浏览代码

Option to set DH key length

Bob Mottram 9 年前
父节点
当前提交
5affb786ea
共有 2 个文件被更改,包括 7 次插入1 次删除
  1. 二进制
      man/freedombone-addcert.1.gz
  2. 7
    1
      src/freedombone-addcert

二进制
man/freedombone-addcert.1.gz 查看文件


+ 7
- 1
src/freedombone-addcert 查看文件

36
 UNIT="Freedombone Unit"
36
 UNIT="Freedombone Unit"
37
 EXTENSIONS=""
37
 EXTENSIONS=""
38
 NODH=
38
 NODH=
39
+DH_KEYLENGTH=1024
39
 
40
 
40
 function show_help {
41
 function show_help {
41
     echo ''
42
     echo ''
51
     echo '  -l --location [locn]       Optional location name'
52
     echo '  -l --location [locn]       Optional location name'
52
     echo '  -o --organisation [name]   Optional organisation name'
53
     echo '  -o --organisation [name]   Optional organisation name'
53
     echo '  -u --unit [name]           Optional unit name'
54
     echo '  -u --unit [name]           Optional unit name'
55
+    echo '     --dhkey [bits]          DH key length in bits'
54
     echo '     --nodh ""               Do not calculate DH params'
56
     echo '     --nodh ""               Do not calculate DH params'
55
     echo '     --ca ""                 Certificate authority cert'
57
     echo '     --ca ""                 Certificate authority cert'
56
     echo ''
58
     echo ''
98
     shift
100
     shift
99
     NODH="true"
101
     NODH="true"
100
     ;;
102
     ;;
103
+    --dhkey)
104
+    shift
105
+    DH_KEYLENGTH=${1}
106
+    ;;
101
     *)
107
     *)
102
     # unknown option
108
     # unknown option
103
     ;;
109
     ;;
125
         -newkey rsa:4096 -keyout /etc/ssl/private/$CERTFILE.key \
131
         -newkey rsa:4096 -keyout /etc/ssl/private/$CERTFILE.key \
126
         -out /etc/ssl/certs/$CERTFILE.crt
132
         -out /etc/ssl/certs/$CERTFILE.crt
127
 if [ ! $NODH ]; then
133
 if [ ! $NODH ]; then
128
-    openssl dhparam -check -text -5 1024 -out /etc/ssl/certs/$CERTFILE.dhparam
134
+    openssl dhparam -check -text -5 $DH_KEYLENGTH -out /etc/ssl/certs/$CERTFILE.dhparam
129
 fi
135
 fi
130
 chmod 400 /etc/ssl/private/$CERTFILE.key
136
 chmod 400 /etc/ssl/private/$CERTFILE.key
131
 chmod 640 /etc/ssl/certs/$CERTFILE.crt
137
 chmod 640 /etc/ssl/certs/$CERTFILE.crt