create-signing-ca

#!/bin/bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>

set -eu
set -o pipefail

umask 0077

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
# shellcheck disable=SC1090
source "${BIN_DIR}/functions"
# shellcheck disable=SC1090
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 [-l] -d CA_DIR"
    echo "Initializes a new signing sub-CA in the directory CA_DIR"
    echo "Must be run inside a root CA dir"
    echo
    echo "Options:"
    echo "    -d CA_DIR  Target directory to be created and initialized"
    echo "               Must not exist yet"
    echo "    -l         Symlink toolchain (designed for development)"
    echo
}

if ! openssl verify -CAfile ca/ca.crt ca/ca.crt >/dev/null 2>&1; then
    echo -e -n "$ERR " && usage && exit 2
fi

CA_DIR=
SYMLINK=0

while getopts d:hl FLAG; do
    case $FLAG in
        d) CA_DIR=${OPTARG} ;;
        h) echo -e -n "$SUCC " && usage && exit 0;;
        l) SYMLINK=1 ;;
        *) echo -e -n "$ERR " && usage && exit 2;;
    esac
done

if [ $OPTIND -le $# ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [ "${CA_DIR}" = "" ]; then
    echo -e -n "$SUCC " && usage && exit 2
fi

PARENT="${BIN_DIR}/.."
CA_NAME="$( basename "${CA_DIR}" )"
CA_PATH="$( fullpath "${CA_DIR}")"
export CA_PATH

echo
echo -e "$NOTE Creating new signing sub-CA in '${CA_DIR}'"
echo

init_ca_home "${CA_DIR}"
trap 'rm -Rf "${CA_DIR}"' 0 2

# early verification of root ca password
echo -e -n "$INPUT Enter passphase for root CA key: "
read -r -s PARENT_PASS
echo
export CA_PARENT_PASS="${PARENT_PASS}"
openssl rsa -check \
            -in ca/private/ca.key \
            -passin env:CA_PARENT_PASS \
            -noout


generate_conf "${CA_DIR}/bin/defaults.conf"
# shellcheck disable=SC1090
source "${CA_DIR}/bin/defaults.conf"

# shellcheck disable=SC2153
CA_CERT_CN="${CA_CERT_O} Certificate ${CA_NAME}"
echo -e -n "$INPUT Common Name for CA certificate [${CA_CERT_CN}]: "
read -r CERT_CN
if [ -n "${CERT_CN}" ]; then
    CA_CERT_CN="${CERT_CN}"
fi

echo
echo -e -n "$INPUT Enter passphase for encrypting signing sub-CA key: "
read -r -s PASS1
echo
if [ ${#PASS1} -lt 4 ]; then
    echo -e "$ERR Passphrase is too short, please use at least 4 characters!"
    exit 1
fi
echo -e -n "$INPUT Verifying - Enter passphase for encrypting signing sub-CA key: "
read -r -s PASS2
echo
if [ "${PASS1}" != "${PASS2}" ]; then
    echo -e "$ERR Passphrases did not match, exiting."
    exit 1
fi

export CA_PASS"=${PASS1}"
export SAN=""

pushd "${CA_DIR}" > /dev/null

# Generate the signing CA openssl config
template "${BIN_DIR}/templates/signing.tpl" "ca/ca.conf"

echo -e "$NOTE Creating the signing sub-CA key"

# Create the signing CA key
openssl genrsa -out ca/private/ca.key -"${CA_KEY_ALG}" -passout env:CA_PASS "${CA_KEY_LENGTH_SIGNCA}"
chmod 0400 ca/private/ca.key

echo -e "$NOTE Creating the signing sub-CA csr"

openssl req -new -batch \
            -config ca/ca.conf \
            -key ca/private/ca.key \
            -out ca/ca.csr \
            -passin env:CA_PASS

echo -e "$NOTE Creating the signing sub-CA certificate"

pushd "${PARENT}" > /dev/null
openssl ca -batch -notext \
           -config ca/ca.conf \
           -in "${CA_DIR}/ca/ca.csr" \
           -out "${CA_DIR}/ca/ca.crt" \
           -extensions signing_ca_ext \
           -passin env:CA_PARENT_PASS
popd > /dev/null

echo -e "$NOTE Creating the signing sub-CA CRL"

openssl ca -gencrl -batch \
           -config ca/ca.conf \
           -out ca/ca.crl \
           -passin env:CA_PASS

echo -e "$NOTE Creating the chain bundle"

cat "${PARENT}/ca/chain.pem" > ca/chain.pem
cat ca/ca.crt >> ca/chain.pem

cp "${PARENT}/ca/root.crt" ca/root.crt

echo -e "$NOTE Verifying trusted chain"

openssl verify -CAfile ca/chain.pem ca/ca.crt
openssl verify -CAfile ca/root.crt ca/ca.crt

if [ $SYMLINK -eq 1 ]; then
    echo -e "$NOTE Symlinking toolchain (dev mode)"
    CP_CMD='ln -s'
else
    echo -e "$NOTE Copying toolchain"
    CP_CMD='cp'
fi
$CP_CMD "${BIN_DIR}/../README.md" README.md
for BIN in ${BINARIES_SIGN}; do
    $CP_CMD "${BIN_DIR}/${BIN}" bin/
done
mkdir bin/templates/
for TPL in ${TEMPLATES_SIGN}; do
    $CP_CMD "${BIN_DIR}/templates/${TPL}" bin/templates/
done

popd > /dev/null

unset CA_PASS
unset CA_PARENT_PASS

trap - 0 2
echo -e "$SUCC Signing sub-CA initialized."