-
Notifications
You must be signed in to change notification settings - Fork 1
/
Makefile
147 lines (126 loc) · 2.86 KB
/
Makefile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
# These are external parameters.
export CN
export ALTN1
export ALTN2
export ALTN3
# Generate ECDSA P-256 keys by default.
KT ?= ec:cnf/prime256v1.params
CN ?=
DN ?=
CA ?= 0
# Explicit validity, format: 20240801010000Z (date -u +%Y%m%d%H%M%SZ)
START_DATE ?=
END_DATE ?=
ifndef CLIENT
# Default is to generate a server cert
CLIENT = 0
SERVER = 1
else ifeq "$(CLIENT)" "1"
# If only CLIENT is specified, default SERVER to 0
SERVER ?= 0
endif
ROOT_KT ?= ec:cnf/secp384r1.params
CA_DATA_DIR ?= ./data
export SIGN_CERT ?= $(CA_DATA_DIR)/ca.crt
export SIGN_KEY ?= $(SIGN_CERT:.crt=.key)
export CA_DATA_DIR
ifeq "$(CLIENT)$(SERVER)" "00"
$(error Both CLIENT and SERVER cannot be 0)
else ifeq "$(CLIENT)$(SERVER)" "01"
export _EKU=serverAuth
else ifeq "$(CLIENT)$(SERVER)" "10"
export _EKU=clientAuth
else ifeq "$(CLIENT)$(SERVER)" "11"
export _EKU=clientAuth,serverAuth
else
$(error CLIENT and SERVER must be 0 or 1)
endif
ifeq "$(DN)" ""
DN = /CN=$(CN)
endif
ifneq "$(START_DATE)$(END_DATE)" ""
ifneq "$(START_DATE)" ""
_VALIDITY = -startdate $(START_DATE)
else
_VALIDITY = -startdate $(shell date -u +%Y%m%d%H%M%SZ)
endif
_VALIDITY += -enddate $(END_DATE)
else ifdef DAYS
_VALIDITY = -days $(DAYS)
else ifeq "$(CA)" "1"
_VALIDITY = -days 3653
else
_VALIDITY = -days 365
endif
ifeq "$(CA)" "1"
export _CNF=cnf/ca.cnf
export _CA = TRUE
else ifneq "$(ALTN1:%=1)$(ALTN2:%=2)$(ALTN3:%=3)" ""
export _CNF=cnf/cert_altn.cnf
export _CA = FALSE
export _ALTN_SECTION=$(ALTN1:%=1)$(ALTN2:%=2)$(ALTN3:%=3)
else
export _CNF=cnf/cert.cnf
export _CA = FALSE
endif
.PHONY: ca check-ca-data clean clean-ca
$(CA_DATA_DIR)/ca.crt: cnf/ca.cnf
_CA=TRUE openssl req \
-subj "$(DN)" \
-out $(@:.crt=.csr) \
-keyout $(@:.crt=.key) \
-newkey $(ROOT_KT) \
-nodes \
-config $<
mkdir $(CA_DATA_DIR)/certs
echo -n true > $(CA_DATA_DIR)/index.txt
touch $(CA_DATA_DIR)/index.txt.attr
_CA=TRUE openssl ca \
-in $(@:.crt=.csr) \
-keyfile $(@:.crt=.key) \
-out $@ \
-config cnf/ca.cnf \
-create_serial \
-batch \
-selfsign \
-preserveDN \
$(_VALIDITY)
rm $(@:.crt=.csr)
check-ca-data:
@[ "$(CN)$(DN)" != "/CN=" ] || { printf '\n *** Root CN or DN must be specified ***\n\n'; exit 1; }
@[ ! -e "$(CA_DATA_DIR)" ] || { printf '\n *** CA data already exists! Use "make clean-ca" to wipe. ***\n\n'; exit 1; }
$(CA_DATA_DIR):
mkdir $@
ca: check-ca-data $(CA_DATA_DIR) $(CA_DATA_DIR)/ca.crt
cat $(CA_DATA_DIR)/ca.crt
%.csr:
ifeq "$(CN)$(DN)" "/CN="
$(eval DN=/CN=$(@:%.csr=%))
endif
openssl req \
-subj "$(DN)" \
-out $@ \
-keyout $(@:.csr=.key) \
-newkey $(KT) \
-nodes \
-text \
-config $(_CNF)
%.crt.tmp: %.csr
rm -f $(CA_DATA_DIR)/ca.srl
openssl ca \
-in $< \
-out $@ \
-config cnf/ca.cnf \
$(_VALIDITY) \
-preserveDN \
-create_serial \
-batch
%.crt: %.crt.tmp
openssl x509 \
-in $< \
-text > $@
cat $@
clean:
rm -f *.crt *.key
clean-ca: clean
rm -rf $(CA_DATA_DIR)