carnet-generate-ssl

   1 #!/bin/sh
   2
   3 set -e
   4
   5 if [ -z "$4" ]; then
   6     echo "Usage: $0 <confdir> <fqdn> <email> <org>"
   7     echo
   8     echo "      confdir is ignored"
   9     echo "      fqdn    is the fully qualified name of the web server"
  10     echo "      email   address that will appear in the certificate"
  11     echo "      org     is the organization name"
  12     exit 2
  13 fi
  14
  15
  16 # Get/set all parameters.
  17 #
  18 CONFDIR="$1"
  19 FQDN="$2"
  20 WEBMASTER="$3"
  21 DOMAIN="$4"
  22
  23 SSLDIR=/etc/ssl
  24 SSLCRTDIR=${SSLDIR}/certs
  25 SSLKEYDIR=${SSLDIR}/private
  26 A2CNDIR=$(dirname $0)
  27 KEYS=
  28
  29
  30 # Create temporary files.
  31 #
  32 TMPFILE=`tempfile -d /var/tmp -p apache2-cn`
  33 TMPFILE2=`tempfile -d /var/tmp -p apache2-cn`
  34
  35
  36 # Set trap for deleting all temp files.
  37 #
  38 trap "rm -f $TMPFILE $TMPFILE2" 1 2 15;
  39
  40
  41 export RANDFILE=/dev/urandom
  42 cd ${SSLDIR}
  43
  44
  45 # Generate CA
  46 #
  47 if [ ! -f ${SSLKEYDIR}/apache2-ca.key ]; then
  48
  49     (umask 077; openssl genrsa -out ${SSLKEYDIR}/apache2-ca.key 2048)
  50     KEYS="${KEYS}
  51  - ${SSLKEYDIR}/apache2-ca.key"
  52 fi
  53
  54 if [ ! -f ${SSLKEYDIR}/apache2-ca.csr ] || [ -n "$KEYS" ]; then
  55
  56     cat <<EOF > $TMPFILE
  57 [ req ]
  58 default_bits           = 2048
  59 default_keyfile        = apache2-ca.pem
  60 distinguished_name     = req_distinguished_name
  61 attributes             = req_attributes
  62 prompt                 = no
  63
  64 [ req_distinguished_name ]
  65 C                      = HR
  66 O                      = $DOMAIN
  67 CN                     = $FQDN CA
  68 emailAddress           = $WEBMASTER
  69
  70 [ req_attributes ]
  71
  72 EOF
  73
  74     openssl req -sha256 -config $TMPFILE -new -key ${SSLKEYDIR}/apache2-ca.key -out ${SSLKEYDIR}/apache2-ca.csr
  75 fi
  76
  77 if [ ! -f ${SSLCRTDIR}/apache2-ca.pem ] || [ -n "$KEYS" ]; then
  78
  79     cat >$TMPFILE <<EOT
  80 extensions = x509v3
  81 [ x509v3 ]
  82 subjectAltName   = email:copy
  83 basicConstraints = CA:true,pathlen:0
  84 nsComment        = "CARNet apache2-cn package generated custom CA certificate"
  85 nsCertType       = sslCA
  86 EOT
  87
  88     openssl x509 -sha256 -extfile $TMPFILE -days 3651 -signkey ${SSLKEYDIR}/apache2-ca.key \
  89             -in ${SSLKEYDIR}/apache2-ca.csr -req -out ${SSLCRTDIR}/apache2-ca.pem
  90
  91     KEYS="${KEYS}
  92  - ${SSLCRTDIR}/apache2-ca.pem"
  93 fi
  94
  95 mod1=`openssl x509 -sha256 -noout -modulus -in ${SSLCRTDIR}/apache2-ca.pem`
  96 mod2=`openssl rsa -noout -modulus -in ${SSLKEYDIR}/apache2-ca.key`
  97
  98 if [ "$mod1" != "$mod2" ]; then
  99     echo "Moduli for CA keys don't match."
 100     exit 1
 101 fi
 102
 103 cd ${SSLCRTDIR}
 104 ln -sf apache2-ca.pem $(openssl x509 -sha256 -hash -noout -in apache2-ca.pem)
 105
 106
 107 # Generate server certificate
 108 #
 109 (umask 077; openssl genrsa -out ${SSLKEYDIR}/apache2.key 2048)
 110
 111 echo 01 > "$TMPFILE2"
 112 sed "s/HOST/$FQDN/g; s/DOMAIN/$DOMAIN/g; s/WEBMASTER/$WEBMASTER/g" \
 113   <  $A2CNDIR/templates/openssl.cnf > "$TMPFILE"
 114
 115 openssl req -sha256 -config "$TMPFILE" -new -nodes \
 116         -key ${SSLKEYDIR}/apache2.key -out ${SSLKEYDIR}/apache2.csr
 117 openssl x509 -sha256 -extfile "$TMPFILE" -days 3650 \
 118         -CAserial "$TMPFILE2" -CA ${SSLCRTDIR}/apache2-ca.pem -CAkey ${SSLKEYDIR}/apache2-ca.key \
 119         -in ${SSLKEYDIR}/apache2.csr -req -out ${SSLCRTDIR}/apache2.pem
 120
 121 mod1=`openssl x509 -sha256 -noout -modulus -in ${SSLCRTDIR}/apache2.pem`
 122 mod2=`openssl rsa -noout -modulus -in ${SSLKEYDIR}/apache2.key`
 123
 124 if [ "$mod1" != "$mod2" ]; then
 125     echo "Moduli for server keys don't match."
 126     exit 1
 127 fi
 128
 129 KEYS="${KEYS}
 130  - ${SSLCRTDIR}/apache2.pem"
 131 KEYS="${KEYS}
 132  - ${SSLKEYDIR}/apache2.key"
 133
 134 cd ${SSLCRTDIR}
 135 ln -sf apache2.pem $(openssl x509 -sha256 -hash -noout -in apache2.pem)
 136
 137
 138 # Fix file access permissions.
 139 #
 140 chmod 600 ${SSLKEYDIR}/apache2-ca.key ${SSLKEYDIR}/apache2.key
 141
 142
 143 # Cleanup
 144 #
 145 rm -f $TMPFILE $TMPFILE2
 146
 147
 148 echo "Successfully generated server key pairs:"
 149 echo "$KEYS"
 150 echo