Skip to content

Commit f7fcb46

Browse files
author
Craig Hicks
committed
first commit
0 parents  commit f7fcb46

File tree

5 files changed

+449
-0
lines changed

5 files changed

+449
-0
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# private-CA-script

‎ca.sh

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
6+
ca_build()
7+
(
8+
9+
function finish {
10+
# Your cleanup code here
11+
echo "finish"
12+
exit 0
13+
}
14+
trap finish EXIT
15+
16+
17+
18+
local CaRoot=/root/ca
19+
local Imed=/root/ca/intermediate
20+
local ScriptDir=/root/ca-scripts
21+
22+
echo_script()
23+
{
24+
while read line; do
25+
if [[ -z $line ]]; then continue; fi
26+
echo ">>>>>>"
27+
echo ">>>>>> $line"
28+
eval "$line"
29+
rc=$?
30+
if [[ $rc -ne 0 ]]; then
31+
echo "ERROR $rc stop processing"
32+
return 1
33+
fi
34+
done
35+
}
36+
37+
38+
uninstall()
39+
{
40+
rm -rf $CaRoot
41+
}
42+
43+
init_ca()
44+
{
45+
mkdir $CaRoot
46+
cd $CaRoot
47+
cp $ScriptDir/openssl-ca.cnf .
48+
mkdir certs crl newcerts private
49+
chmod 700 private
50+
touch index.txt
51+
tree $CaRoot
52+
# echo 1000 > serial
53+
}
54+
55+
init_intermediate()
56+
{
57+
mkdir -p $Imed
58+
cd $Imed
59+
cp $ScriptDir/openssl-intermediate.cnf .
60+
mkdir certs crl csr newcerts private
61+
chmod 700 private
62+
touch index.txt
63+
tree $CaRoot
64+
#echo 1000 > serial
65+
#echo 1000 > /root/ca/intermediate/crlnumber
66+
}
67+
68+
make_ca_cert()
69+
{
70+
echo_script <<EOF_
71+
openssl genrsa -out $CaRoot/private/ca.key.pem 4096 # add -aes256 for password
72+
chmod 400 $CaRoot/private/ca.key.pem
73+
openssl req -batch -config $CaRoot/openssl-ca.cnf \
74+
-key $CaRoot/private/ca.key.pem \
75+
-new -x509 -days 7300 -sha256 -extensions v3_ca \
76+
-out $CaRoot/certs/ca.cert.pem
77+
chmod 444 $CaRoot/certs/ca.cert.pem
78+
openssl x509 -noout -text -in $CaRoot/certs/ca.cert.pem
79+
EOF_
80+
}
81+
82+
make_intermediate_cert()
83+
{
84+
echo_script <<EOF_
85+
echo_script <<EOF_
86+
openssl genrsa -out $Imed/private/intermediate.key.pem 4096 # add -aes256 for password
87+
# Create the request
88+
openssl req -batch -config $Imed/openssl-intermediate.cnf -new -sha256 \
89+
-key $Imed/private/intermediate.key.pem \
90+
-out $Imed/csr/intermediate.csr.pem
91+
# Sign the certificate
92+
openssl ca -batch -config $CaRoot/openssl-ca.cnf -extensions v3_intermediate_ca \
93+
-create_serial \
94+
-days 3650 -notext -md sha256 \
95+
-in $Imed/csr/intermediate.csr.pem \
96+
-out $Imed/certs/intermediate.cert.pem
97+
chmod 444 $Imed/certs/intermediate.cert.pem
98+
cat $CaRoot/index.txt
99+
# Check details
100+
openssl x509 -noout -text \
101+
-in $Imed/certs/intermediate.cert.pem
102+
# Verify chain of trust
103+
openssl verify -CAfile $CaRoot/certs/ca.cert.pem \
104+
$Imed/certs/intermediate.cert.pem
105+
EOF_
106+
107+
cat $Imed/certs/intermediate.cert.pem \
108+
$CaRoot/certs/ca.cert.pem > $Imed/certs/ca-chain.cert.pem
109+
chmod 444 $Imed/certs/ca-chain.cert.pem
110+
}
111+
112+
make_usr_cert() #arg $1: unique identifier
113+
{
114+
if [[ -z $1 ]]; then
115+
echo "unique identifier required"
116+
return 1
117+
fi
118+
local Id=$1
119+
echo_script <<EOF_
120+
openssl genrsa -out $Imed/private/$Id.key.pem 2048 # -aes256 left out, no password used
121+
chmod 400 $Imed/private/$Id.key.pem
122+
openssl req -batch -config $Imed/openssl-intermediate.cnf \
123+
-subj "/CN=$Id" \
124+
-key $Imed/private/$Id.key.pem \
125+
-new -sha256 -out $Imed/csr/$Id.csr.pem
126+
127+
openssl ca -batch -config $Imed/openssl-intermediate.cnf \
128+
-create_serial \
129+
-extensions usr_cert -days 375 -notext -md sha256 \
130+
-in $Imed/csr/$Id.csr.pem \
131+
-out $Imed/certs/$Id.cert.pem
132+
chmod 444 $Imed/certs/$Id.cert.pem
133+
134+
cat $Imed/index.txt
135+
136+
# Check details
137+
openssl x509 -noout -text \
138+
-in $Imed/certs/$Id.cert.pem
139+
140+
# Verify chain of trust
141+
openssl verify -CAfile $Imed/certs/ca-chain.cert.pem \
142+
$Imed/certs/$Id.cert.pem
143+
144+
EOF_
145+
}
146+
147+
test()
148+
{
149+
echo_script <<EOF_
150+
uninstall
151+
init_ca
152+
make_ca_cert
153+
init_intermediate
154+
make_intermediate_cert
155+
make_usr_cert my-client
156+
EOF_
157+
158+
}
159+
160+
${@}
161+
162+
)
163+

‎git-init.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
echo "# private-CA-script" >> README.md
2+
git init
3+
git add README.md *.sh *.cnf
4+
git commit -m "first commit"
5+
git remote add origin [email protected]:craigphicks/private-CA-script.git
6+
git push -u origin master

‎openssl-ca.cnf

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# OpenSSL root CA configuration file.
2+
# Copy to `/root/ca/openssl.cnf`.
3+
4+
[ ca ]
5+
# `man ca`
6+
default_ca = CA_default
7+
8+
[ CA_default ]
9+
# Directory and file locations.
10+
dir = /root/ca
11+
certs = $dir/certs
12+
crl_dir = $dir/crl
13+
new_certs_dir = $dir/newcerts
14+
database = $dir/index.txt
15+
serial = $dir/serial
16+
RANDFILE = $dir/private/.rand
17+
18+
# The root key and root certificate.
19+
private_key = $dir/private/ca.key.pem
20+
certificate = $dir/certs/ca.cert.pem
21+
22+
# For certificate revocation lists.
23+
crlnumber = $dir/crlnumber
24+
crl = $dir/crl/ca.crl.pem
25+
crl_extensions = crl_ext
26+
default_crl_days = 30
27+
28+
# SHA-1 is deprecated, so use SHA-2 instead.
29+
default_md = sha256
30+
31+
name_opt = ca_default
32+
cert_opt = ca_default
33+
default_days = 375
34+
preserve = no
35+
policy = policy_strict
36+
37+
[ policy_strict ]
38+
# The root CA should only sign intermediate certificates that match.
39+
# See the POLICY FORMAT section of `man ca`.
40+
countryName = match
41+
stateOrProvinceName = match
42+
organizationName = match
43+
organizationalUnitName = optional
44+
commonName = supplied
45+
emailAddress = optional
46+
47+
[ policy_loose ]
48+
# Allow the intermediate CA to sign a more diverse range of certificates.
49+
# See the POLICY FORMAT section of the `ca` man page.
50+
countryName = optional
51+
stateOrProvinceName = optional
52+
localityName = optional
53+
organizationName = optional
54+
organizationalUnitName = optional
55+
commonName = supplied
56+
emailAddress = optional
57+
58+
[ req ]
59+
# Options for the `req` tool (`man req`).
60+
default_bits = 2048
61+
distinguished_name = req_distinguished_name
62+
string_mask = utf8only
63+
64+
# SHA-1 is deprecated, so use SHA-2 instead.
65+
default_md = sha256
66+
67+
# Extension to add when the -x509 option is used.
68+
x509_extensions = v3_ca
69+
70+
[ req_distinguished_name ]
71+
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
72+
countryName = Country Name (2 letter code)
73+
stateOrProvinceName = State or Province Name
74+
localityName = Locality Name
75+
0.organizationName = Organization Name
76+
organizationalUnitName = Organizational Unit Name
77+
commonName = Common Name
78+
emailAddress = Email Address
79+
80+
# Optionally, specify some defaults.
81+
countryName_default = US
82+
stateOrProvinceName_default = XXX
83+
localityName_default =
84+
0.organizationName_default = Pinder
85+
organizationalUnitName_default =
86+
emailAddress_default =
87+
commonName_default = my.intermediate
88+
89+
[ v3_ca ]
90+
# Extensions for a typical CA (`man x509v3_config`).
91+
subjectKeyIdentifier = hash
92+
authorityKeyIdentifier = keyid:always,issuer
93+
basicConstraints = critical, CA:true
94+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
95+
96+
[ v3_intermediate_ca ]
97+
# Extensions for a typical intermediate CA (`man x509v3_config`).
98+
subjectKeyIdentifier = hash
99+
authorityKeyIdentifier = keyid:always,issuer
100+
basicConstraints = critical, CA:true, pathlen:0
101+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
102+
103+
[ usr_cert ]
104+
# Extensions for client certificates (`man x509v3_config`).
105+
basicConstraints = CA:FALSE
106+
nsCertType = client, email
107+
nsComment = "OpenSSL Generated Client Certificate"
108+
subjectKeyIdentifier = hash
109+
authorityKeyIdentifier = keyid,issuer
110+
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
111+
extendedKeyUsage = clientAuth, emailProtection
112+
113+
[ server_cert ]
114+
# Extensions for server certificates (`man x509v3_config`).
115+
basicConstraints = CA:FALSE
116+
nsCertType = server
117+
nsComment = "OpenSSL Generated Server Certificate"
118+
subjectKeyIdentifier = hash
119+
authorityKeyIdentifier = keyid,issuer:always
120+
keyUsage = critical, digitalSignature, keyEncipherment
121+
extendedKeyUsage = serverAuth
122+
123+
[ crl_ext ]
124+
# Extension for CRLs (`man x509v3_config`).
125+
authorityKeyIdentifier=keyid:always
126+
127+
[ ocsp ]
128+
# Extension for OCSP signing certificates (`man ocsp`).
129+
basicConstraints = CA:FALSE
130+
subjectKeyIdentifier = hash
131+
authorityKeyIdentifier = keyid,issuer
132+
keyUsage = critical, digitalSignature
133+
extendedKeyUsage = critical, OCSPSigning

0 commit comments

Comments
 (0)