forked from cgzones/easy-ca
-
Notifications
You must be signed in to change notification settings - Fork 11
/
create-root-ca
executable file
·163 lines (130 loc) · 4.17 KB
/
create-root-ca
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
#!/usr/bin/env bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>
set -eu
umask 0077
set -o pipefail
BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "${BIN_DIR}/functions"
source "${BIN_DIR}/defaults.conf"
usage() {
echo "Usage: $0 [-l] -d CA_DIR"
echo "Initializes a new root CA in the directory CA_DIR"
echo
echo "Options:"
echo " -d CA_DIR Target directory to be created and initialized"
echo " Must not exist yet"
echo " -l Symlink toolchain (designed for development)"
echo
}
CA_DIR=
SYMLINK=0
while getopts "d:hl" FLAG; do
case $FLAG in
d) CA_DIR=${OPTARG} ;;
h) echo -e -n "$SUCC " && usage && exit 0;;
l) SYMLINK=1 ;;
*) echo -e -n "$ERR " && usage && exit 2;;
esac
done
if [ $OPTIND -le $# ]; then
echo -e -n "$ERR " && usage && exit 2
elif [[ "${CA_DIR}" = "" ]]; then
echo -e -n "$SUCC " && usage && exit 1
fi
CA_NAME="$( basename "${CA_DIR}" )"
export CA_NAME
echo -e "$NOTE Creating root CA in dir '${CA_DIR}'"
init_ca_home "${CA_DIR}"
trap 'rm -Rf "${CA_DIR}"' 0
generate_conf "${CA_DIR}/bin/defaults.conf"
source "${CA_DIR}/bin/defaults.conf"
CA_CERT_CN="${CA_CERT_O} Certificate Authority"
CA_CERT_CN=`ask "$INPUT Common Name for CA certificate [${CA_CERT_CN}]: " CA_ROOT_CN_DEFAULT "${CA_CERT_CN}"`
if [[ -n $CA_ENABLE_ENGINE ]]; then
init_engine
# Slot 9c requires PIN entry on every operation.
# No need to ask for the PIN for re-use.
export CA_PASS="$(ask_pass_once "Enter PIN for signing root key:" CA_ROOT_PASS_DEFAULT "${ROOT_PASS:-""}")"
init_slot 9c "${CA_DIR}/ca/ca.pub" "pkcs11:object=SIGN%20key"
else
export CA_PASS="$(ask_pass_twice_verify "Enter passphrase for encrypting signing root CA key:" CA_ROOT_PASS_DEFAULT "${ROOT_PASS:-""}")"
fi
CA_PATH="${CA_PATH:-$( fullpath "${CA_DIR}")}"
export CA_PATH
pushd "${CA_DIR}" > /dev/null
# Generate the root CA openssl config
template "${BIN_DIR}/templates/root.tpl" "ca/ca.conf"
# Generate the root CA openssh config
mkdir -p ca/ssh
echo $( od -vAn -N2 -tu2 < /dev/urandom )00 > ca/ssh/serial
# Create the signing CA key
if [[ -z $CA_ENABLE_ENGINE ]]; then
generate_key ca/private/ca.key
ln -s ../private/ca.key ca/ssh/ca.ssh
generate_pubkey ca/private/ca.key ca/ca.pub
else
generate_pubkey_pkcs11 pkcs11:object=SIGN%20key ca/ca.pub
fi
generate_pubkey_ssh ca/ca.pub ca/ssh/ca.ssh.pub ${CA_DIR}
echo -e "$NOTE Creating the root CA csr" >&2
openssl_engine_cmd="\
-engine pkcs11 \
-keyform engine \
-key pkcs11:object=SIGN%20key"
openssl req -new -batch \
${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
$( [ -z $CA_ENABLE_ENGINE ] && echo "-key ca/private/ca.key") \
-config ca/ca.conf \
-out ca/ca.csr \
-passin env:CA_PASS
echo >&2
echo -e "$NOTE Creating the root CA certificate" >&2
openssl_engine_cmd="\
-engine pkcs11 \
-keyform engine \
-keyfile pkcs11:object=SIGN%20key"
openssl ca \
${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
-selfsign -batch -notext \
-config ca/ca.conf \
-in ca/ca.csr \
-out ca/ca.crt \
-extensions root_ca_ext \
-passin env:CA_PASS
ln -s ca.crt ca/chain.pem
ln -s ca.crt ca/root.crt
echo
if [[ -n "$CA_ENABLE_ENGINE" ]]; then
replace_crt 9c ca/ca.crt
fi
echo
echo -e "$NOTE Creating the root CA CRL" >&2
openssl ca -gencrl -batch \
${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
-config ca/ca.conf \
-out ca/ca.crl \
-passin env:CA_PASS
echo
if [ $SYMLINK -eq 1 ]; then
echo -e "$NOTE Symlinking toolchain (dev mode)" >&2
CP_CMD='ln -s'
else
echo -e "$NOTE Copying toolchain" >&2
CP_CMD='cp'
fi
$CP_CMD "${BIN_DIR}/README.md" README.md
for BIN in ${BINARIES_ROOT}; do
$CP_CMD "${BIN_DIR}/${BIN}" bin/
done
mkdir bin/templates/
for TPL in ${TEMPLATES_ROOT}; do
$CP_CMD "${BIN_DIR}/templates/${TPL}" bin/templates/
done
popd > /dev/null
unset CA_PASS
trap 0
echo -e "$SUCC Root CA initialized." >&2