-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathgencert.sh
executable file
·90 lines (71 loc) · 2.44 KB
/
gencert.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
#!/bin/sh
set -e
# Originally taken here by Vadim Bazhov at Jetstyle ([email protected]):
# https://support.plesk.com/hc/en-us/article_attachments/360005259853/cert.sh
SCRIPT_NAME=${0##*/}
CN=$1
CERT_DIR="/etc/postfix/cert"
SAN="DNS:mail.${CN}"
OPENSSL_CONF="/tmp/openssl.cnf"
country=RU
state=Sverdlovsk
locality=Yekaterinburg
organization=Jetstyle
organizationalunit='Dev Team'
function log() {
echo "$SCRIPT_NAME: $1"
}
if [ -z "$CN" ]; then
log "Argument not present."
log "Usage ${SCRIPT_NAME} [domain name for CN name]"
exit 99
fi
log "Construct Subject Alt Names from additional positional arguments"
shift
for arg in "$@"
do
log "Found additional domain: ${arg}"
SAN="${SAN},DNS:$arg"
done
echo "
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
x509_extensions = v3_req
[req_distinguished_name]
commonName = ${CN}
emailAddress = ${email}
organizationName = ${organization}
localityName = ${locality}
countryName = ${country}
[v3_req]
subjectKeyIdentifier = hash
basicConstraints = critical,CA:false
subjectAltName = ${SAN}
keyUsage = critical,digitalSignature,keyEncipherment
" > ${OPENSSL_CONF}
log "Changing working directory to /tmp"
cd /tmp
log "Generating a root private key and creating a self-signed CA"
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -days 3650 -out rootCA.pem -subj "/C=$country/ST=$state/L=$locality/O=$organization/OU=$organizationalunit/CN=$CN/emailAddress=$email" -config ${OPENSSL_CONF}
log "Generating key request for CN"
log "Generate a private key for the certificate"
openssl genrsa -out ${CN}.key 4096
chmod 400 ${CN}.key
log "Create the request"
openssl req -new -key ${CN}.key -out ${CN}.csr -subj "/C=$country/ST=$state/L=$locality/O=$organization/OU=$organizationalunit/CN=$CN/emailAddress=$email" -config ${OPENSSL_CONF}
log "Create endpoint certificate"
openssl x509 -req -in ${CN}.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ${CN}.crt -days 3650 -extfile ${OPENSSL_CONF} -extensions v3_req
log "Placing keys and certificates to the right places on filesystem"
install -d ${CERT_DIR}
mv rootCA.key ${CERT_DIR}
mv rootCA.pem ${CERT_DIR}
mv "${CN}.key" ${CERT_DIR}
mv "${CN}.crt" ${CERT_DIR}
log "Removing unnecessary files"
rm -f rootCA.srl
rm -f "${CN}.csr"
rm -f ${OPENSSL_CONF}
log "Certificates and keys for $CN are made and installed to $CERT_DIR."