3 # Copyright (c) 2016 Viktor Dukhovni <openssl-users@dukhovni.org>.
6 # Contributed to the OpenSSL project under the terms of the OpenSSL license
7 # included with the version of the OpenSSL software that includes this module.
9 # 100 years should be enough for now
11 if [ -z "$DAYS" ]; then
15 if [ -z "$OPENSSL_SIGALG" ]; then
19 if [ -z "$REQMASK" ]; then
25 err=$("$@" >&3 2>&1) || {
26 printf "%s\n" "$err" >&2
36 if [ -n "$OPENSSL_KEYALG" ]; then
41 if [ -n "$OPENSSL_KEYBITS" ]; then
45 if [ ! -f "${key}.pem" ]; then
46 args=(-algorithm "$alg")
48 rsa) args=("${args[@]}" -pkeyopt rsa_keygen_bits:$bits );;
49 ec) args=("${args[@]}" -pkeyopt "ec_paramgen_curve:$bits")
50 args=("${args[@]}" -pkeyopt ec_param_enc:named_curve);;
51 dsa) args=(-paramfile "$bits");;
53 *) printf "Unsupported key algorithm: %s\n" "$alg" >&2; return 1;;
56 openssl genpkey "${args[@]}" -out "${key}.pem"
60 # Usage: $0 req keyname dn1 dn2 ...
68 openssl req -new -"${OPENSSL_SIGALG}" -key "${key}.pem" \
69 -config <(printf "string_mask=%s\n[req]\n%s\n%s\n[dn]\n" \
70 "$REQMASK" "prompt = no" "distinguished_name = dn"
71 for dn in "$@"; do echo "$dn"; done)
79 openssl req -new -"${OPENSSL_SIGALG}" -subj / -key "${key}.pem" \
80 -config <(printf "[req]\n%s\n[dn]\nCN_default =\n" \
81 "distinguished_name = dn")
89 openssl x509 -req -"${OPENSSL_SIGALG}" -out "${cert}.pem" \
90 -extfile <(printf "%s\n" "$exts") "$@"
97 local skid="subjectKeyIdentifier = hash"
98 local akid="authorityKeyIdentifier = keyid"
100 exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
103 exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
105 csr=$(req "$key" "CN = $cn") || return 1
107 cert "$cert" "$exts" -signkey "${key}.pem" -set_serial 1 -days "${DAYS}"
114 local cakey=$1; shift
115 local cacert=$1; shift
116 local skid="subjectKeyIdentifier = hash"
117 local akid="authorityKeyIdentifier = keyid"
119 exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
122 exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
124 if [ -n "$NC" ]; then
125 exts=$(printf "%s\nnameConstraints = %s\n" "$exts" "$NC")
127 csr=$(req "$key" "CN = $cn") || return 1
129 cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
130 -set_serial 2 -days "${DAYS}"
137 local cakey=$1; shift
138 local cacert=$1; shift
139 local skid="subjectKeyIdentifier = hash"
140 local akid="authorityKeyIdentifier = keyid"
142 exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid")
143 exts=$(printf "%s\nkeyUsage = %s\n" "$exts" "keyCertSign, cRLSign")
146 exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
148 csr=$(req "$key" "CN = $cn") || return 1
150 cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
151 -set_serial 2 -days "${DAYS}"
154 # Usage: $0 genpc keyname certname eekeyname eecertname pcext1 pcext2 ...
156 # Note: takes csr on stdin, so must be used with $0 req like this:
158 # $0 req keyname dn | $0 genpc keyname certname eekeyname eecertname pcext ...
162 local cakey=$1; shift
165 exts=$(printf "%s\n%s\n%s\n%s\n" \
166 "subjectKeyIdentifier = hash" \
167 "authorityKeyIdentifier = keyid, issuer:always" \
168 "basicConstraints = CA:false" \
169 "proxyCertInfo = critical, @pcexts";
171 for x in "$@"; do echo $x; done)
172 cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
173 -set_serial 2 -days "${DAYS}"
176 # Usage: $0 genalt keyname certname eekeyname eecertname alt1 alt2 ...
178 # Note: takes csr on stdin, so must be used with $0 req like this:
180 # $0 req keyname dn | $0 genalt keyname certname eekeyname eecertname alt ...
184 local cakey=$1; shift
187 exts=$(printf "%s\n%s\n%s\n%s\n" \
188 "subjectKeyIdentifier = hash" \
189 "authorityKeyIdentifier = keyid" \
190 "basicConstraints = CA:false" \
191 "subjectAltName = @alts";
193 for x in "$@"; do echo $x; done)
194 cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
195 -set_serial 2 -days "${DAYS}"
200 local purpose=serverAuth
205 p) purpose="$OPTARG";;
206 *) echo "Usage: $0 genee [-p EKU] cn keyname certname cakeyname cacertname" >&2
211 shift $((OPTIND - 1))
215 local cakey=$1; shift
218 exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
219 "subjectKeyIdentifier = hash" \
220 "authorityKeyIdentifier = keyid, issuer" \
221 "basicConstraints = CA:false" \
222 "extendedKeyUsage = $purpose" \
223 "subjectAltName = @alts" "DNS=${cn}")
224 csr=$(req "$key" "CN = $cn") || return 1
226 cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
227 -set_serial 2 -days "${DAYS}" "$@"
235 exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
236 "subjectKeyIdentifier = hash" \
237 "authorityKeyIdentifier = keyid, issuer" \
238 "basicConstraints = CA:false" \
239 "extendedKeyUsage = serverAuth" \
240 "subjectAltName = @alts" "DNS=${cn}")
241 csr=$(req "$key" "CN = $cn") || return 1
243 cert "$cert" "$exts" -signkey "${key}.pem" \
244 -set_serial 1 -days "${DAYS}" "$@"
251 csr=$(req_nocn "$key") || return 1
253 cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days -1 "$@"