summaryrefslogtreecommitdiff
path: root/localcsr
blob: 9c13741d570c7dacc914eb0ed7d87098bbc40962 (plain)
  1. #!/bin/sh
  2. # csr.sh: Certificate Signing Request Generator
  3. # Copyright(c) 2005 Evaldo Gardenali <evaldo@gardenali.biz>
  4. # All rights reserved.
  5. #
  6. # Redistribution and use in source and binary forms, with or without
  7. # modification, are permitted provided that the following conditions
  8. # are met:
  9. # 1. Redistributions of source code must retain the above copyright
  10. # notice, this list of conditions and the following disclaimer.
  11. # 2. Redistributions in binary form must reproduce the above copyright
  12. # notice, this list of conditions and the following disclaimer in the
  13. # documentation and/or other materials provided with the distribution.
  14. # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "ASIS"
  15. # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16. # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17. # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  18. # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  19. # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  20. # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  21. # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  22. # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  23. # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  24. # POSSIBILITY OF SUCH DAMAGE.
  25. #
  26. # ChangeLog:
  27. # Mon May 23 00:14:37 BRT 2005 - evaldo - Initial Release
  28. # Wed May 3 12:09:24 UTC 2006 - jonas - Drop $HOME, use current workdir
  29. #
  30. # Original source: http://evaldo.gardenali.biz/cacert/csr
  31. # be safe about permissions
  32. LASTUMASK=`umask`
  33. umask 077
  34. # OpenSSL for HPUX needs a random file
  35. RANDOMFILE=$HOME/.rnd
  36. # create a config file for openssl
  37. CONFIG=`mktemp -q /tmp/openssl-conf.XXXXXXXX`
  38. if [ ! $? -eq 0 ]; then
  39. echo "Could not create temporary config file. exiting"
  40. exit 1
  41. fi
  42. echo "Private Key and Certificate Signing Request Generator"
  43. echo "This script was designed to suit the request format needed by"
  44. echo "the CAcert Certificate Authority. www.CAcert.org"
  45. echo
  46. printf "Short Hostname (ie. imap big_srv www2): "
  47. read HOST
  48. printf "FQDN/CommonName (ie. www.example.com) : "
  49. read COMMONNAME
  50. echo "Type SubjectAltNames for the certificate, one per line. Enter a blank line to finish"
  51. SAN=1 # bogus value to begin the loop
  52. SANAMES="" # sanitize
  53. while [ ! "$SAN" = "" ]; do
  54. printf "SubjectAltName: DNS:"
  55. read SAN
  56. if [ "$SAN" = "" ]; then break; fi # end of input
  57. if [ "$SANAMES" = "" ]; then
  58. SANAMES="DNS:$SAN"
  59. else
  60. SANAMES="$SANAMES,DNS:$SAN"
  61. fi
  62. done
  63. # Config File Generation
  64. cat <<EOF > $CONFIG
  65. # -------------- BEGIN custom openssl.cnf -----
  66. EOF
  67. if [ "`uname -s`" = "HP-UX" ]; then
  68. echo " RANDFILE = $RANDOMFILE" >> $CONFIG
  69. fi
  70. cat <<EOF >> $CONFIG
  71. oid_section = new_oids
  72. [ new_oids ]
  73. [ req ]
  74. default_days = 730 # how long to certify for
  75. default_keyfile = ${HOST}_privatekey.pem
  76. distinguished_name = req_distinguished_name
  77. encrypt_key = no
  78. string_mask = nombstr
  79. EOF
  80. if [ ! "$SANAMES" = "" ]; then
  81. echo "req_extensions = v3_req # Extensions to add to certificate request" >> $CONFIG
  82. fi
  83. cat <<EOF >> $CONFIG
  84. [ req_distinguished_name ]
  85. commonName = Common Name (eg, YOUR name)
  86. commonName_default = $COMMONNAME
  87. commonName_max = 64
  88. [ v3_req ]
  89. EOF
  90. if [ ! "$SANAMES" = "" ]; then
  91. echo "subjectAltName=$SANAMES" >> $CONFIG
  92. fi
  93. echo "# -------------- END custom openssl.cnf -----" >> $CONFIG
  94. echo "Running OpenSSL..."
  95. openssl req -batch -config $CONFIG -newkey rsa:2048 -out ${HOST}_csr.pem
  96. echo "Copy the following Certificate Request and paste into CAcert website to obtain a Certificate."
  97. echo "When you receive your certificate, you 'should' name it something like ${HOST}_server.pem"
  98. echo
  99. cat ${HOST}_csr.pem
  100. echo
  101. echo The Certificate request is also available in ${HOST}_csr.pem
  102. echo The Private Key is stored in ${HOST}_privatekey.pem
  103. echo
  104. rm $CONFIG
  105. #restore umask
  106. umask $LASTUMASK