-
Notifications
You must be signed in to change notification settings - Fork 2
/
makecert.sh
229 lines (214 loc) · 8.07 KB
/
makecert.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
#!/bin/sh
openssl=`which openssl`
# some optional terminal sequences
case $TERM in
xterm|xterm*|vt220|vt220*)
T_MD=`echo dummy | awk '{ printf("%c%c%c%c", 27, 91, 49, 109); }'`
T_ME=`echo dummy | awk '{ printf("%c%c%c", 27, 91, 109); }'`
;;
vt100|vt100*)
T_MD=`echo dummy | awk '{ printf("%c%c%c%c%c%c", 27, 91, 49, 109, 0, 0); }'`
T_ME=`echo dummy | awk '{ printf("%c%c%c%c%c", 27, 91, 109, 0, 0); }'`
;;
default)
T_MD=''
T_ME=''
;;
esac
# find some random files
# (do not use /dev/random here, because this device
# doesn't work as expected on all platforms)
randfiles=''
for file in /var/log/messages /var/adm/messages \
/kernel /vmunix /vmlinuz \
/etc/hosts /etc/resolv.conf; do
if [ -f $file ]; then
if [ ".$randfiles" = . ]; then
randfiles="$file"
else
randfiles="${randfiles}:$file"
fi
fi
done
echo "${T_MD}maketestcrt -- Create self-signed test certificate${T_ME}"
echo ""
target=/var/qmail/control/servercert.pem
if [ -s "$target" ];then
echo "$target already existsready exist, leaving intact"
exit
else
echo "creating $target"
fi
echo ""
tempdir=$(tempfile 2>/dev/null) || tempdir=/tmp/tmpssl-$$
trap "rm -f $tempfile" 0 1 2 5 15
mkdir -p $tempdir
pushd $tempdir > /dev/null
echo "${T_MD}INITIALIZATION${T_ME}"
echo ""
echo "${T_MD}Generating custom Certificate Authority (CA)${T_ME}"
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 1: Generating RSA private key for CA (2048 bit)${T_ME}"
cp /dev/null ca.rnd
echo '01' >ca.ser
if [ ".$randfiles" != . ]; then
$openssl genrsa -rand $randfiles -out ca.key 2048
else
$openssl genrsa -out ca.key 2048
fi
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate RSA private key" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 2: Generating X.509 certificate signing request for CA${T_ME}"
cat >.cfg <<EOT
[ req ]
default_bits = 2048
distinguished_name = req_DN
RANDFILE = ca.rnd
[ req_DN ]
countryName = "1. Country Name (2 letter code)"
#countryName_default = US
#countryName_min = 2
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (full name) "
#stateOrProvinceName_default = "North dakota"
localityName = "3. Locality Name (eg, city) "
#localityName_default = "Minot"
0.organizationName = "4. Organization Name (eg, company) "
0.organizationName_default = "Qmail Toaster Server"
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
organizationalUnitName_default = "For testing purposes only"
commonName = "6. Common Name (eg, CA name) "
commonName_max = 64
commonName_default = "www.qmailtoaster.com"
emailAddress = "7. Email Address (eg, name@FQDN)"
emailAddress_max = 40
#emailAddress_default = "[email protected]"
EOT
$openssl req -config .cfg -new -key ca.key -out ca.csr
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate certificate signing request" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 3: Generating X.509 certificate for CA signed by itself${T_ME}"
cat >.cfg <<EOT
#extensions = x509v3
#[ x509v3 ]
#subjectAltName = email:copy
#basicConstraints = CA:true,pathlen:0
#nsComment = "CCA generated custom CA certificate"
#nsCertType = sslCA
EOT
$openssl x509 -extfile .cfg -req -days 365 -signkey ca.key -in ca.csr -out ca.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate self-signed CA certificate" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}RESULT:${T_ME}"
$openssl verify ca.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to verify resulting X.509 certificate" 1>&2
exit 1
fi
$openssl x509 -text -in ca.crt
$openssl rsa -text -in ca.key
echo "${T_MD}CERTIFICATE GENERATION${T_ME}"
user="server"
echo ""
echo "${T_MD}Generating custom USER${T_ME} [$user]"
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 5: Generating RSA private key for USER (2048 bit)${T_ME}"
if [ ".$randfiles" != . ]; then
$openssl genrsa -rand $randfiles -out $user.key 2048
else
$openssl genrsa -out $user.key 2048
fi
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate RSA private key" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 6: Generating X.509 certificate signing request for USER${T_ME}"
cat >.cfg <<EOT
[ req ]
default_bits = 2048
distinguished_name = req_DN
RANDFILE = ca.rnd
[ req_DN ]
countryName = "1. Country Name (2 letter code)"
#countryName_default = XY
#countryName_min = 2
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (full name) "
#stateOrProvinceName_default = "Unknown"
localityName = "3. Locality Name (eg, city) "
#localityName_default = "Server Room"
0.organizationName = "4. Organization Name (eg, company) "
0.organizationName_default = "Qmail Toaster Server"
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
organizationalUnitName_default = "Test Certificate"
commonName = "6. Common Name (eg, DOMAIN NAME) "
commonName_max = 64
commonName_default = "localhost"
emailAddress = "7. Email Address (eg, name@fqdn)"
emailAddress_max = 40
#emailAddress_default = "root@localhost"
EOT
$openssl req -config .cfg -new -key $user.key -out $user.csr
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate certificate signing request" 1>&2
exit 1
fi
rm -f .cfg
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 7: Generating X.509 certificate signed by own CA${T_ME}"
cat >.cfg <<EOT
#extensions = x509v3
#[ x509v3 ]
#subjectAltName = email:copy
#basicConstraints = CA:false,pathlen:0
#nsComment = "CCA generated client certificate"
#nsCertType = client
EOT
$openssl x509 -extfile .cfg -days 365 -CAserial ca.ser -CA ca.crt -CAkey ca.key -in $user.csr -req -out $user.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate X.509 certificate" 1>&2
exit 1
fi
caname="`$openssl x509 -noout -text -in ca.crt |\
grep Subject: | sed -e 's;.*CN=;;' -e 's;/Em.*;;'`"
username="`$openssl x509 -noout -text -in $user.crt |\
grep Subject: | sed -e 's;.*CN=;;' -e 's;/Em.*;;'`"
# echo "Assembling PKCS#12 package"
# $openssl pkcs12 -export -in $user.crt -inkey $user.key -certfile ca.crt -name "$username" -caname "$caname" -out $user.p12
echo "______________________________________________________________________"
echo ""
echo "${T_MD}RESULT:${T_ME}"
$openssl verify -CAfile ca.crt $user.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to verify resulting X.509 certificate" 1>&2
exit 1
fi
$openssl x509 -text -in $user.crt
$openssl rsa -text -in $user.key
popd >/dev/null
rm -f $tempdir/*.csr
rm -f $tempdir/ca.*
cat $tempdir/server.crt \
$tempdir/server.key \
> $target
chown root:vchkpw $target
chmod 640 $target
echo "Certificate creation done!"
rm -rf $tempdir