-
Notifications
You must be signed in to change notification settings - Fork 1
/
iDevIDcert.sh
executable file
·175 lines (112 loc) · 3.39 KB
/
iDevIDcert.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
#!/bin/bash
export flg=0
export flgcrt=0
export flgprvt=0
export flgchain=0
export flgcn=0
export cnfg=""
export cacert=""
export caprvt=""
export cachain=""
export cn=""
export flgout=0
export out=""
export flagsn=0
for arg in "$@"
do
if [ "$flg" == 1 ]; then
cnfg=$arg
flg=0
fi
if [ "$flgcrt" == 1 ]; then
cacert=$arg
flgcrt=0
fi
if [ "$flgprvt" == 1 ]; then
caprvt=$arg
flgprvt=0
fi
if [ "$flgchain" == 1 ]; then
cachain=$arg
flgchain=0
fi
if [ "$flgcn" == 1 ]; then
cn=$arg
flgcn=0
fi
if [ "$flgout" == 1 ]; then
out=$arg
flgout=0
fi
if [ "$flgsn" == 1 ]; then
serialNumber=$arg
flagsn=0
fi
if [ "$arg" == "--config" ] || [ "$arg" == "-config" ]; then
flg=1
fi
if [ "$arg" == "--cacert" ] || [ "$arg" == "-cacert" ]; then
flgcrt=1
fi
if [ "$arg" == "--caprivate" ] || [ "$arg" == "-caprivate" ]; then
flgprvt=1
fi
if [ "$arg" == "--cachain" ] || [ "$arg" == "-cachain" ]; then
flgchain=1
fi
if [ "$arg" == "--cn" ] || [ "$arg" == "-cn" ]; then
flgcn=1
fi
if [ "$arg" == "--out" ] || [ "$arg" == "-out" ]; then
flgout=1
fi
if [ "$arg" == "--sn" ] || [ "$arg" == "-sn" ]; then
flgsn=1
fi
done
export rt=$out
export intrdir=${cadir-$rt/Intermediate}
export cfgdir=config
export cadir=${cadir-$rt/ca}
export devIDdir=${devIDdir-$rt/iDevID}
mkdir -p $devIDdir
export dir=$cadir
export format=pem
mkdir -p $devIDdir/certs
mkdir -p $devIDdir/newcerts
mkdir -p $devIDdir/private
mkdir -p $devIDdir/csr
source $cnfg
export commonName="/CN="$cn
DevID=$cn
serialNumber="/serialNumber=$serialNumber"
DN=$countryName$stateOrProvinceName$localityName
DN=$DN$organizationName$organizationalUnitName$commonName
DN=$DN$serialNumber
if [ ! -f $devIDdir/private/$DevID.key.$format ]; then
openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:prime256v1\
-pkeyopt ec_param_enc:named_curve\
-out $devIDdir/private/$DevID.key.$format
chmod 400 $devIDdir/private/$DevID.key.$format
fi
openssl pkey -in $devIDdir/private/$DevID.key.$format -text -noout
openssl req -config $cfgdir/openssl-8021ARintermediate.cnf\
-key $devIDdir/private/$DevID.key.$format \
-subj "$DN" -new -sha256 -out $devIDdir/csr/$DevID.csr.$format
openssl req -text -noout -verify\
-in $devIDdir/csr/$DevID.csr.$format
openssl rand -hex $sn > $devIDdir/serial # hex 8 is minimum, 19 is maximum
# Note 'openssl ca' does not support DER format
openssl ca -config $cfgdir/openssl-8021ARintermediate.cnf -days $default_crl_days\
-extensions mud_signers -extfile $cfgdir/openssl-mudsigners.cnf \
-notext -md sha256 \
-in $devIDdir/csr/$DevID.csr.$format\
-out $devIDdir/certs/$DevID.cert.$format
chmod 444 $devIDdir/certs/$DevID.cert.$format
if [ "$cachain" != "" ] ; then
openssl verify -CAfile $cachain $devIDdir/certs/$DevID.cert.$format
fi
if [ "$cachain" == "" ] ; then
openssl verify -CAfile $cacert $devIDdir/certs/$DevID.cert.$format
fi
openssl x509 -noout -text -in $devIDdir/certs/$DevID.cert.$format