initial commit

.ssl/gen-cert.sh

@@ -0,0 +1,116 @@
+#!/bin/sh
+set -eu
+
+CA_DIR="${CA_DIR:-$(dirname $0)/ca}"
+CERTS_DIR="${CERTS_DIR:-$(dirname $0)/certs}"
+
+CA_KEY="${CA_DIR}/ca.key"
+CA_CERT="${CA_DIR}/ca.pem"
+
+NAME="${1:-}"
+DAYS="${DAYS:-825}"
+KEY_BITS="${KEY_BITS:-2048}"
+
+if [ -z "${NAME}" ]; then
+  echo "Usage:"
+  echo "  $0 <name> [san1 san2 ...]"
+  echo
+  echo "Examples:"
+  echo "  $0 api.local api.local localhost 127.0.0.1"
+  echo "  $0 client-1"
+  exit 1
+fi
+
+if [ ! -f "${CA_KEY}" ] || [ ! -f "${CA_CERT}" ]; then
+  echo "CA files not found. Run gen-ca.sh first."
+  exit 1
+fi
+
+shift || true
+
+if [ -e "${CERTS_DIR}/${NAME}" ]; then
+  echo "Certificate for ${NAME} already exists."
+  echo "Nothing to do."
+  exit 0
+fi
+
+mkdir -p "${CERTS_DIR}/${NAME}"
+
+KEY="${CERTS_DIR}/${NAME}/${NAME}.key.pem"
+CSR="${CERTS_DIR}/${NAME}/${NAME}.csr.pem"
+CERT="${CERTS_DIR}/${NAME}/${NAME}.cert.pem"
+EXT="${CERTS_DIR}/${NAME}/${NAME}.ext.cnf"
+FULLCHAIN="${CERTS_DIR}/${NAME}/${NAME}.fullchain.pem"
+
+SUBJECT="${SUBJECT:-/C=US/O=Localhost LLC/CN=${NAME}}"
+
+cat > "${EXT}" <<EOF
+[req]
+distinguished_name = req_distinguished_name
+req_extensions = v3_req
+prompt = no
+
+[req_distinguished_name]
+CN = ${NAME}
+
+[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+
+[alt_names]
+EOF
+
+i=1
+if [ "$#" -gt 0 ]; then
+  for san in "$@"; do
+    case "${san}" in
+      *[!0-9.]* | .* | *.) 
+        echo "DNS.${i} = ${san}" >> "${EXT}"
+        ;;
+      *.*.*.*)
+        echo "IP.${i} = ${san}" >> "${EXT}"
+        ;;
+      *)
+        echo "DNS.${i} = ${san}" >> "${EXT}"
+        ;;
+    esac
+    i=$((i + 1))
+  done
+else
+  echo "DNS.1 = ${NAME}" >> "${EXT}"
+fi
+
+openssl genrsa -out "${KEY}" "${KEY_BITS}"
+chmod 600 "${KEY}"
+
+openssl req \
+  -new \
+  -key "${KEY}" \
+  -subj "${SUBJECT}" \
+  -out "${CSR}"
+
+openssl x509 \
+  -req \
+  -in "${CSR}" \
+  -CA "${CA_CERT}" \
+  -CAkey "${CA_KEY}" \
+  -CAcreateserial \
+  -out "${CERT}" \
+  -days "${DAYS}" \
+  -sha256 \
+  -extfile "${EXT}" \
+  -extensions v3_req
+
+cat "${CERT}" "${CA_CERT}" > "${FULLCHAIN}"
+
+chmod 644 "${CSR}" "${CERT}" "${EXT}" "${FULLCHAIN}"
+
+echo "Certificate issued:"
+echo "  key:       ${KEY}"
+echo "  csr:       ${CSR}"
+echo "  cert:      ${CERT}"
+echo "  fullchain: ${FULLCHAIN}"
+
+openssl x509 -in "${CERT}" -noout -subject -issuer -dates -ext subjectAltName