diff options
Diffstat (limited to 'src/script/signssl.sh')
| -rw-r--r-- | src/script/signssl.sh | 30 |
1 files changed, 27 insertions, 3 deletions
diff --git a/src/script/signssl.sh b/src/script/signssl.sh index 44033e7..2a0234d 100644 --- a/src/script/signssl.sh +++ b/src/script/signssl.sh @@ -13,7 +13,7 @@ do_help() { echo "./signssl -type cert_name -cafrom ca_name -cakeyfrom key_name" echo "usage: ./signssl args" - echo " -type cert_name - input type (-middle, -entity)" + echo " -type cert_name - input type (-caroot -middle, -entity)" echo " -cafrom ca_name - input ca_name (root certificate)" echo " -cakeyfrom key_name - input key_name (the root keys)" exit @@ -37,6 +37,10 @@ do_check() do_help exit fi + + if [ "$type_name" == "-caroot" ]; then + return + fi if [ "$caform" != "-cafrom" ] || [ "$caname" == "" ]; then echo "root certificate name is unkone!" do_help @@ -68,14 +72,30 @@ do_entity() fi openssl genrsa -out ${name}.pem 1024 openssl rsa -in ${name}.pem -out ${name}.key - openssl req -new -key ${name}.pem -out ${name}.csr - openssl x509 -req -days 365 -sha256 -extfile /etc/pki/tls/openssl.cnf -extensions v3_req -CA ${caname} -CAkey ${cakey} -CAserial ca.srl -CAcreateserial -in ${name}.csr -out ${name}.cer + + openssl req -new -sha256 -key ${name}.key -reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:*.${name}.com,DNS:*.${name}.cn")) -out ${name}.csr + + openssl ca -in ${name}.csr -md sha256 -keyfile ${cakey} -cert ${caname} -extensions SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:*.${name}.com,DNS:*.${name}.cn")) -out ${name}.cer + openssl pkcs12 -export -in ${name}.cer -inkey ${name}.key -chain -CAfile ${caname} -out ${name}.p12 mv ${name}.* entity } +do_caroot() +{ + if [ ! -d ".caroot" ];then + mkdir caroot + fi + openssl genrsa -out ${name}.pem 1024 + openssl rsa -in ${name}.pem -out ${name}.key + openssl req -new -key ${name}.pem -out ${name}.csr + openssl x509 -req -days 365 -sha256 -extfile /etc/pki/tls/openssl.cnf -extensions v3_ca -signkey ${name}.pem -in ${name}.csr -out ${name}.cer + + mv ${name}.* caroot +} + do_signssl() { if [ "$type_name" == "-middle" ]; then @@ -86,6 +106,10 @@ do_signssl() do_entity exit fi + if [ "$type_name" == "-caroot" ]; then + do_caroot + exit + fi } do_check |