A small utility to help make certificates. It's basically just all the OpenSSL commands that you normally need to remember written info a Makefile.
Before you can issue certificates, Makefile will create a root CA certificate based on root-ca.subj. If you customize this file, Makefile will generate a new root CA certificate, so be careful!
The Makefile can create files using this supply chain:
root-ca.crt<─┐
│
root-ca.key<─┤
│
*foo.subj<─┐ │
│ │
foo.key<──foo.req<──foo.crt
^ ^
│ │
└─────foo.p12───────┘
^
│
foo.jks
(A <─ B) means B requires A to be created
(*A) are files that are not automatically created
foo.subj is created by you by hand and should contain an X509 distinguished name (DN) in a format OpenSSL can understand. This can be as simple as
/CN=Foo Bar
or, more realistically
/DC=org/DC=example/OU=Users/CN=Foo Bar
Once the .subj file is in place, you can create any file along the chain:
make foo.key
make foo.req
make foo.crt
make foo.p12
make foo.jks
Just say make foo.jks to make everything.
Creating .jks files requires keytool be on the current $PATH.
gencert can act like an OCSP responder. First, generate certificates with authority info:
make EXTENSIONS=v3_req_aia foo.p12
Next, create an index.txt based on these certificates:
TODO, forgot how to do this
Finally, run the OCSP responder:
make ocsp
The DN of the root CA is controlled by root-ca.subj.
X509 extensions for client certificates are stored in openssl.cnf. To customize this, add a new section to the file:
[ custom_v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
authorityInfoAccess = OCSP;URI:http://localhost:8888
And create the request, certificate, or keystore with an appropriate EXTENSIONS argument:
make EXTENSIONS=custom_v3_req foo.p12
(gencert has to at least create the .req file for this to work, so you must remove it to change the extensions a particular cert has.)
Passwords are set in Makefile itself:
# Plain text password for the output files
PLAINPASS:=password
# Comment these out to have OpenSSL or keytool prompt for passwords
CAPASS:=pass:$(PLAINPASS)
KEYPASS:=pass:$(PLAINPASS)
P12PASS:=pass:$(PLAINPASS)
JKSPASS:=$(PLAINPASS)
By default, all passwords are password. If those variables are unset, Makefile will prompt multiple times for various passwords. This can be a bit confusing if generating a file that is derived from many other files, so it's probably a better idea to generate them one at a time in this configuration. Any one variable can be unset to protect just that one password (e.g. the CA key password).