forked from 0k/0k-charms
Browse Source
new: [ca] completed charm.
new: [ca] completed charm.
A new ``mkcrt`` script is provided handling ``--server`` and ``--altname``.postgres
3 changed files with 235 additions and 24 deletions
@ -0,0 +1,155 @@ |
|||
#!/bin/bash |
|||
|
|||
#:- |
|||
. /etc/shlib |
|||
#:- |
|||
|
|||
include common |
|||
include pretty |
|||
|
|||
usage="$exname [--server] [--altname ALTNAME] [--days DAYS] COMMONNAME EMAIL" |
|||
|
|||
|
|||
. /etc/default/ca |
|||
|
|||
CA_PASSWORD_FILE=${CA_PASSWORD_FILE:-$CA_CONFIG/password} |
|||
|
|||
if ! [ -e "$CA_PASSWORD_FILE" ]; then |
|||
die "Password file '$CA_PASSWORD_FILE' does not exist. Either create it or set \$CA_PASSWORD_FILE." |
|||
fi |
|||
|
|||
|
|||
## |
|||
## Arguments |
|||
## |
|||
|
|||
server_cert= |
|||
altnames=() |
|||
while [ "$1" ]; do |
|||
case "$1" in |
|||
"--server") |
|||
server_cert=true |
|||
;; |
|||
"--altname="*) |
|||
altnames=(${altnames[@]} ${1#--altname=}) |
|||
;; |
|||
"--altname") |
|||
altnames=(${altnames[@]} $2) |
|||
shift |
|||
;; |
|||
"--days="*) |
|||
DAYS="${1#--altname=}" |
|||
;; |
|||
"--days") |
|||
DAYS="${2}" |
|||
shift |
|||
;; |
|||
*) |
|||
[ -z ${common_name+x} ] && { common_name=$1 ; shift; continue; } |
|||
[ -z ${email+x} ] && { email=$1 ; shift; continue; } |
|||
die "Unexpected argument '$1'." |
|||
;; |
|||
esac |
|||
shift |
|||
done |
|||
|
|||
if [ -z "${common_name+x}" ] || [ -z "${email+x}" ]; then |
|||
err "Missing mandatory positional argument." |
|||
print_usage |
|||
exit 1 |
|||
fi |
|||
|
|||
for i in COUNTRY STATE ORGANISATION DAYS; do |
|||
if [ -z "${!i}" ]; then |
|||
die "Missing/Empty variable '$i'. You can add it to \`/etc/default/ca\`." |
|||
fi |
|||
done |
|||
|
|||
keyfile="$CA_DATA/keys/$common_name" |
|||
|
|||
if [ -e "$keyfile.crt+key" ]; then |
|||
warn "Keyfile '$keyfile.crt+key' already exist." |
|||
exit 0 |
|||
fi |
|||
|
|||
tmpdir=$(mktemp -d) |
|||
trap 'rm -rf "$tmpdir"' EXIT |
|||
|
|||
|
|||
## |
|||
## Subject building |
|||
## |
|||
|
|||
subject=() |
|||
[ -z "${COUNTRY+x}" ] || subject=("${subject[@]}" "C=$COUNTRY") |
|||
[ -z "${STATE+x}" ] || subject=("${subject[@]}" "ST=$STATE") |
|||
[ -z "${ORGANISATION+x}" ] || subject=("${subject[@]}" "O=$ORGANISATION") |
|||
subject=("${subject[@]}" "CN=$common_name") |
|||
subject=("${subject[@]}" "emailAddress=$email") |
|||
|
|||
SUBJECT=$(for elt in "${subject[@]}"; do echo -n "/$elt"; done) |
|||
|
|||
|
|||
## |
|||
## Openssl Options |
|||
## |
|||
|
|||
openssl_opts=() |
|||
openssl_req_opts=() |
|||
openssl_ca_opts=() |
|||
[ -z "${DAYS+x}" ] && openssl_opts=("${openssl_opts[@]}" "-days" "$DAYS") |
|||
|
|||
|
|||
if [ "$server_cert" ]; then |
|||
if ! egrep "^#\s*nsCertType\s*=\s*server\s*$" "/etc/ssl/openssl.cnf" > /dev/null 2>&1; then |
|||
err "Unexistent line about 'nsCertType' in '/etc/ssl/openssl.cnf' reference." |
|||
die "Can't activate the server certificate." |
|||
fi |
|||
[ -e "$tmpdir/openssl.cnf" ] || cp /etc/ssl/openssl.cnf "$tmpdir/openssl.cnf" |
|||
sed -ri 's/^#\s*(nsCertType\s*=\s*server\s*)$/\1/g' "$tmpdir/openssl.cnf" |
|||
new_openssl_cnf=true |
|||
fi |
|||
|
|||
if [ "${altnames[*]}" ]; then |
|||
[ -e "$tmpdir/openssl.cnf" ] || cp /etc/ssl/openssl.cnf "$tmpdir/openssl.cnf" |
|||
openssl_req_opts=("${openssl_req_opts[@]}" "-reqexts" SAN) |
|||
openssl_ca_opts=("${openssl_ca_opts[@]}" "-extensions" SAN) |
|||
cat <<EOF >> "$tmpdir/openssl.cnf" |
|||
[SAN] |
|||
subjectAltName = $(for altname in "${altnames[@]}"; do echo -n "DNS:$altname,"; done | rev | cut -c 2- | rev) |
|||
EOF |
|||
new_openssl_cnf=true |
|||
fi |
|||
|
|||
[ "$new_openssl_cnf" ] && openssl_opts=("${openssl_opts[@]}" "-config" "$tmpdir/openssl.cnf") |
|||
|
|||
|
|||
## |
|||
## Okay, lets do the real work |
|||
## |
|||
|
|||
cd "$tmpdir" |
|||
|
|||
Wrap -q -d "Generating request" <<EOF || exit 1 |
|||
openssl req -new -nodes \ |
|||
-keyout "$tmpdir/newkey.pem" \ |
|||
-out "$tmpdir/newreq.pem" \ |
|||
-subj "$SUBJECT" \ |
|||
${openssl_opts[@]} \ |
|||
${openssl_req_opts[@]} |
|||
|
|||
EOF |
|||
|
|||
Wrap -q -d "Signing request" <<EOF || exit 1 |
|||
openssl ca -batch \ |
|||
-policy policy_anything \ |
|||
-out "$tmpdir/newcert.pem" \ |
|||
-passin file:"$CA_PASSWORD_FILE" \ |
|||
${openssl_opts[@]} \ |
|||
${openssl_ca_opts[@]} \ |
|||
-infiles "$tmpdir/newreq.pem" |
|||
EOF |
|||
|
|||
mv newcert.pem "$keyfile.crt" |
|||
mv newkey.pem "$keyfile.key" |
|||
cat "$keyfile.crt" "$keyfile.key" > "$keyfile.crt+key" |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue