freedombone-addcert 4.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # A script for creating self-signed certificates on Debian
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. HOSTNAME=
  30. COUNTRY_CODE="US"
  31. AREA="Free Speech Zone"
  32. LOCATION="Freedomville"
  33. ORGANISATION="Freedombone"
  34. UNIT="Freedombone Unit"
  35. EXTENSIONS=""
  36. NODH=
  37. DH_KEYLENGTH=1024
  38. function show_help {
  39. echo ''
  40. echo 'freedombone-addcert -h [hostname] -c [country code] -a [area] -l [location]'
  41. echo ' -o [organisation] -u [unit] --ca "" --nodh ""'
  42. echo ''
  43. echo 'Creates a self-signed certificate for the given hostname'
  44. echo ''
  45. echo ' --help Show help'
  46. echo ' -h --hostname [name] Hostname'
  47. echo ' -c --country [code] Optional country code (eg. US, GB, etc)'
  48. echo ' -a --area [description] Optional area description'
  49. echo ' -l --location [locn] Optional location name'
  50. echo ' -o --organisation [name] Optional organisation name'
  51. echo ' -u --unit [name] Optional unit name'
  52. echo ' --dhkey [bits] DH key length in bits'
  53. echo ' --nodh "" Do not calculate DH params'
  54. echo ' --ca "" Certificate authority cert'
  55. echo ''
  56. exit 0
  57. }
  58. while [[ $# > 1 ]]
  59. do
  60. key="$1"
  61. case $key in
  62. --help)
  63. show_help
  64. ;;
  65. -h|--hostname)
  66. shift
  67. HOSTNAME="$1"
  68. ;;
  69. -c|--country)
  70. shift
  71. COUNTRY_CODE="$1"
  72. ;;
  73. -a|--area)
  74. shift
  75. AREA="$1"
  76. ;;
  77. -l|--location)
  78. shift
  79. LOCATION="$1"
  80. ;;
  81. -o|--organisation)
  82. shift
  83. ORGANISATION="$1"
  84. ;;
  85. -u|--unit)
  86. shift
  87. UNIT="$1"
  88. ;;
  89. --ca)
  90. shift
  91. EXTENSIONS="-extensions v3_ca"
  92. ORGANISATION="Freedombone-CA"
  93. ;;
  94. --nodh)
  95. shift
  96. NODH="true"
  97. ;;
  98. --dhkey)
  99. shift
  100. DH_KEYLENGTH=${1}
  101. ;;
  102. *)
  103. # unknown option
  104. ;;
  105. esac
  106. shift
  107. done
  108. if [ ! $HOSTNAME ]; then
  109. echo 'No hostname specified'
  110. exit 5748
  111. fi
  112. if ! which openssl > /dev/null ;then
  113. echo "$0: openssl is not installed, exiting" 1>&2
  114. exit 5689
  115. fi
  116. CERTFILE=$HOSTNAME
  117. if [[ $ORGANISATION == "Freedombone-CA" ]]; then
  118. CERTFILE="ca-$HOSTNAME"
  119. fi
  120. openssl req -x509 $EXTENSIONS -nodes -days 3650 -sha256 \
  121. -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \
  122. -newkey rsa:4096 -keyout /etc/ssl/private/$CERTFILE.key \
  123. -out /etc/ssl/certs/$CERTFILE.crt
  124. if [ ! $NODH ]; then
  125. openssl dhparam -check -text -5 $DH_KEYLENGTH -out /etc/ssl/certs/$CERTFILE.dhparam
  126. fi
  127. chmod 400 /etc/ssl/private/$CERTFILE.key
  128. chmod 640 /etc/ssl/certs/$CERTFILE.crt
  129. chmod 640 /etc/ssl/certs/$CERTFILE.dhparam
  130. if [ -f /etc/init.d/nginx ]; then
  131. /etc/init.d/nginx reload
  132. fi
  133. # add the public certificate to a separate directory
  134. # so that we can redistribute it easily
  135. if [ ! -d /etc/ssl/mycerts ]; then
  136. mkdir /etc/ssl/mycerts
  137. fi
  138. cp /etc/ssl/certs/$CERTFILE.crt /etc/ssl/mycerts
  139. # Create a bundle of your certificates
  140. cat /etc/ssl/mycerts/*.crt > /etc/ssl/freedombone-bundle.crt
  141. tar -czvf /etc/ssl/freedombone-certs.tar.gz /etc/ssl/mycerts/*.crt
  142. exit 0