1#!/bin/bash
2
3# (c) CopyRight EdelWeb for EdelKey and OpenEvidence, 2000-2004, 2009
4# Author: Peter Sylvester
5
6# "libre" for integration with curl
7
8OPENSSL=openssl
9if [ -f /usr/local/ssl/bin/openssl ] ; then
10   OPENSSL=/usr/local/ssl/bin/openssl
11fi
12
13USAGE="echo Usage is genserv.sh <prefix> <caprefix>"
14
15HOME=`pwd`
16cd $HOME
17
18KEYSIZE=1024
19DURATION=3000
20
21REQ=YES
22P12=NO
23DHP=NO
24
25PREFIX=$1
26if [ ".$PREFIX" = . ] ; then
27	echo No configuration prefix
28	NOTOK=1
29else
30    if [ ! -f $PREFIX-sv.prm ] ; then
31	echo No configuration file $PREFIX-sv.prm
32	NOTOK=1
33    fi
34fi
35
36CAPREFIX=$2
37if [ ".$CAPREFIX" = . ] ; then
38	echo No CA prefix
39	NOTOK=1
40else
41    if [ ! -f $CAPREFIX-ca.cacert ] ; then
42	echo No CA certficate file $CAPREFIX-ca.caert
43	NOTOK=1
44    fi
45    if [ ! -f $CAPREFIX-ca.key ] ; then
46	echo No $CAPREFIX key
47        NOTOK=1
48    fi
49fi
50
51if [ ".$NOTOK" != . ] ; then
52    echo "Sorry, I can't do that for you."
53    $USAGE
54    exit
55fi
56
57if [ ".$SERIAL" = . ] ; then
58	GETSERIAL="\$t = time ;\$d =  \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
59	SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
60fi
61
62echo SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
63
64if [ "$DHP." = YES. ] ; then
65   echo "openssl dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE"
66   $OPENSSL dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE
67fi
68
69if [ "$REQ." = YES. ] ; then
70   echo "openssl req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout XXX"
71   $OPENSSL req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout pass:secret
72fi
73
74echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key"
75$OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret
76echo pseudo secrets generated
77
78echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der"
79$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der
80
81echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem"
82$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem
83
84echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION  -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt "
85
86$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION  -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt
87
88if [ "$P12." = YES. ] ; then
89
90   echo "$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt "
91
92   $OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt
93fi
94
95echo "openssl x509 -noout -text -hash -in $PREFIX-sv.selfcert -nameopt multiline"
96$OPENSSL x509 -noout -text -hash -in $PREFIX-sv.crt -nameopt multiline
97
98# revoke server cert
99touch $CAPREFIX-ca.db
100echo 01 > $CAPREFIX-ca.cnt
101echo "openssl ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt"
102$OPENSSL ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt
103
104# issue CRL
105echo "openssl ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl"
106$OPENSSL ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl
107
108echo "openssl x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der "
109$OPENSSL x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der
110
111# all together now
112touch $PREFIX-sv.dhp
113cat $PREFIX-sv.prm $PREFIX-sv.key  $PREFIX-sv.crt $PREFIX-sv.dhp >$PREFIX-sv.pem
114chmod o-r $PREFIX-sv.prm
115
116echo "$PREFIX-sv.pem done"
117
118
119