Skip to content

Commit 7ff0cda

Browse files
mikegioiamikegioia
committed
Adding needed config variables to scripts, formatting
1 parent 3314140 commit 7ff0cda

12 files changed

+160
-60
lines changed

‎README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Certificate Authority Management Utilities
1+
## Certificate Authority Management Utilities
22

33
---
44

@@ -7,3 +7,4 @@ infrastructure at your organization, or for yourself. You can generate a Root Ce
77
Authority, intermediate CAs like a Software Signing or Email CA, individual web server
88
certificates for your domains to use both locally and on the Internet, and personal
99
email and browser PK12 certificates for email and web-based authentication.
10+

‎bin/client.sh

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24
#
35
# Sets up a new TLS client certificate, signed by the TLS
46
# certificate authority.
@@ -15,13 +17,13 @@ basepath="$rootpath/.."
1517
. $basepath/etc/bash/colors
1618

1719
## Export the ENV variables
18-
export BASEPATH=$basepath
1920
export TLSCANAME=$tlsCA
21+
export BASEPATH=$basepath
2022
export CABASEURL=$caBaseURL
2123
export COUNTRYNAME=$countryName
2224
export ORGNAME=$organizationName
23-
export ORGUNITNAME=$organizationalUnitName
2425
export TLSCOMMONNAME=$tlsCommonName
26+
export ORGUNITNAME=$organizationalUnitName
2527

2628
## Help message
2729
function showHelp {

‎bin/email-ca.sh

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24
#
35
# Sets up the Email CA
46
##
@@ -15,12 +17,14 @@ basepath="$rootpath/.."
1517

1618
## Export the ENV variables
1719
export BASEPATH=$basepath
18-
export EMAILCANAME=$emailCA
20+
export ROOTCANAME=$rootCA
1921
export CABASEURL=$caBaseURL
22+
export EMAILCANAME=$emailCA
2023
export COUNTRYNAME=$countryName
2124
export ORGNAME=$organizationName
22-
export ORGUNITNAME=$organizationalUnitName
25+
export ROOTCOMMONNAME=$rootCommonName
2326
export EMAILCOMMONNAME=$emailCommonName
27+
export ORGUNITNAME=$organizationalUnitName
2428

2529
## Create directories
2630
mkdir -p $basepath/ca/email-ca/private $basepath/ca/email-ca/db

‎bin/root-ca.sh

+124-41
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24
#
35
# Sets up the Primary Root CA
46
##
@@ -19,33 +21,70 @@ export ROOTCANAME=$rootCA
1921
export CABASEURL=$caBaseURL
2022
export COUNTRYNAME=$countryName
2123
export ORGNAME=$organizationName
22-
export ORGUNITNAME=$organizationalUnitName
2324
export ROOTCOMMONNAME=$rootCommonName
25+
export ORGUNITNAME=$organizationalUnitName
26+
27+
## Help message
28+
function showHelp {
29+
echo -e "${yellow}Usage:${NC}"
30+
echo " $0 [options] [command]"
31+
echo ""
32+
echo -e "${yellow}Options:${NC}"
33+
echo -e " ${green}--help -h${NC} Display this help message."
34+
echo ""
35+
echo -e "${yellow}Available Commands:${NC}"
36+
echo -e " ${green}create ${NC} Creates a new Root CA."
37+
echo ""
38+
echo -e "Default command is ${green}create${NC} if none is specified."
39+
}
40+
41+
## Info message
42+
function showCreateMessage {
43+
echo -e "${yellow}You will be creating a new Root Certificate Authority.${NC}"
44+
echo -e "${yellow}This will create new directories, certificates, keys and ${NC}"
45+
echo -e "${yellow}other files, and may overwrite files with the same names ${NC}"
46+
echo -e "${yellow}that already exist.${NC}"
47+
echo -n "Do you want to proceed? [y/N] "
48+
read answer
49+
echo ""
50+
if [[ "$answer" != "y" && "$answer" != "Y" ]] ; then
51+
exit 0
52+
fi
53+
}
2454

2555
## Create directories
26-
mkdir -p $basepath/ca/root-ca/private $basepath/ca/root-ca/db $basepath/crl $basepath/certs
27-
chmod 700 $basepath/ca/root-ca/private
28-
echo -n "*.key" > $basepath/ca/root-ca/private/.gitignore
56+
function createDirectories {
57+
mkdir -p $basepath/ca/root-ca/private $basepath/ca/root-ca/db $basepath/crl $basepath/certs
58+
chmod 700 $basepath/ca/root-ca/private
59+
echo -n "*.key" > $basepath/ca/root-ca/private/.gitignore
60+
}
2961

3062
## Create database
31-
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.db" ]] ; then
32-
cp /dev/null $basepath/ca/root-ca/db/$rootCA.db
33-
fi
34-
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.db.attr" ]] ; then
35-
cp /dev/null $basepath/ca/root-ca/db/$rootCA.db.attr
36-
fi
37-
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.crt.srl" ]] ; then
38-
echo 01 > $basepath/ca/root-ca/db/$rootCA.crt.srl
39-
fi
40-
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.crl.srl" ]] ; then
41-
echo 01 > $basepath/ca/root-ca/db/$rootCA.crl.srl
42-
fi
63+
function createDatabase {
64+
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.db" ]] ; then
65+
cp /dev/null $basepath/ca/root-ca/db/$rootCA.db
66+
fi
67+
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.db.attr" ]] ; then
68+
cp /dev/null $basepath/ca/root-ca/db/$rootCA.db.attr
69+
fi
70+
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.crt.srl" ]] ; then
71+
echo 01 > $basepath/ca/root-ca/db/$rootCA.crt.srl
72+
fi
73+
if ! [[ -f "$basepath/ca/root-ca/db/$rootCA.crl.srl" ]] ; then
74+
echo 01 > $basepath/ca/root-ca/db/$rootCA.crl.srl
75+
fi
76+
}
4377

4478
## Create CA request
4579
## Use -key ca/root-ca/private/root-ca.key to generate
4680
## a new CSR.
4781
function genCsr {
48-
if ! [[ -f "$basepath/ca/root-ca/private/$rootCA.key" ]] ; then
82+
keyPath="$basepath/ca/root-ca/private/$rootCA.key"
83+
84+
if ! [[ -f $keyPath && -s $keyPath ]] ; then
85+
echo -e "${yellow}A new key will now be created.${NC}"
86+
echo -e "${yellowBold}You must enter a password between 4 and 1024 characters.${NC}"
87+
4988
openssl req -new \
5089
-sha256 \
5190
-config $basepath/etc/root-ca.conf \
@@ -62,17 +101,19 @@ function genCsr {
62101

63102
## Check if the CSR exists. If so, ask the user if they
64103
## want to replace it. Otherwise, just create the CSR.
65-
if [[ -f "$basepath/ca/$rootCA.csr" ]] ; then
66-
echo -e "${red}Root CA CSR exists!${NC}"
67-
echo -n "Do you want to create a new one? (y/N): "
68-
read answer
69-
echo ""
70-
if [[ "$answer" == "y" || "$answer" == "Y" ]] ; then
104+
function checkCsr {
105+
if [[ -f "$basepath/ca/$rootCA.csr" ]] ; then
106+
echo -e "${red}Root CA CSR exists!${NC}"
107+
echo -n "Do you want to create a new one? (y/N): "
108+
read answer
109+
echo ""
110+
if [[ "$answer" == "y" || "$answer" == "Y" ]] ; then
111+
genCsr
112+
fi
113+
else
71114
genCsr
72115
fi
73-
else
74-
genCsr
75-
fi
116+
}
76117

77118
## Create CA certificate
78119
function genCrt {
@@ -84,27 +125,69 @@ function genCrt {
84125
-enddate 20501231235959Z
85126
}
86127

87-
if [[ -f "$basepath/ca/$rootCA.crt" ]] ; then
88-
echo -e "${red}Root CA certificate exists!${NC}"
89-
echo -n "Do you want to create a new one? (y/N): "
90-
read answer
91-
echo ""
92-
if [[ "$answer" == "y" || "$answer" == "Y" ]] ; then
128+
## Check if certificate exists and prompt to overwrite
129+
function checkCrt {
130+
if [[ -f "$basepath/ca/$rootCA.crt" ]] ; then
131+
echo -e "${red}Root CA certificate exists!${NC}"
132+
echo -n "Do you want to create a new one? (y/N): "
133+
read answer
134+
echo ""
135+
if [[ "$answer" == "y" || "$answer" == "Y" ]] ; then
136+
genCrt
137+
fi
138+
else
93139
genCrt
94140
fi
95-
else
96-
genCrt
97-
fi
141+
}
98142

99143
## Create CRL
100-
echo -n "Do you want to generate a CRL? (y/N): "
101-
read answer
102-
echo ""
103-
104-
if [[ "$answer" == "y" || "$answer" == "Y" ]] ; then
144+
function genCrl {
105145
openssl ca -gencrl \
106146
-config $basepath/etc/root-ca.conf \
107147
-out $basepath/crl/$rootCA.crl
148+
}
149+
150+
## Ask to create a CRL file
151+
function checkCrl {
152+
echo -n "Do you want to generate a CRL? (y/N): "
153+
read answer
154+
echo ""
155+
156+
if [[ "$answer" == "y" || "$answer" == "Y" ]] ; then
157+
genCrl
158+
fi
159+
}
160+
161+
function finish {
162+
echo -e "${greenBold}Done!${NC}"
163+
}
164+
165+
## If no arguments came in, default to create
166+
if [[ -z "$@" ]] ; then
167+
set "create"
108168
fi
109169

110-
echo -e "${greenBold}Done!${NC}"
170+
## Loop through command parameters
171+
for i
172+
do
173+
case $i in
174+
-\? | -h | help )
175+
showHelp
176+
exit 0
177+
;;
178+
create )
179+
## Create a new CA
180+
showCreateMessage
181+
createDirectories
182+
createDatabase
183+
checkCsr
184+
checkCrt
185+
checkCrl
186+
finish
187+
;;
188+
* )
189+
echo -e "${redBold}Unknown arg '$i'${NC}";
190+
exit 1
191+
;;
192+
esac
193+
done

‎bin/server.sh

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24
#
35
# Sets up a new server certificate, signed by the TLS
46
# certificate authority.
@@ -15,13 +17,13 @@ basepath="$rootpath/.."
1517
. $basepath/etc/bash/colors
1618

1719
## Export the ENV variables
18-
export BASEPATH=$basepath
1920
export TLSCANAME=$tlsCA
21+
export BASEPATH=$basepath
2022
export CABASEURL=$caBaseURL
2123
export COUNTRYNAME=$countryName
2224
export ORGNAME=$organizationName
23-
export ORGUNITNAME=$organizationalUnitName
2425
export TLSCOMMONNAME=$tlsCommonName
26+
export ORGUNITNAME=$organizationalUnitName
2527

2628
## Script vars
2729
fqdns=()

‎bin/software-ca.sh

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24
#
35
# Sets up the Software CA
46
##
@@ -15,10 +17,12 @@ basepath="$rootpath/.."
1517

1618
## Export the ENV variables
1719
export BASEPATH=$basepath
18-
export SOFTWARECANAME=$softwareCA
20+
export ROOTCANAME=$rootCA
1921
export CABASEURL=$caBaseURL
2022
export COUNTRYNAME=$countryName
2123
export ORGNAME=$organizationName
24+
export SOFTWARECANAME=$softwareCA
25+
export ROOTCOMMONNAME=$rootCommonName
2226
export ORGUNITNAME=$organizationalUnitName
2327
export SOFTWARECOMMONNAME=$softwareCommonName
2428

‎bin/tls-ca.sh

+8-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24
#
35
# Sets up the TLS CA
46
##
@@ -14,13 +16,15 @@ basepath="$rootpath/.."
1416
. $basepath/etc/bash/colors
1517

1618
## Export the ENV variables
17-
export BASEPATH=$basepath
1819
export TLSCANAME=$tlsCA
20+
export BASEPATH=$basepath
21+
export ROOTCANAME=$rootCA
1922
export CABASEURL=$caBaseURL
2023
export COUNTRYNAME=$countryName
2124
export ORGNAME=$organizationName
22-
export ORGUNITNAME=$organizationalUnitName
2325
export TLSCOMMONNAME=$tlsCommonName
26+
export ROOTCOMMONNAME=$rootCommonName
27+
export ORGUNITNAME=$organizationalUnitName
2428

2529
## Create directories
2630
mkdir -p $basepath/ca/tls-ca/private $basepath/ca/tls-ca/db
@@ -63,7 +67,7 @@ function genCsr {
6367
## Check if the CSR exists. If so, ask the user if they
6468
## want to replace it. Otherwise, just create the CSR.
6569
if [[ -f "$basepath/ca/$tlsCA.csr" ]] ; then
66-
echo -e "${red}TLS CA CSR exists!{$NC}"
70+
echo -e "${red}TLS CA CSR exists!${NC}"
6771
echo -n "Do you want to create a new one? (y/N): "
6872
read answer
6973
echo ""
@@ -84,7 +88,7 @@ function genCrt {
8488
}
8589

8690
if [[ -f "$basepath/ca/$tlsCA.crt" ]] ; then
87-
echo -e "${red}TLS CA certificate exists!{$NC}"
91+
echo -e "${red}TLS CA certificate exists!${NC}"
8892
echo -n "Do you want to create a new one? (y/N): "
8993
read answer
9094
echo ""

‎etc/client.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# TLS client certificate request
1+
## TLS client certificate request
22

33
[ req ]
44
default_bits = 2048 # RSA key size

‎etc/codesign.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Code-signing certificate request
1+
## Code-signing certificate request
22

33
[ req ]
44
default_bits = 2048 # RSA key size

‎etc/email.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Email certificate request
1+
## Email certificate request
22

33
[ req ]
44
default_bits = 2048 # RSA key size

‎etc/software-ca.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ organizationalUnitName = optional
7474
commonName = optional
7575
emailAddress = optional
7676

77-
# Extensions
77+
## Extensions
7878

7979
[ codesign_ext ]
8080
keyUsage = critical,digitalSignature

0 commit comments

Comments
 (0)