summaryrefslogtreecommitdiff
path: root/localcsr
blob: c50dd5d4921b5f82611f85b17ee7f7475e62b8d6 (plain)
  1. #!/bin/sh
  2. # csr.sh: Certificate Signing Request Generator
  3. # Copyright(c) 2005 Evaldo Gardenali <evaldo@gardenali.biz>
  4. # Copyright(c) 2006, 2010 Jonas Smedegaard <dr@jones.dk>
  5. # All rights reserved.
  6. #
  7. # Redistribution and use in source and binary forms, with or without
  8. # modification, are permitted provided that the following conditions
  9. # are met:
  10. # 1. Redistributions of source code must retain the above copyright
  11. # notice, this list of conditions and the following disclaimer.
  12. # 2. Redistributions in binary form must reproduce the above copyright
  13. # notice, this list of conditions and the following disclaimer in the
  14. # documentation and/or other materials provided with the distribution.
  15. # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "ASIS"
  16. # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17. # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18. # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  19. # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  20. # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  21. # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  22. # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  23. # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  24. # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  25. # POSSIBILITY OF SUCH DAMAGE.
  26. #
  27. # ChangeLog:
  28. # Mon May 23 00:14:37 BRT 2005 - evaldo - Initial Release
  29. # Wed May 3 12:09:24 UTC 2006 - jonas - Drop $HOME, use current workdir
  30. # Fri Oct 15 10:44:10 CEST 2010 - jonas - Support non-DNS URN (e.g. for WebID)
  31. #
  32. # Original source: http://evaldo.gardenali.biz/cacert/csr
  33. # be safe about permissions
  34. LASTUMASK=`umask`
  35. umask 077
  36. # OpenSSL for HPUX needs a random file
  37. RANDOMFILE=$HOME/.rnd
  38. # create a config file for openssl
  39. CONFIG=`mktemp -q /tmp/openssl-conf.XXXXXXXX`
  40. if [ ! $? -eq 0 ]; then
  41. echo "Could not create temporary config file. exiting"
  42. exit 1
  43. fi
  44. echo "Private Key and Certificate Signing Request Generator"
  45. echo "This script was designed to suit the request format needed by"
  46. echo "the CAcert Certificate Authority. www.CAcert.org"
  47. echo
  48. printf "Short Hostname (ie. imap big_srv www2): "
  49. read HOST
  50. printf "FQDN/CommonName (ie. www.example.com) : "
  51. read COMMONNAME
  52. echo "Type SubjectAltNames for the certificate, one per line."
  53. echo "For normal dns URN type only hostname e.g. www.example.org"
  54. echo "Else type full URN e.g. uri:http://example.com/foaf.rdf#me"
  55. echo "Enter a blank line to finish"
  56. SAN=1 # bogus value to begin the loop
  57. SANAMES="" # sanitize
  58. while [ ! "$SAN" = "" ]; do
  59. printf "SubjectAltName: DNS:"
  60. read SAN
  61. if [ "$SAN" = "" ]; then break; fi # end of input
  62. SAN=$(echo "$SAN" | perl -pe 's/^\s*([^:]+)$/DNS:$1/') #'
  63. if [ "$SANAMES" = "" ]; then
  64. SANAMES="$SAN"
  65. else
  66. SANAMES="$SANAMES,$SAN"
  67. fi
  68. done
  69. # Config File Generation
  70. cat <<EOF > $CONFIG
  71. # -------------- BEGIN custom openssl.cnf -----
  72. EOF
  73. if [ "`uname -s`" = "HP-UX" ]; then
  74. echo " RANDFILE = $RANDOMFILE" >> $CONFIG
  75. fi
  76. cat <<EOF >> $CONFIG
  77. oid_section = new_oids
  78. [ new_oids ]
  79. [ req ]
  80. default_days = 730 # how long to certify for
  81. default_keyfile = ${HOST}_privatekey.pem
  82. distinguished_name = req_distinguished_name
  83. encrypt_key = no
  84. string_mask = nombstr
  85. EOF
  86. if [ ! "$SANAMES" = "" ]; then
  87. echo "req_extensions = v3_req # Extensions to add to certificate request" >> $CONFIG
  88. fi
  89. cat <<EOF >> $CONFIG
  90. [ req_distinguished_name ]
  91. commonName = Common Name (eg, YOUR name)
  92. commonName_default = $COMMONNAME
  93. commonName_max = 64
  94. [ v3_req ]
  95. EOF
  96. if [ ! "$SANAMES" = "" ]; then
  97. echo "subjectAltName=$SANAMES" >> $CONFIG
  98. fi
  99. echo "# -------------- END custom openssl.cnf -----" >> $CONFIG
  100. echo "Running OpenSSL..."
  101. openssl req -batch -config $CONFIG -newkey rsa:2048 -out ${HOST}_csr.pem
  102. echo "Copy the following Certificate Request and paste into CAcert website to obtain a Certificate."
  103. echo "When you receive your certificate, you 'should' name it something like ${HOST}_server.pem"
  104. echo
  105. cat ${HOST}_csr.pem
  106. echo
  107. echo The Certificate request is also available in ${HOST}_csr.pem
  108. echo The Private Key is stored in ${HOST}_privatekey.pem
  109. echo
  110. rm $CONFIG
  111. #restore umask
  112. umask $LASTUMASK