crea-clientkey.bash

#!/bin/bash
#
#	crea-clientkey.bash
#	Create OpenVPN client certificate
#	(C) Luca Romano 2021
#
#
#
#
#############################################################################
#
#--> Global variables
#
CNX_PRG_NAME=$0
CNX_PATH_TO_OVPN=$HOME/openVPN
CNX_PATH_TO_EASYRSA=$CNX_PATH_TO_OVPN/EasyRSA
CNX_PATH_TO_CA=$CNX_PATH_TO_OVPN/ca
CNX_PATH_TO_PKI=$CNX_PATH_TO_OVPN/pki
CNX_PATH_TO_CLIENTKEY=$CNX_PATH_TO_OVPN/clients
CNX_CN=""
CNX_YN=""
CNX_VPNSERVERLIST=`ls $CNX_PATH_TO_PKI`
CNX_VPNSERVER=""
CNX_VPNADDRESS=""
CNX_COMPLETED="N"

function confirm() {
	CNX_YN=""
	while [ "$CNX_YN" != "y" ]  && [ "$CNX_YN" != "Y" ] && [ "$CNX_YN" != "n" ] && [ "$CNX_YN" != "N" ]
	do
		echo "$1 (Y/N) ?"
		read CNX_YN
	done
}

function quit() {
	echo "$CNX_PRG_NAME: $1"
	exit 1
}

function select_vpnserver() {
	CNX_VPNSERVER=""
	while [ "$CNX_VPNSERVER" == "" ]
	do
		select server in $CNX_VPNSERVERLIST Quit
		do
		CNX_VPNSERVER=$server
		if [ "$CNX_VPNSERVER" != "" ]
		then
			break
		else
			echo "Invalid choice"
		fi
		done
	done
}

function select_vpnaddress() {
	echo "Select remote address for server -> $CNX_VPNSERVER or hit return to accept $CNX_VPNSERVER.connexx.it"
	read CNX_VPNADDRESS
	if [ "$CNX_VPNADDRESS" == "" ]
	then
		CNX_VPNADDRESS=$CNX_VPNSERVER.connexx.it
	fi
}

function select_cn() {
	CNX_CN=""
	while [ "$CNX_CN" == "" ]
	do
		echo "Please enter the common name (CN) for this client; q to quit"
		read CNX_CN
	done
}

#
#--> Message start
#
echo "---- $CNX_PRG_NAME: Create certificate and key for OpenVPN CLIENT ----"

#
#--> MAIN part of script
#
if [ ! -d "$CNX_PATH_TO_EASYRSA" ]
then
	echo "Directory $CNX_PATH_TO_EASYRSA does NOT exist!"
	echo "Please download EasyRSA by doing:"
	echo
	echo "wget -P ~/ https://github.com/OpenVPN/easy-rsa/releases/download/v<Latest version>/EasyRSA-<Latest version>.tgz"
	echo "Execute tar xvf EasyRSA<Latest version>.tgz in your HOME folder ($HOME)"
	echo "Execute ln -s EasyRSA<Latest version>.tgz EasyRSA"
	echo
	echo "Substitute latest version with the correct value (i.e. 3.0.8)"
	echo "Install EasyRSA and restart this script"
	echo
	quit "missing EasyRSA software, exiting..."
fi

if [ ! -d "$CNX_PATH_TO_PKI" ]
then
	echo "Directory $CNX_PATH_TO_PKI does NOT exist; creating..."
	mkdir $CNX_PATH_TO_PKI
fi

if [ ! -d "$CNX_PATH_TO_CLIENTKEY" ]
then
	echo "Directory $CNX_PATH_TO_CLIENTKEY does NOT exist; creating..."
	mkdir $CNX_PATH_TO_CLIENTKEY
	chmod 700 $CNX_PATH_TO_CLIENTKEY
fi

#
#--> LOOP until completed
#
while [ "$CNX_COMPLETED" == "N" ]
do

	select_vpnserver
	if [ "$CNX_VPNSERVER" == "Quit" ]
	then
		quit "exiting upon user request..."
	fi

	select_vpnaddress
	select_cn

	if [ "$CNX_CN" == "q" ] || [ "$CNX_CN" == "Q" ]
	then
		quit "exiting upon user request..."
	fi

	confirm "Generating CLIENT certificate and key with Common Name (CN) -> $CNX_CN to access VPN server -> $CNX_VPNSERVER"
	if [ "$CNX_YN" == "n" ] || [ "$CNX_YN" == "N" ]
	then
		continue
	fi
	CNX_OUTPUT_CLIENT_PATH=$CNX_PATH_TO_CLIENTKEY/$CNX_VPNSERVER
	CNX_OUTPUT_CLIENT_PATH+=VPN/$CNX_CN

	if [ ! -d "$CNX_OUTPUT_CLIENT_PATH" ]
	then
		echo "Directory $CNX_OUTPUT_CLIENT_PATH does NOT exist; creating..."
		mkdir -p $CNX_OUTPUT_CLIENT_PATH
		chmod 700 $CNX_OUTPUT_CLIENT_PATH
	fi
	CNX_PATH_TO_PKI_CA=$CNX_PATH_TO_PKI/$CNX_VPNSERVER/ca
	CNX_PATH_TO_PKI_SERVER=$CNX_PATH_TO_PKI/$CNX_VPNSERVER/server
	cd $CNX_PATH_TO_EASYRSA
	#
	#--> Client part
	#
	./easyrsa --pki-dir=$CNX_PATH_TO_PKI_CA gen-req $CNX_CN nopass
	mv $CNX_PATH_TO_PKI_SERVER/reqs/$CNX_CN.req /tmp
	./easyrsa --pki-dir=$CNX_PATH_TO_PKI_CA import-req /tmp/$CNX_CN.req $CNX_CN
	rm -f /tmp/$CNX_CN.req
	./easyrsa --pki-dir=$CNX_PATH_TO_PKI_CA sign-req client $CNX_CN
	cp $CNX_PATH_TO_PKI_CA/private/$CNX_CN.key $CNX_OUTPUT_CLIENT_PATH
	cp $CNX_PATH_TO_PKI_CA/issued/$CNX_CN.crt $CNX_OUTPUT_CLIENT_PATH
	CNX_OVPN=$CNX_OUTPUT_CLIENT_PATH/$CNX_CN.ovpn
	echo "Creating $CNX_OVPN file..."
	echo "#" > $CNX_OVPN
	echo "# Filename: `basename $CNX_OVPN`" >> $CNX_OVPN
	echo "# Automatically generated by script: `basename $CNX_PRG_NAME`" >> $CNX_OVPN
	echo "# Date: `date`" >> $CNX_OVPN
	echo "#" >> $CNX_OVPN
	cat $CNX_PATH_TO_CLIENTKEY/client.conf | sed "s/my-server-1/$CNX_VPNADDRESS/g" >> $CNX_OVPN
	echo "<ca>" >> $CNX_OVPN
	cat $CNX_PATH_TO_PKI_CA/ca.crt >> $CNX_OVPN
	echo "</ca>" >> $CNX_OVPN
	echo "<cert>" >> $CNX_OVPN
	cat $CNX_OUTPUT_CLIENT_PATH/$CNX_CN.crt >> $CNX_OVPN
	echo "</cert>" >> $CNX_OVPN
	echo "<key>" >> $CNX_OVPN
	cat $CNX_OUTPUT_CLIENT_PATH/$CNX_CN.key >> $CNX_OVPN
	echo "</key>" >> $CNX_OVPN
	echo "<tls-auth>" >> $CNX_OVPN
	cat $CNX_PATH_TO_PKI_SERVER/ta.key >> $CNX_OVPN
	echo "</tls-auth>" >> $CNX_OVPN
	echo "Client configuration for '$CNX_CN' connecting to VPN server -> $CNX_VPNSERVER finished"
	echo "Files are located in $CNX_OUTPUT_CLIENT_PATH"
	echo "Use `basename $CNX_OVPN` in your client openVPN"
	CNX_COMPLETED="Y"
done