1#!/bin/bash
2#***************************************************************************
3#                                  _   _ ____  _
4#  Project                     ___| | | |  _ \| |
5#                             / __| | | | |_) | |
6#                            | (__| |_| |  _ <| |___
7#                             \___|\___/|_| \_\_____|
8#
9# Copyright (C) EdelWeb for EdelKey and OpenEvidence
10#
11# This software is licensed as described in the file COPYING, which
12# you should have received as part of this distribution. The terms
13# are also available at https://curl.se/docs/copyright.html.
14#
15# You may opt to use, copy, modify, merge, publish, distribute and/or sell
16# copies of the Software, and permit persons to whom the Software is
17# furnished to do so, under the terms of the COPYING file.
18#
19# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20# KIND, either express or implied.
21#
22# SPDX-License-Identifier: curl
23#
24###########################################################################
25
26OPENSSL=openssl
27if [ -f /usr/local/ssl/bin/openssl ] ; then
28   OPENSSL=/usr/local/ssl/bin/openssl
29fi
30
31USAGE="echo Usage is genserv.sh <prefix> <caprefix>"
32
33# exit on first fail
34set -e
35
36HOME=`pwd`
37cd $HOME
38
39KEYSIZE=2048
40DURATION=3000
41# The -sha256 option was introduced in OpenSSL 1.0.1
42DIGESTALGO=-sha256
43
44REQ=YES
45P12=NO
46DHP=NO
47
48PREFIX=$1
49if [ ".$PREFIX" = . ] ; then
50   echo No configuration prefix
51   NOTOK=1
52else
53   if [ ! -f $PREFIX-sv.prm ] ; then
54      echo No configuration file $PREFIX-sv.prm
55      NOTOK=1
56   fi
57fi
58
59CAPREFIX=$2
60if [ ".$CAPREFIX" = . ] ; then
61   echo No CA prefix
62   NOTOK=1
63else
64   if [ ! -f $CAPREFIX-ca.cacert ] ; then
65      echo No CA certificate file $CAPREFIX-ca.caert
66      NOTOK=1
67   fi
68   if [ ! -f $CAPREFIX-ca.key ] ; then
69      echo No $CAPREFIX key
70      NOTOK=1
71   fi
72fi
73
74if [ ".$NOTOK" != . ] ; then
75   echo "Sorry, I can't do that for you."
76   $USAGE
77   exit
78fi
79
80if [ ".$SERIAL" = . ] ; then
81   GETSERIAL="\$t = time ;\$d =  \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
82   SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
83fi
84
85echo SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
86
87if [ "$DHP." = YES. ] ; then
88   echo "openssl dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE"
89   $OPENSSL dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE
90fi
91
92if [ "$REQ." = YES. ] ; then
93   echo "openssl req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout XXX"
94   $OPENSSL req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout pass:secret
95fi
96
97echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key"
98$OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret
99echo pseudo secrets generated
100
101echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der"
102$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der
103
104echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem"
105$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem
106
107echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION  -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt "
108
109$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION  -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt
110
111if [ "$P12." = YES. ] ; then
112
113   echo "$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt "
114
115   $OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt
116fi
117
118echo "openssl x509 -noout -text -hash -in $PREFIX-sv.selfcert -nameopt multiline"
119$OPENSSL x509 -noout -text -hash -in $PREFIX-sv.crt -nameopt multiline
120
121# revoke server cert
122touch $CAPREFIX-ca.db
123echo 01 > $CAPREFIX-ca.cnt
124echo "openssl ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt"
125$OPENSSL ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt
126
127# issue CRL
128echo "openssl ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl"
129$OPENSSL ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl
130
131echo "openssl x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der "
132$OPENSSL x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der
133
134# all together now
135touch $PREFIX-sv.dhp
136cat $PREFIX-sv.prm $PREFIX-sv.key  $PREFIX-sv.crt $PREFIX-sv.dhp >$PREFIX-sv.pem
137chmod o-r $PREFIX-sv.prm
138
139$OPENSSL x509 -in $PREFIX-sv.pem -pubkey -noout | \
140$OPENSSL pkey -pubin -outform der | $OPENSSL dgst -sha256 -binary | \
141$OPENSSL enc -base64 >$PREFIX-sv.pubkey-pinned
142
143echo "$PREFIX-sv.pem done"
144