1 $! CA - wrapper around ca to make it easier to use ... basically ca requires
2 $! some setup stuff to be done before you can use it and this makes
3 $! things easier between now and when Eric is convinced to fix it :-)
5 $! CA -newca ... will setup the right stuff
6 $! CA -newreq ... will generate a certificate request
7 $! CA -sign ... will sign the generated request and output
9 $! At the end of that grab newreq.pem and newcert.pem (one has the key
10 $! and the other the certificate) and cat them together and that is what
11 $! you want/need ... I'll make even this a little cleaner later.
13 $! default openssl.cnf file has setup as per the following
14 $! demoCA ... where everything is stored
16 $ IF F$TYPE(OPENSSL_CONFIG) .EQS. "" THEN OPENSSL_CONFIG := SSLLIB:OPENSSL.CNF
19 $ REQ = openssl + " req " + OPENSSL_CONFIG
20 $ CA = openssl + " ca " + OPENSSL_CONFIG
21 $ VERIFY = openssl + " verify"
22 $ X509 = openssl + " x509"
23 $ PKCS12 = openssl + " pkcs12"
24 $ echo = "write sys$Output"
28 $! Use a concealed logical name to reduce command line lengths, to
29 $! avoid DCL errors on VAX:
30 $! %DCL-W-TKNOVF, command element is too long - shorten
31 $! (Path segments like "openssl-1_0_1-stable-SNAP-20101217" accumulate
34 $ CATOP = F$PARSE( F$ENVIRONMENT( "DEFAULT"), "[]")- "].;"+ ".demoCA.]"
35 $ define /translation_attributes = concealed CATOP 'CATOP'
37 $ on error then goto clean_up
38 $ on control_y then goto clean_up
40 $ CAKEY = "CATOP:[private]cakey.pem"
41 $ CACERT = "CATOP:[000000]cacert.pem"
43 $ __INPUT := SYS$COMMAND
47 $ if i .gt. 8 then goto opt_loop_end
49 $ prog_opt = F$EDIT(P'i',"lowercase")
51 $ IF (prog_opt .EQS. "?" .OR. prog_opt .EQS. "-h" .OR. prog_opt .EQS. "-help")
53 $ echo "usage: CA -newcert|-newreq|-newca|-sign|-verify"
57 $ IF (prog_opt .EQS. "-input")
59 $ ! Get input from somewhere other than SYS$COMMAND
62 $ GOTO opt_loop_continue
65 $ IF (prog_opt .EQS. "-newcert")
67 $ ! Create a certificate.
68 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
69 $ REQ -new -x509 -keyout newreq.pem -out newreq.pem 'DAYS'
71 $ echo "Certificate (and private key) is in newreq.pem"
72 $ GOTO opt_loop_continue
75 $ IF (prog_opt .EQS. "-newreq")
77 $ ! Create a certificate request
78 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
79 $ REQ -new -keyout newreq.pem -out newreq.pem 'DAYS'
81 $ echo "Request (and private key) is in newreq.pem"
82 $ GOTO opt_loop_continue
85 $ IF (prog_opt .EQS. "-newca")
87 $ ! If explicitly asked for or it doesn't exist then setup the directory
88 $ ! structure that Eric likes to manage things.
89 $ IF F$SEARCH( "CATOP:[000000]serial.") .EQS. ""
91 $ CREATE /DIRECTORY /PROTECTION=OWNER:RWED CATOP:[000000]
92 $ CREATE /DIRECTORY /PROTECTION=OWNER:RWED CATOP:[certs]
93 $ CREATE /DIRECTORY /PROTECTION=OWNER:RWED CATOP:[crl]
94 $ CREATE /DIRECTORY /PROTECTION=OWNER:RWED CATOP:[newcerts]
95 $ CREATE /DIRECTORY /PROTECTION=OWNER:RWED CATOP:[private]
97 $ OPEN /WRITE ser_file CATOP:[000000]serial.
100 $ APPEND /NEW_VERSION NL: CATOP:[000000]index.txt
102 $ ! The following is to make sure access() doesn't get confused. It
103 $ ! really needs one file in the directory to give correct answers...
104 $ COPY NLA0: CATOP:[certs].;
105 $ COPY NLA0: CATOP:[crl].;
106 $ COPY NLA0: CATOP:[newcerts].;
107 $ COPY NLA0: CATOP:[private].;
110 $ IF F$SEARCH( CAKEY) .EQS. ""
112 $ READ '__INPUT' FILE -
113 /PROMPT="CA certificate filename (or enter to create): "
114 $ IF (FILE .NES. "") .AND. (F$SEARCH(FILE) .NES. "")
116 $ COPY 'FILE' 'CAKEY'
119 $ echo "Making CA certificate ..."
120 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
121 $ REQ -new -x509 -keyout 'CAKEY' -out 'CACERT' 'DAYS'
125 $ GOTO opt_loop_continue
128 $ IF (prog_opt .EQS. "-pkcs12")
132 $ IF cname .EQS. "" THEN cname = "My certificate"
133 $ PKCS12 -in newcert.pem -inkey newreq.pem -certfile 'CACERT' -
134 -out newcert.p12 -export -name "''cname'"
139 $ IF (prog_opt .EQS. "-xsign")
142 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
143 $ CA -policy policy_anything -infiles newreq.pem
145 $ GOTO opt_loop_continue
148 $ IF ((prog_opt .EQS. "-sign") .OR. (prog_opt .EQS. "-signreq"))
151 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
152 $ CA -policy policy_anything -out newcert.pem -infiles newreq.pem
155 $ echo "Signed certificate is in newcert.pem"
156 $ GOTO opt_loop_continue
159 $ IF (prog_opt .EQS. "-signcert")
162 $ echo "Cert passphrase will be requested twice - bug?"
163 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
164 $ X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
165 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
166 $ CA -policy policy_anything -out newcert.pem -infiles tmp.pem
170 $ echo "Signed certificate is in newcert.pem"
171 $ GOTO opt_loop_continue
174 $ IF (prog_opt .EQS. "-verify")
180 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
181 $ VERIFY "-CAfile" 'CACERT' newcert.pem
185 $ IF j .GT. 8 THEN GOTO verify_opt_loop_end
188 $ DEFINE /USER_MODE SYS$INPUT '__INPUT'
190 $ VERIFY "-CAfile" 'CACERT' '__tmp'
192 $ IF tmp .NE. 0 THEN RET=tmp
195 $ GOTO verify_opt_loop
196 $ verify_opt_loop_end:
202 $ IF (prog_opt .NES. "")
205 $ echo "Unknown argument ''prog_opt'"
218 $ if f$trnlnm( "CATOP", "LNM$PROCESS") .nes. "" then -
219 deassign /process CATOP