3 # Copyright (c) 2016 Viktor Dukhovni <openssl-users@dukhovni.org>.
6 # Contributed to the OpenSSL project under the terms of the OpenSSL license
7 # included with the version of the OpenSSL software that includes this module.
9 # 100 years should be enough for now
13 if [ -z "$OPENSSL_SIGALG" ]; then
19 err=$("$@" >&3 2>&1) || {
20 printf "%s\n" "$err" >&2
30 if [ -n "$OPENSSL_KEYALG" ]; then
35 if [ -n "$OPENSSL_KEYBITS" ]; then
39 if [ ! -f "${key}.pem" ]; then
40 args=(-algorithm "$alg")
42 rsa) args=("${args[@]}" -pkeyopt rsa_keygen_bits:$bits );;
43 ec) args=("${args[@]}" -pkeyopt "ec_paramgen_curve:$bits")
44 args=("${args[@]}" -pkeyopt ec_param_enc:named_curve);;
45 *) printf "Unsupported key algorithm: %s\n" "$alg" >&2; return 1;;
48 openssl genpkey "${args[@]}" -out "${key}.pem"
52 # Usage: $0 req keyname dn1 dn2 ...
60 openssl req -new -"${OPENSSL_SIGALG}" -key "${key}.pem" \
61 -config <(printf "[req]\n%s\n%s\n[dn]\n" \
62 "prompt = no" "distinguished_name = dn" "${dn}"
63 for dn in "$@"; do echo "$dn"; done)
71 openssl req -new -"${OPENSSL_SIGALG}" -subj / -key "${key}.pem" \
72 -config <(printf "[req]\n%s\n[dn]\nCN_default =\n" \
73 "distinguished_name = dn")
81 openssl x509 -req -"${OPENSSL_SIGALG}" -out "${cert}.pem" \
82 -extfile <(printf "%s\n" "$exts") "$@"
89 local skid="subjectKeyIdentifier = hash"
90 local akid="authorityKeyIdentifier = keyid"
92 exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
95 exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
97 csr=$(req "$key" "CN = $cn") || return 1
99 cert "$cert" "$exts" -signkey "${key}.pem" -set_serial 1 -days "${DAYS}"
106 local cakey=$1; shift
107 local cacert=$1; shift
108 local skid="subjectKeyIdentifier = hash"
109 local akid="authorityKeyIdentifier = keyid"
111 exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
114 exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
116 csr=$(req "$key" "CN = $cn") || return 1
118 cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
119 -set_serial 2 -days "${DAYS}"
126 local cakey=$1; shift
127 local cacert=$1; shift
128 local skid="subjectKeyIdentifier = hash"
129 local akid="authorityKeyIdentifier = keyid"
131 exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid")
132 exts=$(printf "%s\nkeyUsage = %s\n" "$exts" "keyCertSign, cRLSign")
135 exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
137 csr=$(req "$key" "CN = $cn") || return 1
139 cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
140 -set_serial 2 -days "${DAYS}"
143 # Usage: $0 genpc keyname certname eekeyname eecertname pcext1 pcext2 ...
145 # Note: takes csr on stdin, so must be used with $0 req like this:
147 # $0 req keyname dn | $0 genpc keyname certname eekeyname eecertname pcext ...
151 local cakey=$1; shift
154 exts=$(printf "%s\n%s\n%s\n%s\n" \
155 "subjectKeyIdentifier = hash" \
156 "authorityKeyIdentifier = keyid, issuer:always" \
157 "basicConstraints = CA:false" \
158 "proxyCertInfo = critical, @pcexts";
160 for x in "$@"; do echo $x; done)
161 cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
162 -set_serial 2 -days "${DAYS}"
167 local purpose=serverAuth
172 p) purpose="$OPTARG";;
173 *) echo "Usage: $0 genee [-p EKU] cn keyname certname cakeyname cacertname" >&2
178 shift $((OPTIND - 1))
182 local cakey=$1; shift
185 exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
186 "subjectKeyIdentifier = hash" \
187 "authorityKeyIdentifier = keyid, issuer" \
188 "basicConstraints = CA:false" \
189 "extendedKeyUsage = $purpose" \
190 "subjectAltName = @alts" "DNS=${cn}")
191 csr=$(req "$key" "CN = $cn") || return 1
193 cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
194 -set_serial 2 -days "${DAYS}" "$@"
202 exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
203 "subjectKeyIdentifier = hash" \
204 "authorityKeyIdentifier = keyid, issuer" \
205 "basicConstraints = CA:false" \
206 "extendedKeyUsage = serverAuth" \
207 "subjectAltName = @alts" "DNS=${cn}")
208 csr=$(req "$key" "CN = $cn") || return 1
210 cert "$cert" "$exts" -signkey "${key}.pem" \
211 -set_serial 1 -days "${DAYS}" "$@"
218 csr=$(req_nocn "$key") || return 1
220 cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days -1 "$@"