easy-ca/create-client at master · IcePlanet/easy-ca · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
#!/bin/bash
# Derek Moore <derek.moore@gmail.com>

usage() {
    echo "Usage: $0 -c CLIENT_NAME [-A]"
    echo "Issues a client certificate for CLIENT_NAME"
    echo
    echo "Options:"
    echo "    -c CLIENT_NAME  Client name (commonName) for the new cert"
    echo "    -A              Automateion mode, password read from env_variable EASY_CA_PASS"
    echo
    exit 2
}

CLIENT_NAME=
AUTOMODE=false
OPENSSH_ADDITIONAL_PARAMETERS=""

while getopts Ac: FLAG; do
    case $FLAG in
        c) CLIENT_NAME=${OPTARG} ;;
        A) AUTOMODE=true ;;
        *) usage ;;
    esac
done

if [ "${CLIENT_NAME}" == "" ]; then
    echo "ERROR: Client name empty"
    usage
fi

BIN_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${BIN_DIR}/functions
source ${BIN_DIR}/defaults.conf

SAFE_NAME=`echo $CLIENT_NAME | sed 's/\*/star/g'`
SAFE_NAME=`echo $SAFE_NAME | sed 's/[^A-Za-z0-9-]/-/g'`

echo
echo "Creating new client certificate for '${CLIENT_NAME}'"
echo

pushd ${BIN_DIR}/.. > /dev/null

if [ "${AUTOMODE}" = true ] ; then
    if [ -z "${EASY_CA_PASS}" ] ; then
        echo "ERROR: Automode set but no (or empty) password provided"
        exit 1
    else
        export OPENSSH_ADDITIONAL_PARAMETERS="-batch"
        export CA_PASS=${EASY_CA_PASS}
    fi
else
    echo -n "Enter passphase for signing CA key: "
    read -s PASS
    echo
    export CA_PASS=${PASS}
fi

# Generate the client cert openssl config
export SAN=""
export CA_USERNAME=${CLIENT_NAME}
if [ -f conf/${SAFE_NAME}.client.conf ]; then
    echo "WARNING: Configuration already exists for '${CLIENT_NAME}'"
else
    template "${BIN_DIR}/templates/client.tpl" "conf/${SAFE_NAME}.client.conf"
    echo "Template conf/${SAFE_NAME}.client.conf created "
fi

# Create the client key and csr
if [ -f csr/${SAFE_NAME}.client.csr ]; then
    echo "WARNING: CSR already exists for ${SAFE_NAME}."
else
    openssl req -new -nodes ${OPENSSH_ADDITIONAL_PARAMETERS} \
                -config conf/${SAFE_NAME}.client.conf \
                -keyout private/${SAFE_NAME}.client.key \
                -out csr/${SAFE_NAME}.client.csr
    chmod 0400 private/${SAFE_NAME}.client.key
    echo "Client CSR created csr/${SAFE_NAME}.client.csr"
fi

# Create the client certificate
if [ -f certs/${SAFE_NAME}.client.crt ]; then
    echo "WARNING: CRT already exists for ${SAFE_NAME}"
else
    openssl ca -batch -notext \
               -config conf/ca.conf \
               -in csr/${SAFE_NAME}.client.csr \
               -out certs/${SAFE_NAME}.client.crt \
               -days 3650 \
               -extensions client_ext \
               -passin env:CA_PASS
    echo "Client CRT created certs/${SAFE_NAME}.client.crt"
fi

popd > /dev/null

echo
echo "Client certificate created."
echo