]> git.somenet.org - somenet/certgen.git/blob - certgen.sh
Allow spaces in CA-cert subject too. (Suggested by Astra)
[somenet/certgen.git] / certgen.sh
1 #!/bin/bash
2
3 MYPWD=$(pwd)
4 umask 0027
5
6 echo "cleanup previous run..."
7 rm -rf output/*
8 mkdir output/csr output/crt output/sgn
9
10 while read cdline ; do
11         if [[ $cdline == "" || $cdline == "#"* ]] ; then
12                 continue
13         fi
14
15         cd $MYPWD
16         read -a certdata <<< "$cdline"
17
18         if [[ ${certdata[0]} == "EXIT" ]] ; then
19                 echo "*** $cdline ***" 1>&2
20                 exit ${certdata[1]}
21         fi
22
23         echo "*** Processing: $(date -Iseconds) - ${certdata[0]} - ${certdata[1]} ***"
24         if [[ -d "output/${certdata[1]}"  ]] ; then
25                 echo "*** ERROR - THIS SEEMS TO ALREADY EXIST ***" 1>&2
26                 echo "*** ABORTED ***" 1>&2
27                 exit 1
28         fi
29
30         mkdir "output/${certdata[1]}"
31         chmod o+x "output/${certdata[1]}"
32         cd "output/${certdata[1]}"
33
34         # Handle "CA" type here.
35         if [[ ${certdata[0]} == "CA" ]] ; then
36                 mkdir -m 0700 certs crl newcerts
37                 touch index.txt
38                 export CA_PATH="./"
39                 SUBJECT=$(echo -n "${certdata[2]}" | sed -e 's/_/ /g')
40                 openssl req -batch -new -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -nodes -subj "${SUBJECT}" -reqexts v3_ca_req -config "${MYPWD}/openssl.cnf" -days 3650 &>/dev/null
41                 continue
42         fi
43
44
45         # Handle non "CA" types here.
46         export CA_PATH="$MYPWD/ca/"
47         SUBJECT="$(echo -n "${certdata[2]}" | sed -e 's/_/ /g')CN=${certdata[1]}/"
48         DNS_NAMES="${certdata[1]},${certdata[3]}"
49         OLDIFS=$IFS
50         IFS=","
51         cat "${MYPWD}/openssl.cnf" > /tmp/certgen.cnf
52         COUNTER=0
53         for name in $DNS_NAMES; do
54                 if [[ "" == $name ]] ; then
55                         continue
56                 fi
57                 COUNTER=$((COUNTER+1))
58                 echo "DNS.${COUNTER} = $name" >> /tmp/certgen.cnf
59         done
60         IFS=$OLDIFS
61         unset OLDIFS
62         unset COUNTER
63         
64         openssl genrsa -out "${certdata[1]}.key" 4096 &> /dev/null
65         openssl req -new -key "${certdata[1]}.key" -out "${certdata[1]}.csr" -utf8 -batch -subj "${SUBJECT}" -config /tmp/certgen.cnf
66
67         if [[ ${certdata[0]} == "SGN" ]] ; then
68                 if [[ ! -d "${CA_PATH}"  ]] ; then
69                         echo "*** ERROR - NO CA DATA FOUND ***" 1>&2
70                         echo "*** maybe generate a CA and move it to ${CA_PATH} ***" 1>&2
71                         echo "copy template: mv output/SomeNet ${CA_PATH}" 1>&2
72                         echo "*** ABORTED ***" 1>&2
73                         exit 2
74                 fi
75
76                 openssl ca -batch -create_serial -out "${certdata[1]}.crt" -days 365 -keyfile "${MYPWD}/ca/ca.key" -extensions v3_ca \
77                         -config "${MYPWD}/openssl.cnf" -infiles "${certdata[1]}.csr"
78                 cat "${MYPWD}/ca/ca.crt" >> "${certdata[1]}.crt"
79
80         elif [[ ${certdata[0]} == "CRT" ]] ; then
81                 openssl x509 -req -signkey "${certdata[1]}.key" -in "${certdata[1]}.csr" -out "${certdata[1]}.crt" -extensions v3_req -extfile /tmp/certgen.cnf \
82                         -days 365 -sha512 &> /dev/null
83                 chmod o+r "${certdata[1]}.crt"
84
85                 echo -n "${certdata[1]} " >> "${MYPWD}/output/fpfile.txt"
86                 openssl x509 -in "${certdata[1]}.crt" -fingerprint -noout -sha512 >> "${MYPWD}/output/fpfile.txt"
87                 echo "" >> "${MYPWD}/output/fpfile.txt"
88         fi
89
90         rm /tmp/certgen.cnf
91         cd $MYPWD
92
93         if [[ ${certdata[0]} == "SGN" ]] ; then
94                 mv "output/${certdata[1]}" "output/sgn/${certdata[1]}"
95         elif [[ ${certdata[0]} == "CRT" ]] ; then
96                 mv "output/${certdata[1]}" "output/crt/${certdata[1]}"
97         else
98                 mv "output/${certdata[1]}" "output/csr/${certdata[1]}"
99         fi
100
101 done < certgen.data
102
103 echo "*** DONE ***"
104 ls -l "${MYPWD}/output/"*/ | grep -v "total"
105