initial commit of ca-scripts devel work
This commit is contained in:
Alex Bramley
commit
348a0df638
|
|
@ -0,0 +1,169 @@
|
|||
#! /bin/bash
|
||||
|
||||
. "/home/alex/code/ca-scripts/lib/ca-functions"
|
||||
|
||||
ALT_NAMES=()
|
||||
TPL_ONLY=0
|
||||
CSR_ONLY=0
|
||||
CRT_ONLY=0
|
||||
MAKE_P12=0
|
||||
|
||||
# XXX: in the ca_extension_policy section of ca-config.tpl it states that the
|
||||
# C= and O= DN values in a CSR have to match those of the CA
|
||||
# should we have options here to change them when it will cause breakage?
|
||||
usage() {
|
||||
cat <<__EOT__
|
||||
Usage:
|
||||
$PROGNAME -t server [options] <hostname>
|
||||
$PROGNAME -t client [options] <hostname>
|
||||
$PROGNAME -t user [options] <username>
|
||||
|
||||
Options:
|
||||
-h, --help Print this helpful message!
|
||||
-c, --encrypt Encrypt certificate private key with Triple-DES
|
||||
-f, --config FILE Use config file instead of $CONFFILE
|
||||
-t, --type Certificate type: "server", "client" or "user"
|
||||
-n, --alt-name Alternative host name (can be provided multiple times)
|
||||
-p, --pkcs12 Create PKCS#12 certificate archive from generated cert
|
||||
-r, --csr-only Only generate CSR, don't sign it
|
||||
-s, --crt-only Only sign certificate, requires CSR in place
|
||||
-x, --tpl-only Only generate templates, do not create CSR or sign CRT
|
||||
--country Certificate DN -- C
|
||||
--state Certificate DN -- ST
|
||||
--loc Certificate DN -- L
|
||||
--org Certificate DN -- O
|
||||
--org-unit Certificate DN -- OU
|
||||
--email Certificate DN -- E
|
||||
--comment Certificate nsComment field
|
||||
|
||||
__EOT__
|
||||
}
|
||||
|
||||
short='hcf:t:n:prsx'
|
||||
long='help,encrypt.config:,type:,alt-name:,csr-only,crt-only,tpl-only,pkcs12'
|
||||
long="$long,country:,state:,loc:,org:,org-unit:,email:,comment:"
|
||||
opts=$( getopt -o "$short" -l "$long" -n "$PROGNAME" -- "$@" )
|
||||
if [ 0 -ne $? ]; then echo; usage; exit 1; fi
|
||||
eval set -- "$opts";
|
||||
|
||||
while :; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0;;
|
||||
-c|--encrypt) CRYPTKEY=""; shift;;
|
||||
-f|--config) shift; CONFFILE="$1"; shift;;
|
||||
-t|--type) shift; CA_CRT_TYPE="$1"; shift;;
|
||||
-n|--alt-name) shift; ALT_NAMES+=("$1"); shift;;
|
||||
-p|--pkcs12) MAKE_P12=1; shift;;
|
||||
-r|--csr-only) CSR_ONLY=1; shift;;
|
||||
-s|--crt-only) CRT_ONLY=1; shift;;
|
||||
-x|--tpl-only) TPL_ONLY=1; shift;;
|
||||
--country) shift; CA_CRT_C="$1"; shift;;
|
||||
--state) shift; CA_CRT_ST="$1"; shift;;
|
||||
--location) shift; CA_CRT_L="$1"; shift;;
|
||||
--org) shift; CA_CRT_O="$1"; shift;;
|
||||
--org-unit) shift; CA_CRT_OU="$1"; shift;;
|
||||
--email) shift; CA_CRT_E="$1"; shift;;
|
||||
--comment) shift; CA_CRT_COMMENT="$1"; shift;;
|
||||
--) shift; break;;
|
||||
*) echo "Unknown value '$1'"; exit 1;;
|
||||
esac
|
||||
done
|
||||
CA_CRT_CN="$1";
|
||||
|
||||
# load up the configuration file
|
||||
ca_load_conf
|
||||
|
||||
# parameter checking fun -- we need a type and a cn (either user or host name)
|
||||
if [ -z "$CA_CRT_CN" ]; then
|
||||
error "The host or username parameter is mandatory!"
|
||||
fi
|
||||
|
||||
if [ 1 -eq "$CSR_ONLY" -a 1 -eq "$CRT_ONLY" ]; then
|
||||
error "Options --csr-only and --crt-only are mutually exclusive."
|
||||
fi
|
||||
|
||||
if [ "$CA_CRT_TYPE" = "user" ]; then
|
||||
# append @$CA_DOMAIN to user CN if it's not already there
|
||||
if [ "${CA_CRT_CN%%@*}" = "$CA_CRT_CN" ]; then
|
||||
CA_CRT_CN="$CA_CRT_CN@$CA_DOMAIN";
|
||||
fi
|
||||
else
|
||||
# fully qualify server or client CN with $CA_DOMAIN if it's not already
|
||||
if [ "${CA_CRT_CN%%.*}" = "$CA_CRT_CN" ]; then
|
||||
# however we may also want the unqualified one as an alt-name
|
||||
ALT_NAMES+=("$CA_CRT_CN")
|
||||
CA_CRT_CN="$CA_CRT_CN.$CA_DOMAIN"
|
||||
fi
|
||||
fi
|
||||
CNF_NAME=$( echo -n "$CA_CRT_CN" | tr -c '[:alnum:]@-' _ )".$CA_CRT_TYPE";
|
||||
|
||||
# if they've provided a comment, reformat it correctly
|
||||
if [ -n "$CA_CRT_COMMENT" ]; then
|
||||
CA_CRT_COMMENT="$( tr -d\" <<< $CA_CRT_COMMENT )"
|
||||
CA_CRT_COMMENT="nsComment = \"$CA_CRT_COMMENT\"\n"
|
||||
else
|
||||
CA_CRT_COMMENT=""
|
||||
fi
|
||||
|
||||
CA_CRT_ALT_NAMES=""
|
||||
# generate a list of alternative DNS names for server certificates
|
||||
if [ "$CA_CRT_TYPE" = "server" ]; then
|
||||
i=1
|
||||
for ALT_NAME in "$CA_CRT_CN" "${ALT_NAMES[@]}"; do
|
||||
# also fully-qualify unqualified alt-names too (see below)
|
||||
if [ "${ALT_NAME%%.*}" = "$ALT_NAME" ]; then
|
||||
CA_CRT_ALT_NAMES="${CA_CRT_ALT_NAMES}DNS.$i=$ALT_NAME.$CA_DOMAIN\n"
|
||||
i=$(( $i+1 ))
|
||||
fi
|
||||
CA_CRT_ALT_NAMES="${CA_CRT_ALT_NAMES}DNS.$i=$ALT_NAME\n"
|
||||
i=$(( $i+1 ))
|
||||
done
|
||||
fi
|
||||
|
||||
if [ 1 -ne "$CRT_ONLY" ]; then
|
||||
if [ 1 -eq "$TPL_ONLY" -o "$CSR_ONLY" -eq "$TPL_ONLY" ]; then
|
||||
# dirty logic here that probably needs commenting!
|
||||
# generate a *new* certificate request configuration if...
|
||||
# a) --tpl-only is set, i.e. we only want to generate a config
|
||||
# b) both --tpl-only and --csr-only are unset, i.e.
|
||||
# we're just generating a csr/crt as per usual
|
||||
# c) both --tpl-only and --csr-only are set, i.e.
|
||||
# we're just generating the config and not the csr itself
|
||||
ca_template "req-config" "$CA_HOME/cnf/$CNF_NAME.req.cnf"
|
||||
fi
|
||||
if [ 1 -ne "$TPL_ONLY" ]; then
|
||||
if [ ! -f "$CA_HOME/cnf/$CNF_NAME.req.cnf" ]; then
|
||||
error "Couldn't find CSR config $CA_HOME/cnf/$CNF_NAME.req.cnf!"
|
||||
fi
|
||||
# the above logic means that if you pass --csr-only but not
|
||||
# --tpl-only, you can re-use a pre-existing config to generate
|
||||
# a new csr, should you wish to do so...
|
||||
openssl req -new $CRYPTKEY -config "$CA_HOME/cnf/$CNF_NAME.req.cnf" \
|
||||
-keyout "$CA_HOME/key/$CNF_NAME.key" \
|
||||
-out "$CA_HOME/csr/$CNF_NAME.csr"
|
||||
fi
|
||||
fi
|
||||
if [ 1 -ne "$CSR_ONLY" ]; then
|
||||
if [ 1 -eq "$TPL_ONLY" -o "$CRT_ONLY" -eq "$TPL_ONLY" ]; then
|
||||
# same logic above applies here, but for generating the extensions
|
||||
# configuration file and signed certificate instead
|
||||
ca_template "$CA_CRT_TYPE-ext" "$CA_HOME/cnf/$CNF_NAME.ext.cnf"
|
||||
fi
|
||||
if [ 1 -ne "$TPL_ONLY" ]; then
|
||||
# ensure relevant files are in place before continuing...
|
||||
if [ ! -f "$CA_HOME/csr/$CNF_NAME.csr" ]; then
|
||||
error "CSR not present in $CA_HOME/csr/$CNF_NAME.csr"
|
||||
fi
|
||||
if [ ! -f "$CA_HOME/cnf/$CNF_NAME.ext.cnf" ]; then
|
||||
error "Couldn't find extensions in $CA_HOME/cnf/$CNF_NAME.ext.cnf"
|
||||
fi
|
||||
openssl ca -config "$CA_HOME/cnf/$CA_NAME.ca.cnf" \
|
||||
-extfile "$CA_HOME/cnf/$CNF_NAME.ext.cnf" -batch \
|
||||
-out "$CA_HOME/crt/$CNF_NAME.crt" \
|
||||
-in "$CA_HOME/csr/$CNF_NAME.csr"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ 1 -eq "$MAKE_P12" ]; then
|
||||
ca_gen_p12 "$CNF_NAME"
|
||||
fi
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
#! /bin/bash
|
||||
|
||||
. "/home/alex/code/ca-scripts/lib/ca-functions"
|
||||
|
||||
usage() {
|
||||
cat <<__EOT__
|
||||
Usage: $PROGNAME [options]
|
||||
|
||||
Options:
|
||||
-h, --help Print this helpful message!
|
||||
-c, --encrypt Encrypt CA private key with Triple-DES
|
||||
-f, --config FILE Use config file instead of $CONFFILE
|
||||
-i, --template FILE Use alternative index.html template
|
||||
-o, --output FILE Generate CA index.html in FILE
|
||||
|
||||
__EOT__
|
||||
}
|
||||
|
||||
short='hcf:i:o:'
|
||||
long='help,encrypt,config:,template:,output:'
|
||||
opts=$( getopt -o "$short" -l "$long" -n "$PROGNAME" -- "$@" )
|
||||
if [ 0 -ne $? ]; then echo; usage; exit 1; fi
|
||||
eval set -- "$opts";
|
||||
|
||||
while :; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0;;
|
||||
-c|--encrypt) CRYPTKEY=""; shift;;
|
||||
-f|--config) shift; CONFFILE="$1"; shift;;
|
||||
-i|--template) shift; INDEXTPL="$1"; shift;;
|
||||
-o|--output) shift; INDEXOUT="$1"; shift;;
|
||||
--) shift; break;;
|
||||
*) echo "Unknown value '$1'"; exit 1;;
|
||||
esac
|
||||
done
|
||||
|
||||
# load up the configuration file
|
||||
CA_CRT_TYPE="ca"
|
||||
ca_load_conf
|
||||
|
||||
# create the directory structure that'll be populated by the scripts
|
||||
mkdir -p $CA_HOME/{cnf,crl,crt,csr,db,idx,key,p12}
|
||||
echo "01" > $CA_HOME/db/crlnumber
|
||||
touch $CA_HOME/db/index.txt
|
||||
touch $CA_HOME/db/.rand
|
||||
chmod 600 $CA_HOME/db/.rand
|
||||
chmod 700 $CA_HOME/key
|
||||
|
||||
# generate an openssl configuration for this CA
|
||||
ca_template ca-config "$CA_HOME/cnf/$CA_NAME.ca.cnf"
|
||||
|
||||
# generate a self-signed cert that is valid for 10 years, with
|
||||
# ... the private key in $CA_HOME/key/$CA_NAME.ca.key
|
||||
# ... the certificate in $CA_HOME/crt/$CA_NAME.ca.crt
|
||||
# ... using the config in $CA_HOME/cnf/$CA_NAME.ca.cnf
|
||||
openssl req -new $CRYPTKEY -config "$CA_HOME/cnf/$CA_NAME.ca.cnf" \
|
||||
-keyout "$CA_HOME/key/$CA_NAME.ca.key" \
|
||||
-out "$CA_HOME/csr/$CA_NAME.ca.csr"
|
||||
|
||||
openssl ca -create_serial -selfsign -days 3652 -batch \
|
||||
-name ca_scripts -extensions ca_x509_extensions \
|
||||
-config "$CA_HOME/cnf/$CA_NAME.ca.cnf" \
|
||||
-in "$CA_HOME/csr/$CA_NAME.ca.csr" \
|
||||
-keyfile "$CA_HOME/key/$CA_NAME.ca.key" \
|
||||
-out "$CA_HOME/crt/$CA_NAME.ca.crt"
|
||||
|
||||
# generate an initial CRL too (yes it will be empty, but we should serve it)
|
||||
ca_gen_crl
|
||||
if [ -n "$INDEXOUT" ]; then
|
||||
ca_checksum
|
||||
ca_template $INDEXTPL $INDEXOUT
|
||||
fi
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
#! /bin/bash
|
||||
|
||||
. "/home/alex/code/ca-scripts/lib/ca-functions"
|
||||
|
||||
usage() {
|
||||
cat <<__EOT__
|
||||
Usage: $PROGNAME -t <type> [options] <hostname|username|certpath>
|
||||
|
||||
Options:
|
||||
-h, --help Print this helpful message!
|
||||
-f, --config FILE Use config file instead of $CONFFILE
|
||||
-t, --type Certificate type: "server", "client" or "user"
|
||||
|
||||
__EOT__
|
||||
}
|
||||
|
||||
short='hf:t:'
|
||||
long='help,config:,type:'
|
||||
opts=$( getopt -o "$short" -l "$long" -n "$PROGNAME" -- "$@" )
|
||||
if [ 0 -ne $? ]; then echo; usage; exit 1; fi
|
||||
eval set -- "$opts";
|
||||
|
||||
while :; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0;;
|
||||
-f|--config) shift; CONFFILE="$1"; shift;;
|
||||
-t|--type) shift; CA_CRT_TYPE="$1"; shift;;
|
||||
--) shift; break;;
|
||||
*) echo "Unknown value '$1'"; exit 1;;
|
||||
esac
|
||||
done
|
||||
|
||||
CNF_NAME="$1"
|
||||
|
||||
ca_load_conf
|
||||
|
||||
CNF_NAME=$( ca_find_cnf "$CNF_NAME" )
|
||||
CRT="$CA_HOME/crt/$CNF_NAME.crt"
|
||||
|
||||
# make sure that configuration files are present as expected
|
||||
if [ ! -f "$CA_HOME/cnf/$CNF_NAME.ext.cnf" ]; then
|
||||
error "Couldn't find extensions in $CA_HOME/cnf/$CNF_NAME-ext.cnf"
|
||||
fi
|
||||
|
||||
# according to the below URL we should create the new CRT using the old CSR
|
||||
# and with the same serial as the previous certificate.
|
||||
# http://blog.fupps.com/2007/11/30/x509ssl-certificate-prolongation/
|
||||
# After some fun googling, I found the following URL which tells us how...
|
||||
# http://ca.dutchgrid.nl/info/CA_gymnastics.html
|
||||
# XXX: this is only *really* relevant for certs that have been used for code
|
||||
# or e-mail encryption. should we regenerate client/server certs entirely?
|
||||
# ... for the moment there's always the revoke/recreate route for people.
|
||||
|
||||
# acquire required info from old certificate
|
||||
ENDDATE=$( openssl x509 -in "$CRT" -noout -enddate | cut -d= -f2 )
|
||||
SERIAL=$( openssl x509 -in "$CRT" -noout -serial | cut -d= -f2 )
|
||||
# work out new expiry date based on expiry date of current cert + 1 year
|
||||
# these dates are "<year> <day of year>"
|
||||
export TZ=UTC
|
||||
NOWYEAR=$( date +%Y )
|
||||
NOWDAYS=$( date +%j )
|
||||
ENDYEAR=$( date +%Y -d "$ENDDATE + 1 year" )
|
||||
ENDDAYS=$( date +%j -d "$ENDDATE + 1 year" )
|
||||
CERTDATE=$( date +%Y-%m-%d -d "$ENDDATE" )
|
||||
|
||||
# and this does the maths to work out how many days there are from now
|
||||
# (when we're creating the new cert) to the new expiry date
|
||||
DAYS=$(( ($ENDYEAR-$NOWYEAR)*365 + ($ENDDAYS-$NOWDAYS) ))
|
||||
|
||||
# Now perform required CA gymnastics ;p
|
||||
openssl x509 -req -set_serial "0x$SERIAL" -days "$DAYS" \
|
||||
-CA "$CA_HOME/crt/$CA_NAME.ca.crt" \
|
||||
-CAkey "$CA_HOME/key/$CA_NAME.ca.key" \
|
||||
-extfile "$CA_HOME/cfg/$CNF_NAME.ext.cnf" \
|
||||
-out "$CA_HOME/crt/$CNF_NAME.crt" \
|
||||
-in "$CA_HOME/csr/$CNF_NAME.csr"
|
||||
|
||||
# This doesn't update the original certificate in the index, so let's do that
|
||||
mv "$CA_HOME/idx/$SERIAL.pem" "$CA_HOME/idx/$SERIAL.$CERTDATE.pem"
|
||||
cp "$CA_HOME/crt/$CNF_NAME.crt" "$CA_HOME/idx/$SERIAL.pem"
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
#! /bin/sh
|
||||
|
||||
. "/home/alex/code/ca-scripts/lib/ca-functions"
|
||||
|
||||
usage() {
|
||||
cat <<__EOT__
|
||||
Usage: $PROGNAME -t <type> [options] <hostname|username|certpath>
|
||||
|
||||
Options:
|
||||
-h, --help Print this helpful message!
|
||||
-f, --config FILE Use config file instead of $CONFFILE
|
||||
-t, --type Certificate type: "server", "client" or "user"
|
||||
-i, --template FILE Use alternative index.html template
|
||||
-o, --output FILE Generate CA index.html in FILE
|
||||
|
||||
__EOT__
|
||||
}
|
||||
|
||||
short='hf:t:i:o:'
|
||||
long='help,config:,type:,template:,output:'
|
||||
opts=$( getopt -o "$short" -l "$long" -n "$PROGNAME" -- "$@" )
|
||||
if [ 0 -ne $? ]; then echo; usage; exit 1; fi
|
||||
eval set -- "$opts";
|
||||
|
||||
while :; do
|
||||
case "$1" in
|
||||
-h|--help) usage; exit 0;;
|
||||
-f|--config) shift; CONFFILE="$1"; shift;;
|
||||
-t|--type) shift; CA_CRT_TYPE="$1"; shift;;
|
||||
-i|--template) shift; INDEXTPL="$1"; shift;;
|
||||
-o|--output) shift; INDEXOUT="$1"; shift;;
|
||||
--) shift; break;;
|
||||
*) echo "Unknown value '$1'"; exit 1;;
|
||||
esac
|
||||
done
|
||||
CNF_NAME="$1"
|
||||
|
||||
ca_load_conf
|
||||
|
||||
CNF_NAME=$( ca_find_cnf "$CNF_NAME" "$TYPE" )
|
||||
CRT="$CA_HOME/crt/$CNF_NAME.crt"
|
||||
|
||||
openssl ca -config $CA_HOME/cnf/$CA_NAME.ca.cnf \
|
||||
-revoke $CRT -crl_reason superseded
|
||||
|
||||
ca_gen_crl
|
||||
if [ -n "$INDEXOUT" ]; then
|
||||
ca_checksum
|
||||
ca_template $INDEXTPL $INDEXOUT
|
||||
fi
|
||||
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
# example ca-scripts configuration file
|
||||
|
||||
# REQUIRED: CA_HOME provides the path to the root of the CA directory tree
|
||||
# this directory must exist and be writeable
|
||||
#CA_HOME="/etc/ssl/ca"
|
||||
CA_HOME="/tmp/ca"
|
||||
|
||||
# REQUIRED: CA_DOMAIN provides a template for other optional variables and
|
||||
# the filenames that are generated within the directory tree
|
||||
CA_DOMAIN="example.com"
|
||||
|
||||
# OPTIONAL: CA_NAME is the internal templating variable for filenames etc
|
||||
# Defaults to:
|
||||
# CA_NAME="$( echo $CA_DOMAIN | tr 'A-Z' 'a-z' | tr -c '-a-z0-9' '_' )"
|
||||
|
||||
# REQUIRED: CA_DN_* configures the Distinguished Name fields present in the
|
||||
# CA certificate generated by ca-init
|
||||
CA_DN_C="GB"
|
||||
CA_DN_ST="London"
|
||||
CA_DN_L="Example House, Mayfair"
|
||||
CA_DN_O="Example Security Services Ltd."
|
||||
CA_DN_OU="Example Internet Encryption Division"
|
||||
CA_DN_CN="Example Security Services Root Certificate Authority"
|
||||
|
||||
# OPTIONAL: CA_DESC configures a single-line description for your CA
|
||||
# using the CN= or O= line from your DN is recommended
|
||||
# Default value:
|
||||
# CA_DESC="$CA_DN_CN"
|
||||
|
||||
# OPTIONAL: CA_EMAIL provides an e-mail address that is embedded into all
|
||||
# generated certificates as a point-of-contact
|
||||
# Default value:
|
||||
# CA_EMAIL="ca@$CA_DOMAIN"
|
||||
|
||||
# OPTIONAL: CA_CRT_URI and CA_CRL_URI provide locations where the CA
|
||||
# certificate and revocation lists can be found
|
||||
# Default value:
|
||||
# CA_CRT_URI="http://$CA_DOMAIN/ca/$CA_NAME.ca.crt"
|
||||
# CA_CRL_URI="http://$CA_DOMAIN/ca/$CA_NAME.ca.crl"
|
||||
|
||||
# OPTIONAL: CA_PATHLEN sets the maximum number of intermediate CA certificates
|
||||
# that can be in the chain of authority between the root CA and the
|
||||
# final certificate.
|
||||
# Default value:
|
||||
# CA_PATHLEN=0
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
1. Creating a Certificate Authority.
|
||||
|
||||
|
||||
|
||||
|
||||
To fully understand it's contents you're unfortunately going to need to read ca(1ssl),
|
||||
req(1ssl), x509(1ssl), config(5ssl), and x509v3_config(5ssl). Particularly
|
||||
important are the x509v3 extensions present in the certificate, which are
|
||||
defined in the "stglab_x509_ca_extensions" section of the config file.
|
||||
|
||||
The ca-cert script configures some important files in db/, then creates a
|
||||
certificate request and signs it. It also generates an initial (empty)
|
||||
revocation list, then substitutes the correct fingerprints into the html
|
||||
template for serving the CA certificate and CRL to the intranet.
|
||||
|
||||
2. Creating a certificate.
|
||||
|
||||
The create-cert script can generate three "types" of certificate -- server
|
||||
certificates for securing a service with SSL/TLS, client certificates for
|
||||
authenticating a client to these services, and user certificates for
|
||||
authentication, S/MIME e-mail signing or encryption, and code signing. There
|
||||
are minor but important differences in the extensions present in these
|
||||
different certificate types, but these are set in the *-ext.tpl files in tpl/
|
||||
and thus you shouldn't need to worry about them.
|
||||
|
||||
The create-cert script takes a number of arguments, of which the hostname or
|
||||
username and the type are mandatory. It is also a very good idea to supply a
|
||||
number of alternative DNS names when generating a server certificate, because
|
||||
while the script will happily append "stglab.manchester.uk.ibm.com" to an
|
||||
un-qualified host name, it won't append "transitives.com" and for the moment we
|
||||
probably need that.
|
||||
|
||||
You should also provide a team name for the organisational unit, e.g.
|
||||
"Manchester STG Lab Test", an e-mail address (preferably for the team rather
|
||||
than an individual for server/client certificates), and a comment that reflects
|
||||
the usage of the certificate, e.g. "Soak Infrastructure Live Server". Reasonable
|
||||
defaults are provided for all of these for our team's use.
|
||||
|
||||
3. Renewing a certificate.
|
||||
|
||||
The renew-cert script does some painful certificate manipulation that is not
|
||||
strictly necessary in most cases, and may in fact decrease SSL security
|
||||
slightly. This is done because the normal renewal process re-generates the
|
||||
certificate signing request and thus creates a new public/private keypair.
|
||||
If the certificates are used for S/MIME encryption or code signing, this
|
||||
renders all the encrypted e-mail unreadable and requires you to re-sign the
|
||||
code with your new private key. The code in renew-cert re-signs the old
|
||||
certificate request with a new expiry date and the extensions generated when
|
||||
the original certificate was created, and avoids this problem.
|
||||
|
||||
Renewing a certificate is done by giving the hostname, username or path to
|
||||
the certificate to renew-cert.sh.
|
||||
|
||||
4. Revoking a certificate.
|
||||
|
||||
Revoking a certificate is done by giving the hostname, username or path to
|
||||
the certificat to revoke-cert.sh. This script also regenerates a new CRL in
|
||||
both PEM and DER encodings (firefox prefers the latter while IE and other
|
||||
browsers work better with the former), and re-generates the html file with the
|
||||
new fingerprints.
|
||||
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
# a brief man-page for ca-cert.sh
|
||||
# $Id: ca-cert.txt 2660 2009-07-24 18:49:52Z alexeb $
|
||||
|
||||
NAME
|
||||
ca-cert.sh - generate a CA cert and perform initial db setup
|
||||
|
||||
SYNOPSIS
|
||||
ca-cert.sh
|
||||
|
||||
DESCRIPTION
|
||||
This script generates a CSR and signs it to turn it into a root
|
||||
certificate authority. It also sets up some important files in the CA
|
||||
database directory, generates an initial empty revocation list, and
|
||||
creates index.html from the template.
|
||||
|
||||
OPTIONS
|
||||
This script takes no options.
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
# a brief man-page for create-cert.sh
|
||||
# $Id: create-cert.txt 2660 2009-07-24 18:49:52Z alexeb $
|
||||
|
||||
NAME
|
||||
create-cert.sh - generate a signed X.509 certificate
|
||||
|
||||
SYNOPSIS
|
||||
create-cert.sh -t server [options] <hostname>
|
||||
create-cert.sh -t client [options] <hostname>
|
||||
create-cert.sh -t user [options] <username>
|
||||
|
||||
DESCRIPTION
|
||||
The create-cert.sh script creates the configuration files necessary
|
||||
for generating a signed X.509 certificate, creates a certificate
|
||||
signing request using these configuration files, and signs that request
|
||||
using the root CA key so that it is trusted by anything that has
|
||||
imported the CA certificate.
|
||||
|
||||
OPTIONS
|
||||
-h, --help
|
||||
Prints out a short synopsis of the arguments that this script takes.
|
||||
|
||||
-t, --type {server|client|user}
|
||||
This argument is mandatory. create-cert.sh can create three types of
|
||||
X.509 certificate: server, client, and user. These differ in the
|
||||
X.509v3 extensions present, and in the uses the certificate is trusted
|
||||
for.
|
||||
|
||||
Server certificates are used for securing SSL/TLS services, such as
|
||||
TLS-encrypted LDAP connections or SSL HTTP. In this case the <hostname>
|
||||
argument is used for the Common Name in the certificate, and any
|
||||
additional alternative names supplied by -n are added to the X.509v3
|
||||
"SubjectAltName" extension.
|
||||
|
||||
Client certificates are used for authenticating to SSL/TLS services.
|
||||
For the most part they will be used by automated systems to identify
|
||||
and authenticate to services they interact with.
|
||||
|
||||
User certificates are for individuals to authenticate themselves to
|
||||
SSL/TLS services in the same manner as client certificates, but they
|
||||
may also be used for S/MIME e-mail encryption and code signing.
|
||||
|
||||
-c, --comment "COMMENT"
|
||||
This argument sets the "Netscape Comment" X.509 extension.
|
||||
|
||||
-n, --alt-name HOSTNAME
|
||||
This argument adds an alternative hostname to the "SubjectAltName"
|
||||
X.509v3 extension. It may be supplied multiple times to add more than
|
||||
one additional hostname.
|
||||
|
||||
-l, --location LOCATION
|
||||
This argument sets the "Location" field of the certificate's
|
||||
distinguished name. Syggested values are "Maybrook House" and
|
||||
"Jackson House", but the field is freeform text.
|
||||
|
||||
-o, --org-unit TEAMNAME
|
||||
This argument sets the "Organisational Unit" field of the certificate's
|
||||
distinguished name. Ideally this should begin with "Manchester STG Lab"
|
||||
for consistency's sake, for example:
|
||||
|
||||
Manchester STG Lab Systems and Network Infrastructure
|
||||
Manchester STG Lab Testing
|
||||
Manchester STG Lab Starlight Development
|
||||
|
||||
-e, --email EMAIL
|
||||
This argument sets the "E-Mail Address" field of the certificate's
|
||||
distinguished name. As per current X.509 standards this is actually
|
||||
removed from the DN of the CSR and placed into the "SubjectAltName"
|
||||
extension in the signed certificate. In general it should be a team
|
||||
alias rather than an individual's address for server and client certs.
|
||||
|
||||
-r, --csr-only
|
||||
This argument causes create-cert.sh to only generate a new CSR. It will
|
||||
not generate the request configuration files in cfg/ unless --tpl-only
|
||||
is also passed; in this case it will just create the configuration
|
||||
files instead. This allows you to re-generate a CSR after manually
|
||||
tweaking the configuration files.
|
||||
|
||||
-s, --crt-only
|
||||
This argument causes create-cert.sh to only sign an existing CSR. As
|
||||
with --csr-only, it will not generate extension configuration files
|
||||
unless --tpl-only is also passed; again in this case it will just
|
||||
create the configuration files so that you can re-sign the same CSR
|
||||
with new extensions.
|
||||
|
||||
-t, --tpl-only
|
||||
This argument modifies the behaviour of the previous two options when
|
||||
passed with them, as described above. On it's own it causes
|
||||
create-cert.sh to generate both sets of configuration files, but
|
||||
not generate either the signing request or the signed certificate.
|
||||
|
||||
DEFAULTS
|
||||
* The LOCATION defaults to "Maybrook House"
|
||||
* The TEAM defaults to "Manchester STG Lab Systems and Network Infrastructure"
|
||||
* The EMAIL defaults to "mcr_lab_lsni@wwpdl.vnet.ibm.com"
|
||||
* There is no COMMENT set by default
|
||||
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
# a brief man-page for create-p12.sh
|
||||
# $Id: create-p12.txt 2660 2009-07-24 18:49:52Z alexeb $
|
||||
|
||||
NAME
|
||||
create-p12.sh - create a PKCS#12 archive of a certificate and key
|
||||
|
||||
SYNOPSIS
|
||||
create-p12.sh /path/to/certificate
|
||||
create-p12.sh <username>
|
||||
|
||||
DESCRIPTION
|
||||
This script exports a PKCS#12 archive containing a user's certificate,
|
||||
private key, and the CA certificate. It will prompt for a password to
|
||||
lock the archive with, and then place it in p12/.
|
||||
|
||||
OPTIONS
|
||||
This script takes no options.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# a brief man-page for renew-cert.sh
|
||||
# $Id: renew-cert.txt 2660 2009-07-24 18:49:52Z alexeb $
|
||||
|
||||
NAME
|
||||
renew-cert.sh - renew a previously generated cert for another year
|
||||
|
||||
SYNOPSIS
|
||||
renew-cert.sh /path/to/certificate
|
||||
renew-cert.sh <hostname>
|
||||
renew-cert.sh <username>
|
||||
|
||||
DESCRIPTION
|
||||
This script renews a certificate for another 365 days from it's current
|
||||
end-date. It does some interesting hackery to re-sign the certificate
|
||||
request generated when the certificate was initially signed, using the
|
||||
same key-pair and the same serial, so that S/MIME encrypted e-mail and
|
||||
previously signed code does not become unusable.
|
||||
|
||||
OPTIONS
|
||||
This script takes no options.
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# a brief man-page for revoke-cert.sh
|
||||
# $Id: revoke-cert.txt 2660 2009-07-24 18:49:52Z alexeb $
|
||||
|
||||
NAME
|
||||
revoke-cert.sh - revoke a certificate and generate revocation list
|
||||
|
||||
SYNOPSIS
|
||||
revoke-cert.sh /path/to/certificate
|
||||
revoke-cert.sh <hostname>
|
||||
revoke-cert.sh <username>
|
||||
|
||||
DESCRIPTION
|
||||
This script revokes the provided certificate and updates the revocation
|
||||
list. It generates both a PEM and a DER encoded version of the CRL for
|
||||
different browsers, and updates the html page with the new fingerprints.
|
||||
|
||||
OPTIONS
|
||||
This script takes no options.
|
||||
|
|
@ -0,0 +1,198 @@
|
|||
#! /bin/bash
|
||||
# common functions for ca-scripts
|
||||
|
||||
PROGNAME=$( basename $0 )
|
||||
CONFFILE="/etc/ca-scripts.conf"
|
||||
SHAREDIR="/home/alex/code/ca-scripts/tpl"
|
||||
CRYPTKEY="-nodes"
|
||||
|
||||
INDEXTPL="index-html"
|
||||
INDEXOUT=""
|
||||
|
||||
error() {
|
||||
usage >&2
|
||||
echo -e "ERROR: $1\n" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
ca_check_var() {
|
||||
local varname vartest
|
||||
|
||||
varname="$1"
|
||||
vartest="$2"
|
||||
eval "if [ ! $vartest \"\$$varname\" ]; then
|
||||
echo '$varname value \"\$$varname\" failed \"$vartest\" test'
|
||||
fi"
|
||||
}
|
||||
|
||||
ca_set_default() {
|
||||
local varname vardef
|
||||
|
||||
varname="$1"
|
||||
vardef="$2"
|
||||
eval "if [ -z \"\$$varname\" ]; then
|
||||
$varname=\"$vardef\";
|
||||
fi"
|
||||
}
|
||||
|
||||
ca_load_conf() {
|
||||
local varname vartest varerr vardef error ca_name
|
||||
if [ ! -r "$CONFFILE" ]; then
|
||||
error "Unable to find $CONFFILE."
|
||||
fi
|
||||
# XXX: seems like . <file> doesn't work if it's not relative to a directory
|
||||
# look this up on the internet sometime to work out why...
|
||||
if [ "$CONFFILE" = "$( basename $CONFFILE )" ]; then
|
||||
CONFFILE="./$CONFFILE"
|
||||
fi
|
||||
. "$CONFFILE"
|
||||
|
||||
error=""
|
||||
while read vartest varname; do
|
||||
varerr=$( ca_check_var "$varname" "$vartest" )
|
||||
if [ -n "$varerr" ]; then
|
||||
error="$error\n $varerr"
|
||||
fi
|
||||
done <<__TESTS__
|
||||
-d CA_HOME
|
||||
-n CA_DOMAIN
|
||||
-n CA_DN_C
|
||||
-n CA_DN_ST
|
||||
-n CA_DN_L
|
||||
-n CA_DN_O
|
||||
-n CA_DN_OU
|
||||
-n CA_DN_CN
|
||||
__TESTS__
|
||||
if [ -n "$error" ]; then
|
||||
error "Parsing config file $CONFFILE failed:\n$error"
|
||||
fi
|
||||
|
||||
case "$CA_CRT_TYPE" in
|
||||
server|client|user|ca) :;;
|
||||
'') error "The type option is mandatory!";;
|
||||
*) error "Unrecognised type '$CA_CRT_TYPE'!";;
|
||||
esac
|
||||
|
||||
# we need to do these first to use them in other default defs
|
||||
# NOTE: bash's here-string syntax appends \n which tr turns to _ :(
|
||||
ca_set_default CA_NAME "$( echo -n "$CA_DOMAIN" | tr -c '[:alnum:]@-' _ )"
|
||||
ca_set_default CA_EMAIL "ca@$CA_DOMAIN"
|
||||
|
||||
while read varname vardef; do
|
||||
ca_set_default "$varname" "$vardef"
|
||||
done <<__DEFAULTS__
|
||||
CA_DESC $CA_DN_CN
|
||||
CA_CRT_URI http://$CA_DOMAIN/ca/$CA_NAME.ca.crt
|
||||
CA_CRL_URI http://$CA_DOMAIN/ca/$CA_NAME.ca.crl
|
||||
CA_PATHLEN 0
|
||||
CA_CRT_C $CA_DN_C
|
||||
CA_CRT_ST $CA_DN_ST
|
||||
CA_CRT_L $CA_DN_L
|
||||
CA_CRT_O $CA_DN_O
|
||||
CA_CRT_OU $CA_DN_OU
|
||||
CA_CRT_E $CA_EMAIL
|
||||
__DEFAULTS__
|
||||
}
|
||||
|
||||
ca_sed_cmd() {
|
||||
# MD5 in CA_CR[TL]_MD5_FP has a non alphabetic character :(
|
||||
# XXX: pretty sure this is a dirty and wrong way of templating vars
|
||||
set | awk -F\= '/^CA_[A-Z5_]*=/{print $1}' | while read ca_var; do
|
||||
echo "s#%$ca_var%#${!ca_var}#;"
|
||||
done
|
||||
}
|
||||
|
||||
ca_template() {
|
||||
local template dest
|
||||
|
||||
if [ -r "$1" ]; then
|
||||
template="$1"
|
||||
elif [ -r "$SHAREDIR/$1.tpl" ]; then
|
||||
template="$SHAREDIR/$1.tpl"
|
||||
else
|
||||
error "Could not read from template $1"
|
||||
fi
|
||||
dest="$2"
|
||||
|
||||
sed -e "$(ca_sed_cmd)" <"$template" >"$dest"
|
||||
}
|
||||
|
||||
ca_gen_crl() {
|
||||
openssl ca -config "$CA_HOME/cnf/$CA_NAME.ca.cnf" \
|
||||
-gencrl -out "$CA_HOME/crl/$CA_NAME.ca.crl" -md sha1
|
||||
openssl crl -in "$CA_HOME/crl/$CA_NAME.ca.crl" \
|
||||
-out "$CA_HOME/crl/$CA_NAME.ca.crl.der" -outform DER
|
||||
}
|
||||
|
||||
ca_gen_p12() {
|
||||
local cnf_name
|
||||
cnf_name="$1"
|
||||
openssl pkcs12 -export -descert -out $CA_HOME/p12/$cnf_name.p12 \
|
||||
-in $CA_HOME/crt/$cnf_name.crt \
|
||||
-inkey $CA_HOME/key/$cnf_name.key \
|
||||
-certfile $CA_HOME/crt/$CA_NAME.ca.crt
|
||||
}
|
||||
|
||||
ca_checksum() {
|
||||
CA_CRT_MD5_FP="$( openssl x509 -in $CA_HOME/crt/$CA_NAME.ca.crt \
|
||||
-noout -md5 -fingerprint | cut -d= -f2 )"
|
||||
CA_CRT_SHA_FP="$( openssl x509 -in $CA_HOME/crt/$CA_NAME.ca.crt \
|
||||
-noout -sha1 -fingerprint | cut -d= -f2 )"
|
||||
CA_CRL_MD5_FP="$( openssl crl -in $CA_HOME/crl/$CA_NAME.ca.crl \
|
||||
-noout -md5 -fingerprint | cut -d= -f2 )"
|
||||
CA_CRL_SHA_FP="$( openssl crl -in $CA_HOME/crl/$CA_NAME.ca.crl \
|
||||
-noout -sha1 -fingerprint | cut -d= -f2 )"
|
||||
}
|
||||
|
||||
ca_cnf_name() {
|
||||
local crt
|
||||
crt="$1"
|
||||
# work out what configuration files we should be using from the cert's CN
|
||||
echo $( openssl x509 -in "$crt" -noout -nameopt sep_multiline,use_quote \
|
||||
-subject | grep "CN=" | cut -d= -f2 | tr -c '[:alnum:]@-' _ )
|
||||
}
|
||||
|
||||
ca_find_cnf() {
|
||||
local name _name
|
||||
name="$1"
|
||||
|
||||
if [ -f "$name" ]; then
|
||||
if ! grep -q "$CA_CRT_TYPE" <<<"$name"; then
|
||||
error "Certificate '$name' does not appear to be of type '$CA_CRT_TYPE'"
|
||||
else
|
||||
echo "$(ca_cnf_name $name).$CA_CRT_TYPE"
|
||||
fi
|
||||
return
|
||||
fi
|
||||
|
||||
_name=$( echo -n "$name" | tr -c '[:alnum:]@-' _ )
|
||||
if [ "$CA_CRT_TYPE" = "user" ]; then
|
||||
# user names may have dots etc. in, so use munged version in match
|
||||
# check if name is "user@domain", append $CA_DOMAIN if not
|
||||
if [ "${_name%%@*}" = "$_name" \
|
||||
-a -f "$CA_HOME/crt/${_name}@$CA_NAME.$CA_CRT_TYPE.crt" ];
|
||||
then
|
||||
# name is not fully-qualified, but a cert exists for it
|
||||
echo "${_name}@$CA_NAME.$CA_CRT_TYPE"
|
||||
elif [ -f "$CA_HOME/crt/$_name.$CA_CRT_TYPE.crt" ]; then
|
||||
# name was fully-qualified and a cert exists
|
||||
echo "$_name.$CA_CRT_TYPE"
|
||||
else
|
||||
error "Could not find $CA_CRT_TYPE certificate configuration matching '$name'"
|
||||
fi
|
||||
else
|
||||
# check if name is fully-qualified -- contains more than 1 dot
|
||||
# NOTE: we have to do this test with the unmunged name ...
|
||||
if [ "${name%%.*}" = "$name" \
|
||||
-a -f "$CA_HOME/crt/${_name}_$CA_NAME.$CA_CRT_TYPE.crt" ];
|
||||
then
|
||||
# name is not fully-qualified, but a cert exists for it
|
||||
echo "${_name}_$CA_NAME.$CA_CRT_TYPE"
|
||||
elif [ -f "$CA_HOME/crt/$_name.$CA_CRT_TYPE.crt" ]; then
|
||||
# name was fully-qualified and a cert exists
|
||||
echo "$_name.$CA_CRT_TYPE"
|
||||
else
|
||||
error "Could not find $CA_CRT_TYPE certificate configuration matching '$name'"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
# CA configuration file template
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the CA configuration to use
|
||||
[ ca ]
|
||||
default_ca = ca_scripts
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines our CA configuration
|
||||
[ ca_scripts ]
|
||||
# interpolation variables defining the directories to use
|
||||
dir = %CA_HOME% # root data directory of CA
|
||||
db_dir = $dir/db # database files are kept here
|
||||
csr_dir = $dir/csr # generated CSRs are kept here
|
||||
crt_dir = $dir/crt # signed CRTs are kept here
|
||||
key_dir = $dir/key # generated KEYs are kept here
|
||||
crl_dir = $dir/crl # generated CRL is kept here
|
||||
new_certs_dir = $dir/idx # default place for new CRTs
|
||||
|
||||
# required settings
|
||||
database = $db_dir/index.txt # database index file
|
||||
serial = $db_dir/serial # serial number index file
|
||||
certificate = $crt_dir/%CA_NAME%.ca.crt # CA certificate
|
||||
private_key = $key_dir/%CA_NAME%.ca.key # CA private key
|
||||
crl = $crl_dir/%CA_NAME%.ca.crl # current CRL
|
||||
RANDFILE = $db_dir/.rand # private random number file
|
||||
|
||||
# these two CA directives can be commented out so that v1 CRLs are created
|
||||
crlnumber = $db_dir/crlnumber # crlnumber index file
|
||||
crl_extensions = ca_crl_extensions # extensions in v2 CRL
|
||||
|
||||
# x509v3 certificate extensions and certificate signing policy
|
||||
x509_extensions = ca_x509_default_extensions
|
||||
copy_extensions = copy # copy extensions from CSR to CRT
|
||||
policy = ca_extension_policy # policy on required CSR attributes
|
||||
|
||||
# leave these defaults
|
||||
name_opt = oneline # Subject Name options - x509(1)
|
||||
cert_opt = ca_default # Certificate field options - x509(1)
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 365 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
unique_subject = no # recommended
|
||||
email_in_dn = no # remove email from CSR DN when signing
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the CA's policy on required CSR attributes.
|
||||
# It requires:
|
||||
# the country [C] to be supplied in the CSR and match the CA
|
||||
# the state or province [ST] to be supplied in the CSR
|
||||
# the locality [L] to be supplied in the CSR
|
||||
# the organisation name [O] to be supplied in the CSR and match the CA
|
||||
# the organisational unit [OU] to be supplied in the CSR
|
||||
# the server common name [CN] to be supplied in the CSR
|
||||
# ... and an [emailAddress] may optionally be supplied in the CSR
|
||||
# XXX: is this too restrictive or not restrictive enough?
|
||||
# should options for ca-create-cert to change "match" values even exist?
|
||||
[ ca_extension_policy ]
|
||||
countryName = match
|
||||
stateOrProvinceName = supplied
|
||||
localityName = supplied
|
||||
organizationName = match
|
||||
organizationalUnitName = supplied
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the default x509 extensions present in a cert signed by the CA.
|
||||
# These should be replaced by a specific set of extensions per certificate.
|
||||
[ ca_x509_default_extensions ]
|
||||
|
||||
# certificates signed by this CA by default are not CA certificates themselves
|
||||
basicConstraints = CA:FALSE
|
||||
|
||||
# old netscape certificate attributes
|
||||
nsCertType = server
|
||||
nsComment = "%CA_DESC% Certificate"
|
||||
nsRevocationUrl = %CA_CRL_URI%
|
||||
|
||||
# key usage restrictions
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
issuerAltName = issuer:copy
|
||||
subjectAltName = URI:%CA_CRT_URI%
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
authorityInfoAccess = caIssuers;URI:%CA_CRT_URI%
|
||||
crlDistributionPoints = URI:%CA_CRL_URI%
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the x509 extensions present in the generated CA certificate.
|
||||
[ ca_x509_extensions ]
|
||||
|
||||
# this certificate is authoritative and allowed to sign other certificates
|
||||
# pathlen=1 implies there may be up to one intermediate CA in the chain
|
||||
# that leads to this root CA certificate.
|
||||
basicConstraints = critical,CA:TRUE,pathlen:%CA_PATHLEN%
|
||||
|
||||
# old netscape certificate attributes
|
||||
nsCertType = objsign, sslCA, emailCA, objCA
|
||||
nsComment = "%CA_DESC%"
|
||||
nsRevocationUrl = %CA_CRL_URI%
|
||||
nsCaRevocationUrl = %CA_CRL_URI%
|
||||
|
||||
# key usage restrictions
|
||||
keyUsage = critical, cRLSign, keyCertSign
|
||||
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection, timeStamping
|
||||
|
||||
issuerAltName = @ca_altname
|
||||
subjectAltName = @ca_altname
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
authorityInfoAccess = caIssuers;URI:%CA_CRT_URI%
|
||||
crlDistributionPoints = URI:%CA_CRL_URI%
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This is a separate section defining the attributes in the CA's subjectAltName.
|
||||
[ ca_altname ]
|
||||
URI=%CA_CRT_URI%
|
||||
DNS.1=%CA_DOMAIN%
|
||||
DNS.2=*.%CA_DOMAIN%
|
||||
email=%CA_EMAIL%
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the extensions present in the CRLs generated by this CA.
|
||||
[ ca_crl_extensions ]
|
||||
issuerAltName = issuer:copy
|
||||
authorityKeyIdentifier = keyid:always, issuer:always
|
||||
# the below is only supported in the very latest releases of openssl
|
||||
# issuingDistributionPoint= URI:%CA_CRL_URI%
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the extensions present in the CSRs created by this CA.
|
||||
[ ca_req_extensions ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, nonRepudiation, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines default settings for certificate requests and CA cert creation.
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_md = sha1
|
||||
distinguished_name = ca_req_dn
|
||||
x509_extensions = ca_x509_extensions
|
||||
req_extensions = ca_req_extensions
|
||||
string_mask = nombstr
|
||||
prompt = no
|
||||
|
||||
# ---------------------------------------------------------------------------- #
|
||||
# This defines the DN of the CA certificate.
|
||||
[ ca_req_dn ]
|
||||
C = %CA_DN_C%
|
||||
ST = %CA_DN_ST%
|
||||
L = %CA_DN_L%
|
||||
O = %CA_DN_O%
|
||||
OU = %CA_DN_OU%
|
||||
CN = %CA_DN_CN%
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
basicConstraints = critical, CA:FALSE
|
||||
nsCertType = client
|
||||
nsRevocationUrl = %CA_CRL_URI%
|
||||
%CA_CRT_COMMENT%
|
||||
keyUsage = critical, keyEncipherment, keyAgreement, digitalSignature
|
||||
extendedKeyUsage = clientAuth, timeStamping
|
||||
|
||||
issuerAltName = issuer:copy
|
||||
subjectAltName = @client_altname
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
authorityInfoAccess = caIssuers;URI:%CA_CRT_URI%
|
||||
crlDistributionPoints = URI:%CA_CRL_URI%
|
||||
|
||||
[ client_altname ]
|
||||
URI=%CA_CRT_URI%
|
||||
email=move
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<HTML>
|
||||
<HEAD><TITLE>%CA_DESC%</TITLE>
|
||||
<STYLE>
|
||||
BODY { font-family: arial,sans-serif; }
|
||||
H1 { font-size: xx-large; margin-left: 50px; }
|
||||
H3 { font-size: large; margin-top: 50px; margin-left: 50px; }
|
||||
IMG { border: 0; }
|
||||
P { width: 700px; margin-left: 100px; }
|
||||
</STYLE>
|
||||
</HEAD>
|
||||
|
||||
<BODY>
|
||||
<H1>%CA_DESC%</H1>
|
||||
<H3>CA Certificate</H3>
|
||||
<P>The CA certificate can be found
|
||||
<A href="%CA_CRT_URI%">here</A></P>
|
||||
<P>MD5 Fingerprint: %CA_CRT_MD5_FP%</P>
|
||||
<P>SHA1 Fingerprint: %CA_CRT_SHA_FP%</P>
|
||||
<H3>Certificate Revocation List</H3>
|
||||
<P>The certificate revocation list can be found
|
||||
<A href="%CA_CRL_URI%.der">here</A> (DER encoded)
|
||||
or <A href="%CA_CRL_URI%">here</A> (PEM encoded)</P>
|
||||
<P>MD5 Fingerprint: %CA_CRL_MD5_FP%</P>
|
||||
<P>SHA1 Fingerprint: %CA_CRL_SHA_FP%</P>
|
||||
</BODY>
|
||||
</HTML>
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
[ req ]
|
||||
default_bits = 2048
|
||||
default_md = sha1
|
||||
distinguished_name = req_dn
|
||||
req_extensions = req_%CA_CRT_TYPE%_extensions
|
||||
string_mask = nombstr
|
||||
prompt = no
|
||||
|
||||
[ req_dn ]
|
||||
C = %CA_CRT_C%
|
||||
ST = %CA_CRT_ST%
|
||||
L = %CA_CRT_L%
|
||||
O = %CA_CRT_O%
|
||||
OU = %CA_CRT_OU%
|
||||
CN = %CA_CRT_CN%
|
||||
emailAddress = %CA_CRT_E%
|
||||
|
||||
[ req_server_extensions ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
[ req_client_extensions ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, keyEncipherment, keyAgreement, digitalSignature
|
||||
extendedKeyUsage = clientAuth, timeStamping
|
||||
|
||||
[ req_user_extensions ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, keyEncipherment, keyAgreement, digitalSignature, nonRepudiation, dataEncipherment
|
||||
extendedKeyUsage = clientAuth, codeSigning, emailProtection
|
||||
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
basicConstraints = critical, CA:FALSE
|
||||
nsCertType = server
|
||||
nsRevocationUrl = %CA_CRL_URI%
|
||||
%CA_CRT_COMMENT%
|
||||
keyUsage = critical, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
issuerAltName = issuer:copy
|
||||
subjectAltName = @server_altname
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
authorityInfoAccess = caIssuers;URI:%CA_CRT_URI%
|
||||
crlDistributionPoints = URI:%CA_CRL_URI%
|
||||
|
||||
[ server_altname ]
|
||||
URI=%CA_CRT_URI%
|
||||
email=move
|
||||
%CA_CRT_ALT_NAMES%
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
basicConstraints = critical, CA:FALSE
|
||||
nsCertType = client, objsign, email
|
||||
nsRevocationUrl = %CA_CRL_URI%
|
||||
%CA_CRT_COMMENT%
|
||||
keyUsage = critical, keyEncipherment, keyAgreement, digitalSignature, nonRepudiation, dataEncipherment
|
||||
extendedKeyUsage = clientAuth, codeSigning, emailProtection
|
||||
|
||||
issuerAltName = issuer:copy
|
||||
subjectAltName = @user_altname
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
authorityInfoAccess = caIssuers;URI:%CA_CRT_URI%
|
||||
crlDistributionPoints = URI:%CA_CRL_URI%
|
||||
|
||||
[ user_altname ]
|
||||
URI=%CA_CRT_URI%
|
||||
email=move
|
||||
|
||||
Loading…
Reference in New Issue