1 $! CA - wrapper around ca to make it easier to use ... basically ca requires
2 $! some setup stuff to be done before you can use it and this makes
3 $! things easier between now and when Eric is convinced to fix it :-)
5 $! CA -newca ... will setup the right stuff
6 $! CA -newreq ... will generate a certificate request
7 $! CA -sign ... will sign the generated request and output
9 $! At the end of that grab newreq.pem and newcert.pem (one has the key
10 $! and the other the certificate) and cat them together and that is what
11 $! you want/need ... I'll make even this a little cleaner later.
14 $! 12-Jan-96 tjh Added more things ... including CA -signcert which
15 $! converts a certificate to a request and then signs it.
16 $! 10-Jan-96 eay Fixed a few more bugs and added the SSLEAY_CONFIG
17 $! environment variable so this can be driven from
19 $! 25-Jul-96 eay Cleaned up filenames some more.
20 $! 11-Jun-96 eay Fixed a few filename missmatches.
21 $! 03-May-96 eay Modified to use 'openssl cmd' instead of 'cmd'.
22 $! 18-Apr-96 tjh Original hacking
28 $! default ssleay.cnf file has setup as per the following
29 $! demoCA ... where everything is stored
31 $ IF F$TYPE(SSLEAY_CONFIG) .EQS. "" THEN SSLEAY_CONFIG := SSLLIB:SSLEAY.CNF
34 $ REQ = openssl + " req " + SSLEAY_CONFIG
35 $ CA = openssl + " ca " + SSLEAY_CONFIG
36 $ VERIFY = openssl + " verify"
37 $ X509 = openssl + " x509"
38 $ echo = "write sys$Output"
40 $ s = F$PARSE(F$ENVIRONMENT("DEFAULT"),"[]") - "].;"
43 $ CACERT := ]cacert.pem
45 $ __INPUT := SYS$COMMAND
50 $ if i .gt. 8 then goto opt_loop_end
52 $ prog_opt = F$EDIT(P'i',"lowercase")
54 $ IF (prog_opt .EQS. "?" .OR. prog_opt .EQS. "-h" .OR. prog_opt .EQS. "-help")
56 $ echo "usage: CA -newcert|-newreq|-newca|-sign|-verify"
60 $ IF (prog_opt .EQS. "-input")
62 $ ! Get input from somewhere other than SYS$COMMAND
65 $ GOTO opt_loop_continue
68 $ IF (prog_opt .EQS. "-newcert")
70 $ ! Create a certificate.
71 $ DEFINE/USER SYS$INPUT '__INPUT'
72 $ REQ -new -x509 -keyout newreq.pem -out newreq.pem 'DAYS'
74 $ echo "Certificate (and private key) is in newreq.pem"
75 $ GOTO opt_loop_continue
78 $ IF (prog_opt .EQS. "-newreq")
80 $ ! Create a certificate request
81 $ DEFINE/USER SYS$INPUT '__INPUT'
82 $ REQ -new -keyout newreq.pem -out newreq.pem 'DAYS'
84 $ echo "Request (and private key) is in newreq.pem"
85 $ GOTO opt_loop_continue
88 $ IF (prog_opt .EQS. "-newca")
90 $ ! If explicitly asked for or it doesn't exist then setup the directory
91 $ ! structure that Eric likes to manage things.
92 $ IF F$SEARCH(CATOP+"]serial.") .EQS. ""
94 $ CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP']
95 $ CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.certs]
96 $ CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.crl]
97 $ CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.newcerts]
98 $ CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.private]
99 $ OPEN /WRITE ser_file 'CATOP']serial.
100 $ WRITE ser_file "01"
102 $ APPEND/NEW NL: 'CATOP']index.txt
105 $ IF F$SEARCH(CATOP+".private"+CAKEY) .EQS. ""
107 $ READ '__INPUT' FILE -
108 /PROMT="CA certificate filename (or enter to create)"
109 $ IF F$SEARCH(FILE) .NES. ""
111 $ COPY 'FILE' 'CATOP'.private'CAKEY'
114 $ echo "Making CA certificate ..."
115 $ DEFINE/USER SYS$INPUT '__INPUT'
116 $ REQ -new -x509 -keyout 'CATOP'.private'CAKEY' -
117 -out 'CATOP''CACERT' 'DAYS'
121 $ GOTO opt_loop_continue
124 $ IF (prog_opt .EQS. "-xsign")
127 $ DEFINE/USER SYS$INPUT '__INPUT'
128 $ CA -policy policy_anything -infiles newreq.pem
130 $ GOTO opt_loop_continue
133 $ IF ((prog_opt .EQS. "-sign") .OR. (prog_opt .EQS. "-signreq"))
136 $ DEFINE/USER SYS$INPUT '__INPUT'
137 $ CA -policy policy_anything -out newcert.pem -infiles newreq.pem
140 $ echo "Signed certificate is in newcert.pem"
141 $ GOTO opt_loop_continue
144 $ IF (prog_opt .EQS. "-signcert")
147 $ echo "Cert passphrase will be requested twice - bug?"
148 $ DEFINE/USER SYS$INPUT '__INPUT'
149 $ X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
150 $ DEFINE/USER SYS$INPUT '__INPUT'
151 $ CA -policy policy_anything -out newcert.pem -infiles tmp.pem
155 $ echo "Signed certificate is in newcert.pem"
156 $ GOTO opt_loop_continue
159 $ IF (prog_opt .EQS. "-verify")
165 $ DEFINE/USER SYS$INPUT '__INPUT'
166 $ VERIFY "-CAfile" 'CATOP''CACERT' newcert.pem
170 $ IF j .GT. 8 THEN GOTO verify_opt_loop_end
173 $ DEFINE/USER SYS$INPUT '__INPUT'
175 $ VERIFY "-CAfile" 'CATOP''CACERT' '__tmp'
177 $ IF tmp .NE. 0 THEN RET=tmp
180 $ GOTO verify_opt_loop
181 $ verify_opt_loop_end:
187 $ IF (prog_opt .NES. "")
190 $ echo "Unknown argument ''prog_opt'"