|
| 1 | +#!/bin/bash |
| 2 | +# |
| 3 | +# |
| 4 | +# This scripts generates: |
| 5 | +# - root CA certificate |
| 6 | +# - server certificate and keystore |
| 7 | +# - client keys |
| 8 | +# |
| 9 | +# Based off of |
| 10 | +# https://github.com/confluentinc/librdkafka/blob/master/tests/gen-ssl-certs.sh |
| 11 | + |
| 12 | +OP="$1" |
| 13 | +CA_CERT="$2" |
| 14 | +PFX="$3" |
| 15 | +HOST="$4" |
| 16 | + |
| 17 | +C=NN |
| 18 | +ST=NN |
| 19 | +L=NN |
| 20 | +O=NN |
| 21 | +OU=NN |
| 22 | +CN="$HOST" |
| 23 | + |
| 24 | + |
| 25 | +# Password |
| 26 | +PASS="secret" |
| 27 | + |
| 28 | +# Cert validity, in days |
| 29 | +VALIDITY=10000 |
| 30 | + |
| 31 | +set -e |
| 32 | + |
| 33 | +export LC_ALL=C |
| 34 | + |
| 35 | +if [[ $OP == "ca" && -n "$CA_CERT" && -n "$3" ]]; then |
| 36 | + CN="$3" |
| 37 | + openssl req -new -x509 -keyout "${CA_CERT}.key" -out "${CA_CERT}" -days $VALIDITY -passin "pass:$PASS" -passout "pass:$PASS" <<EOF |
| 38 | +${C} |
| 39 | +${ST} |
| 40 | +${L} |
| 41 | +${O} |
| 42 | +${OU} |
| 43 | +${CN} |
| 44 | +$USER@${CN} |
| 45 | +. |
| 46 | +. |
| 47 | +EOF |
| 48 | + |
| 49 | + |
| 50 | + |
| 51 | +elif [[ $OP == "server" && -n "$CA_CERT" && -n "$PFX" && -n "$CN" ]]; then |
| 52 | + HOST_CERT_CONFIG_PATH="${PFX}host_cert.cnf" |
| 53 | + HOST_PRIVATE_RSA_KEY_PATH="${PFX}host_private_key_rsa.pem" |
| 54 | + HOST_PRIVATE_KEY_PATH="${PFX}private_key.pem" |
| 55 | + HOST_CSR_PATH="${PFX}host_csr.pem" |
| 56 | + HOST_CERT_PATH="${PFX}host_cert.pem" |
| 57 | + HOST_CERT_CHAIN_PATH="${PFX}client_${CN}.pem" |
| 58 | + |
| 59 | + # Create the CA cert config file |
| 60 | + echo "Setting up host certs..." |
| 61 | + |
| 62 | + cat <<EOF > "${HOST_CERT_CONFIG_PATH}" |
| 63 | +[req] |
| 64 | +default_bits = 2048 |
| 65 | +distinguished_name = req_distinguished_name |
| 66 | +req_extensions = v3_req |
| 67 | +prompt = no |
| 68 | +[req_distinguished_name] |
| 69 | +C = ${C} |
| 70 | +ST = ${ST} |
| 71 | +L = ${L} |
| 72 | +O = ${O} |
| 73 | +CN = ${CN} |
| 74 | +[v3_req] |
| 75 | +subjectAltName = @alt_names |
| 76 | +[alt_names] |
| 77 | +DNS.1 = ${CN} |
| 78 | +DNS.2 = localhost. |
| 79 | +EOF |
| 80 | + |
| 81 | + #Step 1 |
| 82 | + echo "############ Generating key" |
| 83 | + openssl genrsa -out "${HOST_PRIVATE_RSA_KEY_PATH}" 2048 |
| 84 | + openssl pkcs8 -nocrypt -topk8 -v1 PBE-SHA1-RC4-128 -inform pem -outform pem -in "${HOST_PRIVATE_RSA_KEY_PATH}" -out "${HOST_PRIVATE_KEY_PATH}" |
| 85 | + |
| 86 | + #Step 2 |
| 87 | + echo "############ Generate the CSR" |
| 88 | + openssl req -nodes -new -extensions v3_req -sha256 -config "${HOST_CERT_CONFIG_PATH}" -key "${HOST_PRIVATE_KEY_PATH}" -out "${HOST_CSR_PATH}" |
| 89 | + |
| 90 | + #Step 3 |
| 91 | + echo "############ Generate the cert" |
| 92 | + openssl x509 -req -in "${HOST_CSR_PATH}" -CA "${CA_CERT}" -CAkey "${CA_CERT}.key" -CAcreateserial -out "${HOST_CERT_PATH}" -days ${VALIDITY} -sha256 -extensions v3_req -extfile "${HOST_CERT_CONFIG_PATH}" -passin "pass:${PASS}" |
| 93 | + |
| 94 | + cat "${HOST_CERT_PATH}" > "${HOST_CERT_CHAIN_PATH}" |
| 95 | + |
| 96 | + |
| 97 | +elif [[ $OP == "client" && -n "$CA_CERT" && -n "$PFX" && -n "$CN" ]]; then |
| 98 | + |
| 99 | +# Standard OpenSSL keys |
| 100 | + echo "############ Generating key" |
| 101 | + openssl genrsa -nodes -passout "pass:${PASS}" -out "${PFX}client.key" 2048 |
| 102 | + |
| 103 | + echo "############ Generating request" |
| 104 | + openssl req -passin "pass:${PASS}" -passout "pass:${PASS}" -key "${PFX}client.key" -new -out "${PFX}client.req" \ |
| 105 | + <<EOF |
| 106 | +$C |
| 107 | +$ST |
| 108 | +$L |
| 109 | +$O |
| 110 | +$OU |
| 111 | +$CN |
| 112 | +. |
| 113 | +$PASS |
| 114 | +. |
| 115 | +EOF |
| 116 | + |
| 117 | + echo "########### Signing key" |
| 118 | + openssl x509 -req -passin "pass:${PASS}" -in "${PFX}client.req" -CA "${CA_CERT}" -CAkey "${CA_CERT}.key" -CAcreateserial -out "${PFX}client.pem" -days ${VALIDITY} |
| 119 | + |
| 120 | + |
| 121 | +else |
| 122 | + echo "Usage: $0 ca <ca-cert-file> <CN>" |
| 123 | + echo " $0 server|client <ca-cert-file> <file_prefix> <hostname>" |
| 124 | + echo "" |
| 125 | + exit 1 |
| 126 | +fi |
| 127 | + |
0 commit comments