155 lines
4.5 KiB
Text
155 lines
4.5 KiB
Text
|
#! /bin/sh
|
||
|
|
|
||
|
|
if [ -z "$1" -o "$1" == "man" ]; then
|
||
|
|
exec /usr/bin/pod2man -n CA-INIT -s 1 -d "12 February 2010" \
|
||
|
|
-r "ca-scripts version 0.9" -c "SSL Certificate Authority utilities" $0
|
||
|
|
elif [ "$1" == "html" ]; then
|
||
|
|
exec /usr/bin/pod2html --title "ca-init" < $0
|
||
|
|
elif [ "$1" == "text" ]; then
|
||
|
|
exec /usr/bin/pod2text -o $0
|
||
|
|
fi
|
||
|
|
|
||
|
|
=pod
|
||
|
|
|
||
|
|
=head1 NAME
|
||
|
|
|
||
|
|
ca-init - initialise an X.509 SSL CA and generate CA certificate
|
||
|
|
|
||
|
|
=head1 SYNOPSIS
|
||
|
|
|
||
|
|
B<ca-init> [B<-csx>] [B<-f> I<config>] [B<-i> I<template>] [B<-o> I<output>]
|
||
|
|
|
||
|
|
B<ca-init> [B<-h>] | [B<--help>]
|
||
|
|
|
||
|
|
=head1 DESCRIPTION
|
||
|
|
|
||
|
|
ca-init(1) reads the ca-scripts configuration file and generates an openssl(1)
|
||
|
|
configuration file and an X.509 certificate and key suitable for use as an
|
||
|
|
x509(1) certificate authority. The format of the ca-scripts configuration file
|
||
|
|
is documented in ca-scripts.conf(5).
|
||
|
|
|
||
|
|
=head1 OPTIONS
|
||
|
|
|
||
|
|
=over
|
||
|
|
|
||
|
|
=item B<-h>, B<--help>
|
||
|
|
|
||
|
|
Prints out a short synopsis of the options to B<ca-init>.
|
||
|
|
|
||
|
|
=item B<-c>, B<--encrypt>
|
||
|
|
|
||
|
|
Encrypt the private key generated for the certificate authority with 3DES.
|
||
|
|
|
||
|
|
=item B<-f> I<FILE>, B<--config> I<FILE>
|
||
|
|
|
||
|
|
Load the ca-scripts configuration from I<FILE> instead of
|
||
|
|
I</etc/ca-scripts.conf>.
|
||
|
|
|
||
|
|
=item B<-i> I<FILE>, B<--template> I<FILE>
|
||
|
|
|
||
|
|
Use the index.html template in I<FILE> rather than the standard one provided
|
||
|
|
with ca-scripts. See the B<TEMPLATING> section of ca-scripts.conf(5) for more
|
||
|
|
details of the templating system. Hint: it's sed(1) based...
|
||
|
|
|
||
|
|
=item B<-o> I<FILE>, B<--output> I<FILE>
|
||
|
|
|
||
|
|
Generate a HTML page in I<FILE> suitable for serving your CA certificate and
|
||
|
|
revocation lists via HTTP. The default template is basic but provides MD5 and
|
||
|
|
SHA1 fingerprints of both files for verification purposes.
|
||
|
|
|
||
|
|
=item B<-s>, B<--crt-only>
|
||
|
|
|
||
|
|
Generate the CA certificate and private key from a previously-created openssl
|
||
|
|
configuration. May only be used after having run B<ca-init> with the
|
||
|
|
B<--cnf-only> option, and mutually exclusive to that option.
|
||
|
|
|
||
|
|
=item B<-x>, B<--cnf-only>
|
||
|
|
|
||
|
|
Create initial CA directory structure and openssl configuration, but do not
|
||
|
|
generate CA certificate and private key. Using this option in conjunction with
|
||
|
|
B<--crt-only> allows the user to manually customise the openssl config
|
||
|
|
before generating the certificates. Mutually exclusive to B<--crt-only>.
|
||
|
|
|
||
|
|
=back
|
||
|
|
|
||
|
|
=head1 THE CA DIRECTORY STRUCTURE
|
||
|
|
|
||
|
|
B<ca-init> creates a number of subdirectories under the path specified in
|
||
|
|
the mandatory configuration variable I<CA_HOME>. This path must exist before
|
||
|
|
B<ca-init> will run correctly. All files and directories under this path
|
||
|
|
will be created with a restrictive umask of 0027, and in particular the CA
|
||
|
|
private key will be created with permissions of 0400.
|
||
|
|
|
||
|
|
It is recommended but not required that a non-privileged system "ssl" user and
|
||
|
|
group are created for running the ca-scripts suite of utilities, and that any
|
||
|
|
local services needing access to a certificate are added to the "ssl" group.
|
||
|
|
Access to generate certificates can be bestowed to individuals on a multi-user
|
||
|
|
system by adding them to the same group and allowing them to run ca-scripts
|
||
|
|
utilities via sudo(8).
|
||
|
|
|
||
|
|
The directories B<ca-init> creates are as follows:
|
||
|
|
|
||
|
|
=over
|
||
|
|
|
||
|
|
=item I<cnf/>
|
||
|
|
|
||
|
|
Contains a cache of openssl configuration files created by the various
|
||
|
|
ca-scripts utilities from templates.
|
||
|
|
|
||
|
|
=item I<crl/>
|
||
|
|
|
||
|
|
Contains the certificate revocation list for the CA in both PEM and DER forms.
|
||
|
|
|
||
|
|
=item I<crt/>
|
||
|
|
|
||
|
|
Contains the signed certificates generated by ca-create-cert(1).
|
||
|
|
|
||
|
|
=item I<csr/>
|
||
|
|
|
||
|
|
Contains the unsigned certificate signing requests generated by
|
||
|
|
ca-create-cert(1).
|
||
|
|
|
||
|
|
=item I<db/>
|
||
|
|
|
||
|
|
Contains internal openssl(1ssl) database files required for certificate
|
||
|
|
authority management.
|
||
|
|
|
||
|
|
=item I<idx/>
|
||
|
|
|
||
|
|
Contains signed certificates indexed by serial number to make certificate
|
||
|
|
revocation simpler.
|
||
|
|
|
||
|
|
=item I<key/>
|
||
|
|
|
||
|
|
Contains the private keys associated with the certificates in I<crt/>.
|
||
|
|
|
||
|
|
=item I<p12/>
|
||
|
|
|
||
|
|
Contains any PKCS#12 certificate archives created by ca-create-cert(1).
|
||
|
|
|
||
|
|
=back
|
||
|
|
|
||
|
|
=head1 BUGS
|
||
|
|
|
||
|
|
Probably. Of particular note is that the default openssl configuration file
|
||
|
|
requires the C (country) and O (organisation) fields of all generated
|
||
|
|
certificates to match those in the CA certificate, but ca-create-cert(1)
|
||
|
|
allows these fields to be changed.
|
||
|
|
|
||
|
|
=head1 AVAILABILITY
|
||
|
|
|
||
|
|
New releases of the ca-scripts utilities can be found at
|
||
|
|
L<the developer's website|http://www.pl0rt.org/code/ca-scripts>.
|
||
|
|
A L<git repository|git://git.pl0rt.org/alex/code/ca-scripts>
|
||
|
|
for development versions also exists.
|
||
|
|
|
||
|
|
=head1 AUTHORS
|
||
|
|
|
||
|
|
Copyright 2009, 2010 Alex Bramley a.bramley@gmail.com
|
||
|
|
|
||
|
|
=head1 SEE ALSO
|
||
|
|
|
||
|
|
ca-create-cert(1), ca-scripts.conf(5), openssl(1ssl), ca(1ssl), req(1ssl),
|
||
|
|
x509(1ssl), config(5ssl), and x509v3_config(5ssl).
|
||
|
|
|