6 if [[ $# < 3 || $# > 4 ]]; then
7 echo "Invalid argument count." 1>&2
8 echo "Usage: $0 <action> <common name> <subject> [<additional domain>[,<additional domain>[,..]]]" 1>&2
9 echo "e.g.: $0 SGN mail.ionic.at /emailAddress=astra@fsinf.at/O=AstraCA/ smtp.ionic.at,imap.ionic.at"
13 mkdir -p output/csr output/crt output/sgn output/client
16 read -a certdata <<< "$*"
18 echo "*** Processing: $(date -Iseconds) - ${certdata[0]} - ${certdata[1]} ***"
19 if [[ -d "output/${certdata[1]}" ]] ; then
20 echo "*** ERROR - THIS SEEMS TO ALREADY EXIST ***" 1>&2
21 echo "*** ABORTED ***" 1>&2
25 mkdir "output/${certdata[1]}"
26 chmod o+x "output/${certdata[1]}"
27 cd "output/${certdata[1]}"
29 # Handle "CA" type here.
30 if [[ ${certdata[0]} == "CA" ]] ; then
31 mkdir -m 0700 certs crl newcerts
34 SUBJECT=$(echo -n "${certdata[2]}" | sed -e 's/_/ /g')
35 openssl req -batch -new -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -nodes -subj "${SUBJECT}" -reqexts v3_ca_req -config "${MYPWD}/openssl.cnf" -days 3650 &>/dev/null
39 # Handle non "CA" types here.
40 export CA_PATH="$MYPWD/ca/"
41 CNAME="$(echo -n "${certdata[1]}" | sed -e 's/_/ /g')"
42 SUBJECT="$(echo -n "${certdata[2]}" | sed -e 's/_/ /g')CN=${CNAME}/"
43 DNS_NAMES="${CNAME},$(echo -n "${certdata[3]}" | sed -e 's/_/ /g')"
46 cat "${MYPWD}/openssl.cnf" > /tmp/certgen.cnf
48 for name in $DNS_NAMES; do
49 if [[ "" == $name ]] ; then
52 COUNTER=$((COUNTER+1))
53 echo "DNS.${COUNTER} = $name" >> /tmp/certgen.cnf
59 openssl genrsa -out "${certdata[1]}.key" 4096 &> /dev/null
60 openssl req -new -key "${certdata[1]}.key" -out "${certdata[1]}.csr" -utf8 -batch -subj "${SUBJECT}" -config /tmp/certgen.cnf
62 if [[ ${certdata[0]} == "SGN" || ${certdata[0]} == "CLIENT" ]] ; then
63 if [[ ! -d "${CA_PATH}" ]] ; then
64 echo "*** ERROR - NO CA DATA FOUND ***" 1>&2
65 echo "*** maybe generate a CA and move it to ${CA_PATH} ***" 1>&2
66 echo "copy template: mv output/SomeNet ${CA_PATH}" 1>&2
67 echo "*** ABORTED ***" 1>&2
71 openssl ca -batch -create_serial -out "${certdata[1]}.crt" -days 365 -keyfile "${MYPWD}/ca/ca.key" -extensions v3_ca \
72 -config "${MYPWD}/openssl.cnf" -infiles "${certdata[1]}.csr"
73 cat "${MYPWD}/ca/ca.crt" >> "${certdata[1]}.crt"
75 if [[ ${certdata[0]} == "CLIENT" ]]; then
76 openssl pkcs12 -export -clcerts -in ${certdata[1]}.crt -inkey ${certdata[1]}.key -out ${certdata[1]}.p12 -name "${CNAME}" -passout pass:
77 openssl pkcs12 -in ${certdata[1]}.p12 -out ${certdata[1]}.pem -clcerts -passin pass: -passout pass:
80 elif [[ ${certdata[0]} == "CRT" ]] ; then
81 openssl x509 -req -signkey "${certdata[1]}.key" -in "${certdata[1]}.csr" -out "${certdata[1]}.crt" -extensions v3_req -extfile /tmp/certgen.cnf \
82 -days 365 -sha512 &> /dev/null
83 chmod o+r "${certdata[1]}.crt"
85 echo -n "${certdata[1]} " >> "${MYPWD}/output/fpfile.txt"
86 openssl x509 -in "${certdata[1]}.crt" -fingerprint -noout -sha512 >> "${MYPWD}/output/fpfile.txt"
87 echo "" >> "${MYPWD}/output/fpfile.txt"
93 if [[ ${certdata[0]} == "SGN" ]] ; then
94 mv "output/${certdata[1]}" "output/sgn/${certdata[1]}"
95 elif [[ ${certdata[0]} == "CRT" ]] ; then
96 mv "output/${certdata[1]}" "output/crt/${certdata[1]}"
97 elif [[ ${certdata[0]} == "CLIENT" ]]; then
98 mv "output/${certdata[1]}" "output/client/${certdata[1]}"
100 mv "output/${certdata[1]}" "output/csr/${certdata[1]}"