freedombone-addcert 3.8KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # A script for creating self-signed certificates on Debian
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. HOSTNAME=
  30. COUNTRY_CODE="US"
  31. AREA="Free Speech Zone"
  32. LOCATION="Freedomville"
  33. ORGANISATION="Freedombone"
  34. UNIT="Freedombone Unit"
  35. EXTENSIONS=""
  36. NODH=
  37. function show_help {
  38. echo ''
  39. echo 'freedombone-addcert -h [hostname] -c [country code] -a [area] -l [location]'
  40. echo ' -o [organisation] -u [unit] --ca "" --nodh ""'
  41. echo ''
  42. echo 'Creates a self-signed certificate for the given hostname'
  43. echo ''
  44. echo ' --help Show help'
  45. echo ' -h --hostname [name] Hostname'
  46. echo ' -c --country [code] Optional country code (eg. US, GB, etc)'
  47. echo ' -a --area [description] Optional area description'
  48. echo ' -l --location [locn] Optional location name'
  49. echo ' -o --organisation [name] Optional organisation name'
  50. echo ' -u --unit [name] Optional unit name'
  51. echo ' --nodh "" Do not calculate DH params'
  52. echo ' --ca "" Certificate authority cert'
  53. echo ''
  54. exit 0
  55. }
  56. while [[ $# > 1 ]]
  57. do
  58. key="$1"
  59. case $key in
  60. --help)
  61. show_help
  62. ;;
  63. -h|--hostname)
  64. shift
  65. HOSTNAME="$1"
  66. ;;
  67. -c|--country)
  68. shift
  69. COUNTRY_CODE="$1"
  70. ;;
  71. -a|--area)
  72. shift
  73. AREA="$1"
  74. ;;
  75. -l|--location)
  76. shift
  77. LOCATION="$1"
  78. ;;
  79. -o|--organisation)
  80. shift
  81. ORGANISATION="$1"
  82. ;;
  83. -u|--unit)
  84. shift
  85. UNIT="$1"
  86. ;;
  87. --ca)
  88. shift
  89. EXTENSIONS="-extensions v3_ca"
  90. ORGANISATION="Freedombone-CA"
  91. ;;
  92. --nodh)
  93. shift
  94. NODH="true"
  95. ;;
  96. *)
  97. # unknown option
  98. ;;
  99. esac
  100. shift
  101. done
  102. if [ ! $HOSTNAME ]; then
  103. echo 'No hostname specified'
  104. exit 5748
  105. fi
  106. if ! which openssl > /dev/null ;then
  107. echo "$0: openssl is not installed, exiting" 1>&2
  108. exit 5689
  109. fi
  110. CERTFILE=$HOSTNAME
  111. if [[ $ORGANISATION == "Freedombone-CA" ]]; then
  112. CERTFILE="ca-$HOSTNAME"
  113. fi
  114. openssl req -x509 $EXTENSIONS -nodes -days 3650 -sha256 \
  115. -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \
  116. -newkey rsa:4096 -keyout /etc/ssl/private/$CERTFILE.key \
  117. -out /etc/ssl/certs/$CERTFILE.crt
  118. if [ ! $NODH ]; then
  119. openssl dhparam -check -text -5 1024 -out /etc/ssl/certs/$CERTFILE.dhparam
  120. fi
  121. chmod 400 /etc/ssl/private/$CERTFILE.key
  122. chmod 640 /etc/ssl/certs/$CERTFILE.crt
  123. chmod 640 /etc/ssl/certs/$CERTFILE.dhparam
  124. if [ -f /etc/init.d/nginx ]; then
  125. /etc/init.d/nginx reload
  126. fi
  127. # add the public certificate to a separate directory
  128. # so that we can redistribute it easily
  129. if [ ! -d /etc/ssl/mycerts ]; then
  130. mkdir /etc/ssl/mycerts
  131. fi
  132. cp /etc/ssl/certs/$CERTFILE.crt /etc/ssl/mycerts
  133. # Create a bundle of your certificates
  134. cat /etc/ssl/mycerts/*.crt > /etc/ssl/freedombone-bundle.crt
  135. tar -czvf /etc/ssl/freedombone-certs.tar.gz /etc/ssl/mycerts/*.crt
  136. exit 0