easy-ca/create-server at master · IcePlanet/easy-ca · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
#!/bin/bash
# Derek Moore <derek.moore@gmail.com>

usage() {
    echo "Usage: $0 -s SERVER_NAME [-a ALT_NAME] [-A]..."
    echo "Issues a server certificate for SERVER_NAME"
    echo
    echo "Options:"
    echo "    -s SERVER_NAME  Server hostname (commonName) for the new cert"
    echo "    -a ALT_NAME     One (or more) subjectAltNames for the new cert (optional)"
    echo "    -A              Automateion mode, password read from env_variable EASY_CA_PASS"
    echo
    exit 2
}

SERVER_NAME=
ALT_NAME=
AUTOMODE=false
OPENSSH_ADDITIONAL_PARAMETERS=""

while getopts As:a: FLAG; do
    case $FLAG in
        s) SERVER_NAME=${OPTARG}
           if [ -z "${ALT_NAME}" ]; then
               ALT_NAME="DNS:${OPTARG}"
           else
               ALT_NAME="${ALT_NAME}, DNS:${OPTARG}"
           fi
           ;;
        a) if [ -z "${ALT_NAME}" ]; then
               ALT_NAME="DNS:${OPTARG}"
           else
               ALT_NAME="${ALT_NAME}, DNS:${OPTARG}"
           fi
           ;;
        A) AUTOMODE=true ;;
        *) usage
           ;;
    esac
done

if [ "${SERVER_NAME}" == "" ]; then
    echo "ERROR: Server name empty"
    usage
fi

BIN_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${BIN_DIR}/functions
source ${BIN_DIR}/defaults.conf

# Sanitize the commonName to make it suitable for use in filenames
SAFE_NAME=`echo ${SERVER_NAME} | sed 's/\*/star/g'`
SAFE_NAME=`echo ${SAFE_NAME} | sed 's/[^A-Za-z0-9-]/-/g'`

echo
echo "Creating new SSL server certificate for:"
echo "commonName: ${SERVER_NAME}"
echo "subjectAltName: ${ALT_NAME}"
echo

pushd ${BIN_DIR}/.. > /dev/null

if [ "${AUTOMODE}" = true ] ; then
    if [ -z "${EASY_CA_PASS}" ] ; then
        echo "ERROR: Automode set but no (or empty) password provided"
        exit 1
    else
        export OPENSSH_ADDITIONAL_PARAMETERS="-batch"
        export CA_PASS=${EASY_CA_PASS}
    fi
else
    echo -n "Enter passphase for signing CA key: "
    read -s PASS
    echo
    export CA_PASS=${PASS}
fi

# Generate the server openssl config
export CA_HOSTNAME=${SERVER_NAME}
export SAN=${ALT_NAME}
if [ -f conf/${SAFE_NAME}.server.conf ]; then
    echo "WARNING: Configuration already exists for ${SAFE_NAME}"
else
    template "${BIN_DIR}/templates/server.tpl" "conf/${SAFE_NAME}.server.conf"
    echo "Template conf/${SAFE_NAME}.server.conf created "
fi

# Create the server key and csr
if [ -f csr/${SAFE_NAME}.server.csr ]; then
    echo "WARNING: CSR already exists for ${SAFE_NAME}."
else
    openssl req -new -nodes ${OPENSSH_ADDITIONAL_PARAMETERS} \
                -config conf/${SAFE_NAME}.server.conf \
                -keyout private/${SAFE_NAME}.server.key \
                -out csr/${SAFE_NAME}.server.csr
    chmod 0400 private/${SAFE_NAME}.server.key
    echo "Server CSR created csr/${SAFE_NAME}.server.csr"
fi
# Create the server certificate
if [ -f certs/${SAFE_NAME}.server.crt ]; then
    echo "WARNING: CRT already exists for ${SAFE_NAME}"
else
    openssl ca -batch -notext \
               -config conf/ca.conf \
               -in csr/${SAFE_NAME}.server.csr \
               -out certs/${SAFE_NAME}.server.crt \
               -days 3650 \
               -extensions server_ext \
               -passin env:CA_PASS
    echo "Server CRT created certs/${SAFE_NAME}.server.crt"
fi

popd > /dev/null

echo
echo "Server certificate created."
echo