suvari
90 lines
1.7 KiB
Bash
90 lines
1.7 KiB
Bash
#!/bin/sh
|
|
|
|
# Accept one parameter as output file names
|
|
# Generates a self-signed certificate.
|
|
# Edit EOF section before running
|
|
|
|
if [ $# -ne 1 ]
|
|
then
|
|
echo -e "\nUse with a single name paramater for output files will be generated into current folder.\nAnd don't forget to edit [ req_dn ] section in script.\n"
|
|
echo -e "Example:\n\n./mkcert.sh foo\n\n"
|
|
exit 1
|
|
fi
|
|
|
|
OPENSSL=openssl
|
|
DIR=`pwd`
|
|
CONFIG=$1-ssl.config
|
|
|
|
CERTDIR=$SSLDIR
|
|
KEYDIR=$SSLDIR
|
|
|
|
CERTFILE=$DIR/$1.cert
|
|
KEYFILE=$DIR/$1.key
|
|
REQFILE=$DIR/$1.req
|
|
|
|
KEYBITS=1024
|
|
DAYS=3650
|
|
|
|
if [ ! -f $CONFIG ]; then
|
|
cat > $CONFIG << EOF
|
|
[ req ]
|
|
default_bits = 1024
|
|
encrypt_key = yes
|
|
distinguished_name = req_dn
|
|
x509_extensions = cert_type
|
|
prompt = no
|
|
|
|
[ req_dn ]
|
|
# country (2 letter code)
|
|
C=XY
|
|
|
|
# State or Province Name (full name)
|
|
ST=SomeState
|
|
|
|
# Locality Name (eg. city)
|
|
L=SomeCity
|
|
|
|
# Organization (eg. company)
|
|
O=SomeCompany
|
|
|
|
# Organizational Unit Name (eg. section)
|
|
OU=PisiLinux
|
|
|
|
# Common Name (*.example.com is also possible)
|
|
CN=mail.example.com
|
|
|
|
# E-mail contact
|
|
#emailAddress=admin@example.com
|
|
|
|
[ cert_type ]
|
|
nsCertType = server
|
|
EOF
|
|
fi
|
|
|
|
if [ -f $CERTFILE ]; then
|
|
echo "$CERTFILE already exists, won't overwrite"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -f $KEYFILE ]; then
|
|
echo "$KEYFILE already exists, won't overwrite"
|
|
exit 1
|
|
fi
|
|
|
|
#Generate key. Use -des3 for password protected key.
|
|
$OPENSSL genrsa -out $KEYFILE $KEYBITS
|
|
chmod 0600 $KEYFILE
|
|
|
|
#Unmask password protected key
|
|
#mv $KEYFILE $KEYFILE.orig
|
|
#$OPENSSL rsa -in $KEYFILE.orig -out $KEYFILE
|
|
|
|
#Generate request file
|
|
$OPENSSL req -new -key $KEYFILE -out $REQFILE -config $CONFIG
|
|
|
|
#Generate self signed certificate
|
|
$OPENSSL x509 -req -days $DAYS -in $REQFILE -signkey $KEYFILE -out $CERTFILE
|
|
|
|
#Verify
|
|
$OPENSSL x509 -subject -fingerprint -noout -in $CERTFILE || exit 2
|