-
Notifications
You must be signed in to change notification settings - Fork 0
/
setup-2tier-ca.sh
executable file
·158 lines (136 loc) · 4.11 KB
/
setup-2tier-ca.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
#!/bin/bash
cat - > new-root-batch.conf << EOF
[ req ]
distinguished_name = req_fields
prompt = no
x509_extensions = extensions
[ req_fields ]
C = US
ST = New York
L = Astoria
O = MyDomain.com
CN = root
emailAddress = me@mydomain.com
[ extensions ]
basicConstraints = CA:TRUE
keyUsage = keyCertSign, cRLSign
EOF
openssl genrsa -out root.key 2048
openssl req -new -key root.key -days 3650 -x509 -batch -config new-root-batch.conf -out root.pem
cat - > new-intermediate-batch.conf << EOF
[ req ]
distinguished_name = req_fields
prompt = no
x509_extensions = extensions
[ req_fields ]
C = US
ST = New York
L = Astoria
O = MyDomain.com
OU = TechOps DCA
CN = intermediate
emailAddress = me@mydomain.com
[ extensions ]
basicConstraints = CA:TRUE
keyUsage = keyCertSign, cRLSign
[ x509 ]
EOF
openssl genrsa -out intermediate.key 2048
openssl req -new -key intermediate.key -days 3650 -batch -config new-intermediate-batch.conf -out intermediate.req
cat - > root.conf << EOF
[ ca ]
default_ca = myca
[ crl_ext ]
# issuerAltName=issuer:copy #this would copy the issuer name to altname
authorityKeyIdentifier=keyid:always
[ myca ]
new_certs_dir = root-certs/
unique_subject = no
certificate = root.pem
database = root.db
private_key = root.key
serial = root-serial.txt
default_days = 3650
default_md = sha1
policy = myca_policy
x509_extensions = myca_extensions
[ myca_policy ]
commonName = supplied
emailAddress = optional
organizationName = supplied
organizationalUnitName = supplied
[ myca_extensions ]
basicConstraints = CA:TRUE
keyUsage = keyCertSign, cRLSign
subjectKeyIdentifier = hash
#authorityKeyIdentifier = keyid:always
crlDistributionPoints = URI:http://path.to.crl/myca.crl
EOF
mkdir root-certs
echo 0001 > root-serial.txt
touch root.db
openssl ca -batch -config root.conf -notext -in intermediate.req -out intermediate.pem
cat - > intermediate.conf << EOF
[ ca ]
default_ca = myca
[ crl_ext ]
# issuerAltName=issuer:copy #this would copy the issuer name to altname
authorityKeyIdentifier=keyid:always
[ myca ]
new_certs_dir = intermediate-certs/
unique_subject = no
certificate = intermediate.pem
database = intermediate.db
private_key = intermediate.key
serial = intermediate-serial.txt
default_days = 365
default_md = sha1
policy = myca_policy
x509_extensions = myca_extensions
[ myca_policy ]
commonName = supplied
emailAddress = optional
organizationName = supplied
organizationalUnitName = supplied
[ myca_extensions ]
basicConstraints = CA:false
subjectKeyIdentifier = hash
#authorityKeyIdentifier = keyid:always
keyUsage = digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth
crlDistributionPoints = URI:http://path.to.crl/myca.crl
[ req ]
default_bits = 2048
distinguished_name = req_fields
prompt = yes
[ req_fields ]
O = "Organization"
O_default = "MyDomain.com"
OU = "Organizational Unit"
OU_default = "IT"
CN = "Fully-qualified Hostname"
CN_default = "somehost.mydomain.com"
emailAddress = "Email address"
emailAddress_default = "me@mydomain.com"
EOF
mkdir intermediate-certs
touch intermediate.db
echo 0001 > intermediate-serial.txt
#keytool -genkey -alias agent -keyalg RSA -keystore agent.jks -keysize 2048 -storepass 123456 \
# -dname "O=MyDomain.com, OU=IT, CN=somehost.mydomain.com/emailAddress=me@mydomain.com" \
# -noprompt
#keytool -certreq -alias agent -keystore agent.jks -file pipedev.req -storepass 123456 -noprompt
openssl genrsa -out pipedev.key 2048
openssl req -new -key pipedev.key -days 3650 -batch -config intermediate.conf -out pipedev.req
openssl ca -batch -config intermediate.conf -notext -in pipedev.req -out pipedev.pem
cat pipedev.pem intermediate.pem root.pem > chain.pem
openssl pkcs12 -export -in chain.pem -inkey pipedev.key \
-export -out pipedev.p12 \
-name agent \
-password pass:123456
keytool -importkeystore -deststorepass 123456 -destkeystore agent.jks \
-srckeystore pipedev.p12 -srcstoretype PKCS12 -srcstorepass 123456 \
-alias agent
#keytool -importcert -alias root -file root.pem -keystore agent.jks -storepass 123456
#keytool -importcert -alias intermediate -file intermediate.pem -keystore agent.jks -storepass 123456
#keytool -importcert -alias agent -file pipedev.pem -keystore agent.jks -storepass 123456