singlecertgen.sh

   1 #!/bin/bash
   2
   3 MYPWD=$(pwd)
   4 umask 0027
   5
   6 if  [[ $# < 3 || $# > 4 ]]; then
   7         echo "Invalid argument count." 1>&2
   8         echo "Usage: $0 <action> <common name> <subject> [<additional domain>[,<additional domain>[,..]]]" 1>&2
   9         echo "e.g.: $0 SGN mail.ionic.at /emailAddress=astra@fsinf.at/O=AstraCA/ smtp.ionic.at,imap.ionic.at"
  10         exit 1
  11 fi
  12
  13 mkdir -p output/csr output/crt output/sgn
  14
  15 cd $MYPWD
  16 read -a certdata <<< "$*"
  17
  18 echo "*** Processing: $(date -Iseconds) - ${certdata[0]} - ${certdata[1]} ***"
  19 if [[ -d "output/${certdata[1]}"  ]] ; then
  20         echo "*** ERROR - THIS SEEMS TO ALREADY EXIST ***" 1>&2
  21         echo "*** ABORTED ***" 1>&2
  22         exit 1
  23 fi
  24
  25 mkdir "output/${certdata[1]}"
  26 chmod o+x "output/${certdata[1]}"
  27 cd "output/${certdata[1]}"
  28
  29 # Handle "CA" type here.
  30 if [[ ${certdata[0]} == "CA" ]] ; then
  31         mkdir -m 0700 certs crl newcerts
  32         touch index.txt
  33         export CA_PATH="./"
  34         SUBJECT=$(echo -n "${certdata[2]}" | sed -e 's/_/ /g')
  35         openssl req -batch -new -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -nodes -subj "${SUBJECT}" -reqexts v3_ca_req -config "${MYPWD}/openssl.cnf" -days 3650 &>/dev/null
  36         exit 0
  37 fi
  38
  39 # Handle non "CA" types here.
  40 export CA_PATH="$MYPWD/ca/"
  41 SUBJECT="$(echo -n "${certdata[2]}" | sed -e 's/_/ /g')CN=${certdata[1]}/"
  42 DNS_NAMES="${certdata[1]},${certdata[3]}"
  43 OLDIFS=$IFS
  44 IFS=","
  45 cat "${MYPWD}/openssl.cnf" > /tmp/certgen.cnf
  46 COUNTER=0
  47 for name in $DNS_NAMES; do
  48         if [[ "" == $name ]] ; then
  49                 break
  50         fi
  51         COUNTER=$((COUNTER+1))
  52         echo "DNS.${COUNTER} = $name" >> /tmp/certgen.cnf
  53 done
  54 IFS=$OLDIFS
  55 unset OLDIFS
  56 unset COUNTER
  57
  58 openssl genrsa -out "${certdata[1]}.key" 4096 &> /dev/null
  59 openssl req -new -key "${certdata[1]}.key" -out "${certdata[1]}.csr" -utf8 -batch -subj "${SUBJECT}" -config /tmp/certgen.cnf
  60
  61 if [[ ${certdata[0]} == "SGN" ]] ; then
  62         if [[ ! -d "${CA_PATH}"  ]] ; then
  63                 echo "*** ERROR - NO CA DATA FOUND ***" 1>&2
  64                 echo "*** maybe generate a CA and move it to ${CA_PATH} ***" 1>&2
  65                 echo "copy template: mv output/SomeNet ${CA_PATH}" 1>&2
  66                 echo "*** ABORTED ***" 1>&2
  67                 exit 2
  68         fi
  69
  70         openssl ca -batch -create_serial -out "${certdata[1]}.crt" -days 365 -keyfile "${MYPWD}/ca/ca.key" -extensions v3_ca \
  71                 -config "${MYPWD}/openssl.cnf" -infiles "${certdata[1]}.csr"
  72         cat "${MYPWD}/ca/ca.crt" >> "${certdata[1]}.crt"
  73
  74 elif [[ ${certdata[0]} == "CRT" ]] ; then
  75         openssl x509 -req -signkey "${certdata[1]}.key" -in "${certdata[1]}.csr" -out "${certdata[1]}.crt" -extensions v3_req -extfile /tmp/certgen.cnf \
  76                 -days 365 -sha512 &> /dev/null
  77         chmod o+r "${certdata[1]}.crt"
  78
  79         echo -n "${certdata[1]} " >> "${MYPWD}/output/fpfile.txt"
  80         openssl x509 -in "${certdata[1]}.crt" -fingerprint -noout -sha512 >> "${MYPWD}/output/fpfile.txt"
  81         echo "" >> "${MYPWD}/output/fpfile.txt"
  82 fi
  83
  84 rm /tmp/certgen.cnf
  85 cd $MYPWD
  86
  87 if [[ ${certdata[0]} == "SGN" ]] ; then
  88         mv "output/${certdata[1]}" "output/sgn/${certdata[1]}"
  89 elif [[ ${certdata[0]} == "CRT" ]] ; then
  90         mv "output/${certdata[1]}" "output/crt/${certdata[1]}"
  91 else
  92         mv "output/${certdata[1]}" "output/csr/${certdata[1]}"
  93 fi
  94