carnet-generate-ssl

   1 #!/bin/sh
   2
   3 set -e
   4
   5 if [ -z "$4" ]; then
   6     echo "Usage: $0 <confdir> <fqdn> <email> <org>"
   7     echo
   8     echo "      confdir is ignored"
   9     echo "      fqdn    is the fully qualified name of the web server"
  10     echo "      email   address that will appear in the certificate"
  11     echo "      org     is the organization name"
  12     exit 2
  13 fi
  14
  15
  16 # Get/set all parameters.
  17 #
  18 CONFDIR="$1"
  19 FQDN="$2"
  20 WEBMASTER="$3"
  21 DOMAIN="$4"
  22
  23 sslcrt=/etc/ssl/certs
  24 sslkey=/etc/ssl/private
  25 A2CNDIR=$(dirname $0)
  26 KEYS=
  27
  28
  29 # Create temporary files.
  30 #
  31 TMPFILE=`tempfile -d /var/tmp -p apache2-cn`
  32 TMPFILE2=`tempfile -d /var/tmp -p apache2-cn`
  33
  34
  35 # Set trap for deleting all temp files.
  36 #
  37 trap "rm -f $TMPFILE $TMPFILE2" 1 2 15;
  38
  39
  40 export RANDFILE=/dev/urandom
  41 cd /etc/ssl
  42
  43
  44 # Generate CA
  45 #
  46 if [ ! -f ${sslkey}/apache2-ca.key ]; then
  47
  48     (umask 027; openssl genrsa -out ${sslkey}/apache2-ca.key 1024)
  49     KEYS="${KEYS}
  50  - ${sslkey}/apache2-ca.key"
  51 fi
  52
  53 if [ ! -f ${sslkey}/apache2-ca.csr ] || [ -n "$KEYS" ]; then
  54
  55     cat <<EOF > $TMPFILE
  56 [ req ]
  57 default_bits           = 1024
  58 default_keyfile        = apache2-ca.pem
  59 distinguished_name     = req_distinguished_name
  60 attributes             = req_attributes
  61 prompt                 = no
  62
  63 [ req_distinguished_name ]
  64 C                      = HR
  65 O                      = $DOMAIN
  66 CN                     = $FQDN CA
  67 emailAddress           = $WEBMASTER
  68
  69 [ req_attributes ]
  70
  71 EOF
  72
  73     openssl req -config $TMPFILE -new -key ${sslkey}/apache2-ca.key -out ${sslkey}/apache2-ca.csr
  74 fi
  75
  76 if [ ! -f ${sslcrt}/apache2-ca.pem ] || [ -n "$KEYS" ]; then
  77
  78     cat >$TMPFILE <<EOT
  79 extensions = x509v3
  80 [ x509v3 ]
  81 subjectAltName   = email:copy
  82 basicConstraints = CA:true,pathlen:0
  83 nsComment        = "CARNet apache2-cn package generated custom CA certificate"
  84 nsCertType       = sslCA
  85 EOT
  86
  87     openssl x509 -extfile $TMPFILE -days 3651 -signkey ${sslkey}/apache2-ca.key \
  88             -in ${sslkey}/apache2-ca.csr -req -out ${sslcrt}/apache2-ca.pem
  89
  90     KEYS="${KEYS}
  91  - ${sslcrt}/apache2-ca.pem"
  92 fi
  93
  94 mod1=`openssl x509 -noout -modulus -in ${sslcrt}/apache2-ca.pem`
  95 mod2=`openssl rsa -noout -modulus -in ${sslkey}/apache2-ca.key`
  96
  97 if [ "$mod1" != "$mod2" ]; then
  98     echo "Moduli for CA keys don't match."
  99     exit 1
 100 fi
 101
 102 cd ${sslcrt}
 103 ln -sf apache2-ca.pem $(openssl x509 -hash -noout -in apache2-ca.pem)
 104
 105
 106 # Generate server certificate
 107 #
 108 (umask 027; openssl genrsa -out ${sslkey}/apache2.key 1024)
 109
 110 echo 01 > "$TMPFILE2"
 111 sed "s/HOST/$FQDN/g; s/DOMAIN/$DOMAIN/g; s/WEBMASTER/$WEBMASTER/g" \
 112   <  $A2CNDIR/templates/openssl.cnf > "$TMPFILE"
 113
 114 openssl req -config "$TMPFILE" -new -nodes \
 115         -key ${sslkey}/apache2.key -out ${sslkey}/apache2.csr
 116 openssl x509 -extfile "$TMPFILE" -days 3650 \
 117         -CAserial "$TMPFILE2" -CA ${sslcrt}/apache2-ca.pem -CAkey ${sslkey}/apache2-ca.key \
 118         -in ${sslkey}/apache2.csr -req -out ${sslcrt}/apache2.pem
 119
 120 mod1=`openssl x509 -noout -modulus -in ${sslcrt}/apache2.pem`
 121 mod2=`openssl rsa -noout -modulus -in ${sslkey}/apache2.key`
 122
 123 if [ "$mod1" != "$mod2" ]; then
 124     echo "Moduli for server keys don't match."
 125     exit 1
 126 fi
 127
 128 KEYS="${KEYS}
 129  - ${sslcrt}/apache2.pem"
 130 KEYS="${KEYS}
 131  - ${sslkey}/apache2.key"
 132
 133 cd ${sslcrt}
 134 ln -sf apache2.pem $(openssl x509 -hash -noout -in apache2.pem)
 135
 136
 137 # Fix file access permissions and group ownership.
 138 #
 139 chgrp www-data ${sslkey}/apache2-ca.key ${sslkey}/apache2-ca.csr ${sslkey}/apache2.key ${sslkey}/apache2.csr
 140 chmod 640 ${sslkey}/apache2-ca.key ${sslkey}/apache2-ca.csr ${sslkey}/apache2.key ${sslkey}/apache2.csr
 141
 142
 143 # Cleanup
 144 #
 145 rm -f $TMPFILE $TMPFILE2
 146
 147
 148 echo "Successfully generated server key pairs:"
 149 echo "$KEYS"
 150 echo