1 #!/bin/bash 2 3 # (c) CopyRight EdelWeb for EdelKey and OpenEvidence, 2000-2004, 2009 4 # Author: Peter Sylvester 5 6 # "libre" for integration with curl 7 8 OPENSSL=openssl 9 if [ -f /usr/local/ssl/bin/openssl ] ; then 10 OPENSSL=/usr/local/ssl/bin/openssl 11 fi 12 13 USAGE="echo Usage is genserv.sh <prefix> <caprefix>" 14 15 HOME=`pwd` 16 cd $HOME 17 18 KEYSIZE=1024 19 DURATION=3000 20 21 REQ=YES 22 P12=NO 23 DHP=NO 24 25 PREFIX=$1 26 if [ ".$PREFIX" = . ] ; then 27 echo No configuration prefix 28 NOTOK=1 29 else 30 if [ ! -f $PREFIX-sv.prm ] ; then 31 echo No configuration file $PREFIX-sv.prm 32 NOTOK=1 33 fi 34 fi 35 36 CAPREFIX=$2 37 if [ ".$CAPREFIX" = . ] ; then 38 echo No CA prefix 39 NOTOK=1 40 else 41 if [ ! -f $CAPREFIX-ca.cacert ] ; then 42 echo No CA certificate file $CAPREFIX-ca.caert 43 NOTOK=1 44 fi 45 if [ ! -f $CAPREFIX-ca.key ] ; then 46 echo No $CAPREFIX key 47 NOTOK=1 48 fi 49 fi 50 51 if [ ".$NOTOK" != . ] ; then 52 echo "Sorry, I can't do that for you." 53 $USAGE 54 exit 55 fi 56 57 if [ ".$SERIAL" = . ] ; then 58 GETSERIAL="\$t = time ;\$d = \$t . substr(\$t+$$ ,-4,4)-1;print \$d" 59 SERIAL=`/usr/bin/env perl -e "$GETSERIAL"` 60 fi 61 62 echo SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE 63 64 if [ "$DHP." = YES. ] ; then 65 echo "openssl dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE" 66 $OPENSSL dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE 67 fi 68 69 if [ "$REQ." = YES. ] ; then 70 echo "openssl req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout XXX" 71 $OPENSSL req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout pass:secret 72 fi 73 74 echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key" 75 $OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret 76 echo pseudo secrets generated 77 78 echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der" 79 $OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der 80 81 echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem" 82 $OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem 83 84 echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt " 85 86 $OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt 87 88 if [ "$P12." = YES. ] ; then 89 90 echo "$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt " 91 92 $OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt 93 fi 94 95 echo "openssl x509 -noout -text -hash -in $PREFIX-sv.selfcert -nameopt multiline" 96 $OPENSSL x509 -noout -text -hash -in $PREFIX-sv.crt -nameopt multiline 97 98 # revoke server cert 99 touch $CAPREFIX-ca.db 100 echo 01 > $CAPREFIX-ca.cnt 101 echo "openssl ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt" 102 $OPENSSL ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt 103 104 # issue CRL 105 echo "openssl ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl" 106 $OPENSSL ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl 107 108 echo "openssl x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der " 109 $OPENSSL x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der 110 111 # all together now 112 touch $PREFIX-sv.dhp 113 cat $PREFIX-sv.prm $PREFIX-sv.key $PREFIX-sv.crt $PREFIX-sv.dhp >$PREFIX-sv.pem 114 chmod o-r $PREFIX-sv.prm 115 116 echo "$PREFIX-sv.pem done" 117 118 119
