222 lines
6 KiB
Bash
Executable file
222 lines
6 KiB
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# CA - wrapper around ca to make it easier to use ... basically ca requires
|
|
# some setup stuff to be done before you can use it and this makes
|
|
# things easier between now and when Eric is convinced to fix it :-)
|
|
#
|
|
# CA -newca ... will setup the right stuff
|
|
# CA -newreq ... will generate a certificate request
|
|
# CA -sign ... will sign the generated request and output
|
|
#
|
|
# At the end of that grab newreq.pem and newcert.pem (one has the key
|
|
# and the other the certificate) and cat them together and that is what
|
|
# you want/need ... I'll make even this a little cleaner later.
|
|
#
|
|
#
|
|
# 12-Jan-96 tjh Added more things ... including CA -signcert which
|
|
# converts a certificate to a request and then signs it.
|
|
# 10-Jan-96 eay Fixed a few more bugs and added the SSLEAY_CONFIG
|
|
# environment variable so this can be driven from
|
|
# a script.
|
|
# 25-Jul-96 eay Cleaned up filenames some more.
|
|
# 11-Jun-96 eay Fixed a few filename missmatches.
|
|
# 03-May-96 eay Modified to use 'ssleay cmd' instead of 'cmd'.
|
|
# 18-Apr-96 tjh Original hacking
|
|
#
|
|
# Tim Hudson
|
|
# tjh@cryptsoft.com
|
|
#
|
|
|
|
# default openssl.cnf file has setup as per the following
|
|
# demoCA ... where everything is stored
|
|
cp_pem() {
|
|
infile=$1
|
|
outfile=$2
|
|
bound=$3
|
|
flag=0
|
|
exec <$infile;
|
|
while read line; do
|
|
if [ $flag -eq 1 ]; then
|
|
echo $line|grep "^-----END.*$bound" 2>/dev/null 1>/dev/null
|
|
if [ $? -eq 0 ] ; then
|
|
echo $line >>$outfile
|
|
break
|
|
else
|
|
echo $line >>$outfile
|
|
fi
|
|
fi
|
|
|
|
echo $line|grep "^-----BEGIN.*$bound" 2>/dev/null 1>/dev/null
|
|
if [ $? -eq 0 ]; then
|
|
echo $line >$outfile
|
|
flag=1
|
|
fi
|
|
done
|
|
}
|
|
|
|
usage() {
|
|
echo "usage: $0 -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify|-revoke 'file'|-gencrl|-updatedb" >&2
|
|
}
|
|
|
|
if [ -z "$OPENSSL" ]; then OPENSSL=openssl; fi
|
|
|
|
if [ -z "$SSLEAY_CONFIG" ]; then SSLEAY_CONFIG="-config $( pwd )/openssl.cnf"; fi
|
|
|
|
if [ -z "$DAYS" ] ; then DAYS="3650" ; fi
|
|
if [ -z "$CRLDAYS" ]; then CRLDAYS="3650"; fi
|
|
CADAYS="-days 14600" # 40 years
|
|
REQ="$OPENSSL req $SSLEAY_CONFIG"
|
|
CA="$OPENSSL ca $SSLEAY_CONFIG"
|
|
VERIFY="$OPENSSL verify"
|
|
X509="$OPENSSL x509"
|
|
PKCS12="openssl pkcs12"
|
|
|
|
if [ -z "$CATOP" ] ; then CATOP=./demoCA ; fi
|
|
CAKEY=./cakey.pem
|
|
CAREQ=./careq.pem
|
|
CACERT=./cacert.pem
|
|
CRLLIST=./cacrl.pem
|
|
|
|
RET=0
|
|
|
|
while [ "$1" != "" ] ; do
|
|
case $1 in
|
|
-\?|-h|-help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
-newcert)
|
|
# create a certificate
|
|
$REQ -new -x509 -keyout newkey.pem -out newcert.pem -days $DAYS
|
|
RET=$?
|
|
echo "Certificate is in newcert.pem, private key is in newkey.pem"
|
|
;;
|
|
-newreq)
|
|
# create a certificate request
|
|
$REQ -new -keyout newkey.pem -out newreq.pem -days $DAYS
|
|
RET=$?
|
|
echo "Request is in newreq.pem, private key is in newkey.pem"
|
|
;;
|
|
-newreq-nodes)
|
|
# create a certificate request
|
|
$REQ -new -nodes -keyout newreq.pem -out newreq.pem -days $DAYS
|
|
RET=$?
|
|
echo "Request (and private key) is in newreq.pem"
|
|
;;
|
|
-newca)
|
|
# if explicitly asked for or it doesn't exist then setup the directory
|
|
# structure that Eric likes to manage things
|
|
NEW="1"
|
|
if [ "$NEW" -o ! -f ${CATOP}/serial ]; then
|
|
# create the directory hierarchy
|
|
mkdir -p ${CATOP}
|
|
mkdir -p ${CATOP}/certs
|
|
mkdir -p ${CATOP}/crl
|
|
mkdir -p ${CATOP}/newcerts
|
|
mkdir -p ${CATOP}/private
|
|
touch ${CATOP}/index.txt
|
|
touch ${CATOP}/index.txt.attr
|
|
test -f ${CATOP}/crlnumber || echo "01" >${CATOP}/crlnumber
|
|
fi
|
|
if [ ! -f ${CATOP}/private/$CAKEY ]; then
|
|
echo "CA certificate filename (or enter to create)"
|
|
read FILE
|
|
|
|
# ask user for existing CA certificate
|
|
if [ "$FILE" ]; then
|
|
cp_pem $FILE ${CATOP}/private/$CAKEY PRIVATE
|
|
cp_pem $FILE ${CATOP}/$CACERT CERTIFICATE
|
|
RET=$?
|
|
if [ ! -f "${CATOP}/serial" ]; then
|
|
$X509 -in ${CATOP}/$CACERT -noout -next_serial \
|
|
-out ${CATOP}/serial
|
|
fi
|
|
else
|
|
echo "Making CA certificate ..."
|
|
$REQ -new -keyout ${CATOP}/private/$CAKEY \
|
|
-out ${CATOP}/$CAREQ
|
|
$CA -create_serial -out ${CATOP}/$CACERT $CADAYS -batch \
|
|
-keyfile ${CATOP}/private/$CAKEY -selfsign \
|
|
-extensions v3_ca \
|
|
-infiles ${CATOP}/$CAREQ
|
|
RET=$?
|
|
fi
|
|
fi
|
|
;;
|
|
-xsign)
|
|
$CA -policy policy_anything -infiles newreq.pem
|
|
RET=$?
|
|
;;
|
|
-revoke)
|
|
test -f "$2" || ( echo "ERROR: Please specify a certificate to revoke." >&2 ; exit 1)
|
|
$CA -revoke "$2"
|
|
RET="$?"
|
|
if [ "$RET" -eq "0" ]; then echo "info: don't forget to -gencrl"; fi
|
|
;;
|
|
-gencrl)
|
|
$CA -gencrl -crldays "$CRLDAYS" -out "$CATOP/crl/$CRLLIST"
|
|
RET="$?"
|
|
;;
|
|
-updatedb)
|
|
$CA -updatedb
|
|
RET="$?"
|
|
;;
|
|
-pkcs12)
|
|
if [ -z "$2" ] ; then
|
|
CNAME="My Certificate"
|
|
else
|
|
CNAME="$2"
|
|
fi
|
|
# Note : on n'inclue pas le CACERT dans le p12 pour éviter de créer une confusion
|
|
# avec le certificat du serveur (signé par une autre autorité)
|
|
# Il n'a pas été prouvé que c'était mauvais de l'inclure : on n'a jamais testé ainsi :)
|
|
#$PKCS12 -in newcert.pem -inkey newkey.pem -certfile ${CATOP}/$CACERT \
|
|
$PKCS12 -in newcert.pem -inkey newkey.pem \
|
|
-out newcert.p12 -export -name "$CNAME"
|
|
RET=$?
|
|
exit $RET
|
|
;;
|
|
-sign|-signreq)
|
|
$CA -policy policy_anything -out newcert.pem -days "$DAYS" -infiles newreq.pem
|
|
RET=$?
|
|
cat newcert.pem
|
|
echo "Signed certificate is in newcert.pem"
|
|
;;
|
|
-signCA)
|
|
$CA -policy policy_anything -out newcert.pem -extensions v3_ca -infiles newreq.pem
|
|
RET=$?
|
|
echo "Signed CA certificate is in newcert.pem"
|
|
;;
|
|
-signcert)
|
|
echo "Cert passphrase will be requested twice - bug?"
|
|
$X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
|
|
$CA -policy policy_anything -out newcert.pem -infiles tmp.pem
|
|
RET=$?
|
|
cat newcert.pem
|
|
echo "Signed certificate is in newcert.pem"
|
|
;;
|
|
-verify)
|
|
shift
|
|
if [ -z "$1" ]; then
|
|
$VERIFY -CAfile $CATOP/$CACERT newcert.pem
|
|
RET=$?
|
|
else
|
|
for j
|
|
do
|
|
$VERIFY -CAfile $CATOP/$CACERT $j
|
|
if [ $? != 0 ]; then
|
|
RET=$?
|
|
fi
|
|
done
|
|
fi
|
|
exit $RET
|
|
;;
|
|
*)
|
|
echo "Unknown arg $i" >&2
|
|
usage
|
|
exit 1
|
|
;;
|
|
esac
|
|
shift
|
|
done
|
|
exit $RET
|