create-root-ca

#!/bin/bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>

set -eu

umask 0077
set -o pipefail

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
# shellcheck disable=SC1090
source "${BIN_DIR}/functions"
# shellcheck disable=SC1090
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 [-l] -d CA_DIR"
    echo "Initializes a new root CA in the directory CA_DIR"
    echo
    echo "Options:"
    echo "    -d CA_DIR  Target directory to be created and initialized"
    echo "               Must not exist yet"
    echo "    -l         Symlink toolchain (designed for development)"
    echo
}

CA_DIR=
SYMLINK=0

while getopts "d:hl" FLAG; do
    case $FLAG in
        d) CA_DIR=${OPTARG} ;;
        h) echo -e -n "$SUCC " && usage && exit 0;;
        l) SYMLINK=1 ;;
        *) echo -e -n "$ERR " && usage && exit 2;;
    esac
done

if [ $OPTIND -le $# ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [ "${CA_DIR}" = "" ]; then
    echo -e -n "$SUCC " && usage && exit 1
fi

CA_NAME="$( basename "${CA_DIR}" )"
export CA_NAME

echo -e "$NOTE Creating root CA in dir '${CA_DIR}'"

init_ca_home "${CA_DIR}"
trap 'rm -Rf "${CA_DIR}"' 0 2
generate_conf "${CA_DIR}/bin/defaults.conf"
# shellcheck disable=SC1090
source "${CA_DIR}/bin/defaults.conf"

# shellcheck disable=SC2153
CA_CERT_CN="${CA_CERT_O} Certificate Authority"
echo -e -n "$INPUT Common Name for CA certificate [${CA_CERT_CN}]: "
read -r CERT_CN
if [ -n "${CERT_CN}" ]; then
    CA_CERT_CN="${CERT_CN}"
fi

echo
echo -e -n "$INPUT Enter passphase for encrypting root CA key: "
read -r -s PASS1
echo
if [ ${#PASS1} -lt 4 ]; then
    echo -e "$ERR Passphrase is too short, please use at least 4 characters!"
    exit 1
fi
echo -e -n "$INPUT Verifying - Enter passphase for encrypting root CA key: "
read -r -s PASS2
echo
if [ "${PASS1}" != "${PASS2}" ]; then
    echo -e "$ERR Passphrases did not match, exiting."
    exit 1
fi

export CA_PASS="${PASS1}"
export SAN=""

CA_PATH="$( fullpath "${CA_DIR}")"
export CA_PATH

pushd "${CA_DIR}" > /dev/null

# Generate the root CA openssl config
template "${BIN_DIR}/templates/root.tpl" "ca/ca.conf"

echo -e "$NOTE Creating the root CA key (${CA_KEY_ALG} with ${CA_KEY_LENGTH_ROOTCA} bits)"

openssl genrsa -out ca/private/ca.key -"${CA_KEY_ALG}" -passout env:CA_PASS "${CA_KEY_LENGTH_ROOTCA}"
chmod 0400 ca/private/ca.key

echo -e "$NOTE Creating the root CA csr"

openssl req -new -batch \
            -config ca/ca.conf \
            -key ca/private/ca.key \
            -out ca/ca.csr \
            -passin env:CA_PASS

echo -e "$NOTE Creating the root CA certificate"

openssl ca -selfsign -batch -notext \
           -config ca/ca.conf \
           -in ca/ca.csr \
           -out ca/ca.crt \
           -extensions root_ca_ext \
           -passin env:CA_PASS

ln -s ca.crt ca/chain.pem
ln -s ca.crt ca/root.crt

echo -e "$NOTE Creating the root CA CRL"

openssl ca -gencrl -batch \
           -config ca/ca.conf \
           -out ca/ca.crl \
           -passin env:CA_PASS

if [ $SYMLINK -eq 1 ]; then
    echo -e "$NOTE Symlinking toolchain (dev mode)"
    CP_CMD='ln -s'
else
    echo -e "$NOTE Copying toolchain"
    CP_CMD='cp'
fi
$CP_CMD "${BIN_DIR}/README.md" README.md
for BIN in ${BINARIES_ROOT}; do
    $CP_CMD "${BIN_DIR}/${BIN}" bin/
done
mkdir bin/templates/
for TPL in ${TEMPLATES_ROOT}; do
    $CP_CMD "${BIN_DIR}/templates/${TPL}" bin/templates/
done


popd > /dev/null

unset CA_PASS

trap - 0 2

echo -e "$SUCC Root CA initialized."