crt --tls-cert-file=/yourdirectory/server.crt

openssl genrsa -out ca.key 2048 <del> <!-- 1.  According to the ca.key generate a ca.crt (use -days to set the certificate effective time): --> 1.  在 ca.key 文件的基础上，生成 ca.crt 文件（用参数 -days 设置证书有效期） </del> <ins> <!-- 2.  According to the ca.key generate a ca.crt (use -days to set the certificate effective time): --> 2.  在 ca.key 文件的基础上，生成 ca.crt 文件（用参数 -days 设置证书有效期） </ins> openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt <del> <!-- 1.  Generate a server.key with 2048bit: --> 1.  生成一个 2048 位的 server.key 文件： </del> <ins> <!-- 3.  Generate a server.key with 2048bit: --> 3.  生成一个 2048 位的 server.key 文件： </ins> openssl genrsa -out server.key 2048 <del> <!-- 1.  Create a config file for generating a Certificate Signing Request (CSR). Be sure to substitute the values marked with angle brackets (e.g. `<MASTER_IP>`) with real values before saving this to a file (e.g. `csr.conf`). Note that the value for `MASTER_CLUSTER_IP` is the service cluster IP for the API server as described in previous subsection. The sample below also assumes that you are using `cluster.local` as the default DNS domain name. --> 1.  创建一个用于生成证书签名请求（CSR）的配置文件。 </del> <ins> <!-- 4.  Create a config file for generating a Certificate Signing Request (CSR). Be sure to substitute the values marked with angle brackets (e.g. `<MASTER_IP>`) with real values before saving this to a file (e.g. `csr.conf`). Note that the value for `MASTER_CLUSTER_IP` is the service cluster IP for the API server as described in previous subsection. The sample below also assumes that you are using `cluster.local` as the default DNS domain name. --> 4.  创建一个用于生成证书签名请求（CSR）的配置文件。 </ins> 保存文件（例如：`csr.conf`）前，记得用真实值替换掉尖括号中的值（例如：`<MASTER_IP>`）。 注意：`MASTER_CLUSTER_IP` 就像前一小节所述，它的值是 API 服务器的服务集群 IP。 下面的例子假定你的默认 DNS 域名为 `cluster.local`。

extendedKeyUsage=serverAuth,clientAuth subjectAltName=@alt_names <del> <!-- 1.  Generate the certificate signing request based on the config file: --> 1.  基于上面的配置文件生成证书签名请求： </del> <ins> <!-- 5.  Generate the certificate signing request based on the config file: --> 5.  基于上面的配置文件生成证书签名请求： </ins> openssl req -new -key server.key -out server.csr -config csr.conf <del> <!-- 1.  Generate the server certificate using the ca.key, ca.crt and server.csr: --> 1.  基于 ca.key、ca.crt 和 server.csr 等三个文件生成服务端证书： </del> <ins> <!-- 6.  Generate the server certificate using the ca.key, ca.crt and server.csr: --> 6.  基于 ca.key、ca.crt 和 server.csr 等三个文件生成服务端证书： </ins> openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key  -CAcreateserial -out server.crt -days 10000  -extensions v3_ext -extfile csr.conf <del> <!-- 1.  View the certificate signing request: --> 1.  查看证书签名请求： </del> <ins> <!-- 7.  View the certificate signing request: --> 7.  查看证书签名请求： </ins> openssl req  -noout -text -in ./server.csr <del> <!-- 1.  View the certificate: --> 1.  查看证书： </del> <ins> <!-- 8.  View the certificate: --> 8.  查看证书： </ins> openssl x509  -noout -text -in ./server.crt

curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl-certinfo_1.5.0_linux_amd64 -o cfssl-certinfo chmod +x cfssl-certinfo <del> <!-- 1.  Create a directory to hold the artifacts and initialize cfssl: --> 1.  创建一个目录，用它保存所生成的构件和初始化 cfssl： </del> <ins> <!-- 2.  Create a directory to hold the artifacts and initialize cfssl: --> 2.  创建一个目录，用它保存所生成的构件和初始化 cfssl： </ins> mkdir cert cd cert ../cfssl print-defaults config > config.json ../cfssl print-defaults csr > csr.json <del> <!-- 1.  Create a JSON config file for generating the CA file, for example, `ca-config.json`: --> 1.  创建一个 JSON 配置文件来生成 CA 文件，例如：`ca-config.json`： </del> <ins> <!-- 3.  Create a JSON config file for generating the CA file, for example, `ca-config.json`: --> 3.  创建一个 JSON 配置文件来生成 CA 文件，例如：`ca-config.json`： </ins> { "signing": {

} } <del> <!-- 1.  Create a JSON config file for CA certificate signing request (CSR), for example, `ca-csr.json`. Be sure to replace the values marked with angle brackets with real values you want to use. --> 1.  创建一个 JSON 配置文件，用于 CA 证书签名请求（CSR），例如：`ca-csr.json`。 </del> <ins> <!-- 4.  Create a JSON config file for CA certificate signing request (CSR), for example, `ca-csr.json`. Be sure to replace the values marked with angle brackets with real values you want to use. --> 4.  创建一个 JSON 配置文件，用于 CA 证书签名请求（CSR），例如：`ca-csr.json`。 </ins> 确认用你需要的值替换掉尖括号中的值。 {

}] } <del> <!-- 1.  Generate CA key (`ca-key.pem`) and certificate (`ca.pem`): --> 1.  生成 CA 秘钥文件（`ca-key.pem`）和证书文件（`ca.pem`）： </del> <ins> <!-- 5.  Generate CA key (`ca-key.pem`) and certificate (`ca.pem`): --> 5.  生成 CA 秘钥文件（`ca-key.pem`）和证书文件（`ca.pem`）： </ins> ../cfssl gencert -initca ca-csr.json | ../cfssljson -bare ca <del> <!-- 1.  Create a JSON config file for generating keys and certificates for the API server, for example, `server-csr.json`. Be sure to replace the values in angle brackets with real values you want to use. The `MASTER_CLUSTER_IP` is the service cluster IP for the API server as described in previous subsection. The sample below also assumes that you are using `cluster.local` as the default DNS domain name. --> 1.  创建一个 JSON 配置文件，用来为 API 服务器生成秘钥和证书，例如：`server-csr.json`。 </del> <ins> <!-- 6.  Create a JSON config file for generating keys and certificates for the API server, for example, `server-csr.json`. Be sure to replace the values in angle brackets with real values you want to use. The `MASTER_CLUSTER_IP` is the service cluster IP for the API server as described in previous subsection. The sample below also assumes that you are using `cluster.local` as the default DNS domain name. --> 6.  创建一个 JSON 配置文件，用来为 API 服务器生成秘钥和证书，例如：`server-csr.json`。 </ins> 确认用你需要的值替换掉尖括号中的值。`MASTER_CLUSTER_IP` 是为 API 服务器 指定的服务集群 IP，就像前面小节描述的那样。 以下示例假定你的默认 DNS 域名为`cluster.local`。

}] } <del> <!-- 1.  Generate the key and certificate for the API server, which are by default saved into file `server-key.pem` and `server.pem` respectively: --> 1.  为 API 服务器生成秘钥和证书，默认会分别存储为`server-key.pem` 和 `server.pem` 两个文件。 </del> <ins> <!-- 7.  Generate the key and certificate for the API server, which are by default saved into file `server-key.pem` and `server.pem` respectively: --> 7.  为 API 服务器生成秘钥和证书，默认会分别存储为`server-key.pem` 和 `server.pem` 两个文件。 </ins> ../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem  --config=ca-config.json -profile=kubernetes