diff options
Diffstat (limited to 'conf/CA/bootstrap.sh')
| -rw-r--r-- | conf/CA/bootstrap.sh | 34 |
1 files changed, 29 insertions, 5 deletions
diff --git a/conf/CA/bootstrap.sh b/conf/CA/bootstrap.sh index 56181246..056fb3a4 100644 --- a/conf/CA/bootstrap.sh +++ b/conf/CA/bootstrap.sh @@ -9,11 +9,11 @@ chmod 755 certs newcerts touch index.txt echo "unique_subject = no" > index.txt.attr if [ ! -e ./serial ]; then - echo '01' > ./serial + echo $(date +%s) > ./serial fi NAME=aaf.bootstrap -FQDN=$(hostname -f) +FQDN="${HOSTNAME:=$(hostname -f)}" FQI=aaf@aaf.osaaf.org SUBJECT="/CN=$FQDN/OU=$FQI`cat subject.aaf`" SIGNER_P12=$1 @@ -29,6 +29,7 @@ BOOTSTRAP_CSR=/tmp/$NAME.csr BOOTSTRAP_CRT=/tmp/$NAME.crt BOOTSTRAP_CHAIN=/tmp/$NAME.chain BOOTSTRAP_P12=$NAME.p12 +BOOTSTRAP_ISSUER=$NAME.issuer # If Signer doesn't exist, create Self-Signed CA @@ -63,8 +64,19 @@ fi # SANS cp san.conf $BOOTSTRAP_SAN +SANS=$FQDN +if [ "$FQDN" -ne "$HOSTNAME" ]; then + SANS="$SANS $HOSTNAME" +fi + +for ROOT in $(cat san_root.aaf); do + SANS="$SANS $ROOT" + for C in service locate oauth gui cm hello; do + SANS="$SANS $C.$ROOT" + done +done NUM=1 -for D in $FQDN aaf.osaaf.org service.aaf.osaaf.org locate.aaf.osaaf.org oauth.aaf.osaaf.org gui.aaf.osaaf.org cm.aaf.osaaf.org hello.aaf.osaaf.org; do +for D in $SANS; do echo "DNS.$NUM = $D" >> $BOOTSTRAP_SAN NUM=$((NUM+1)) done @@ -80,7 +92,7 @@ echo Sign it openssl ca -batch -config openssl.conf -extensions server_cert \ -cert $SIGNER_CRT -keyfile $SIGNER_KEY \ -policy policy_loose \ - -days 90 \ + -days 365 \ -passin stdin \ -out $BOOTSTRAP_CRT \ -extfile $BOOTSTRAP_SAN \ @@ -93,13 +105,25 @@ EOF cat $BOOTSTRAP_CRT cp $BOOTSTRAP_CRT $BOOTSTRAP_CHAIN cat $SIGNER_CRT >> $BOOTSTRAP_CHAIN +cat $BOOTSTRAP_CHAIN # Note: Openssl will pickup and load all Certs in the Chain file +#openssl pkcs12 -name $FQI -export -in $BOOTSTRAP_CRT -inkey $BOOTSTRAP_KEY -CAfile $SIGNER_CRT -out $BOOTSTRAP_P12 -passin stdin -passout stdin << EOF openssl pkcs12 -name $FQI -export -in $BOOTSTRAP_CHAIN -inkey $BOOTSTRAP_KEY -out $BOOTSTRAP_P12 -passin stdin -passout stdin << EOF $PASSPHRASE $PASSPHRASE $PASSPHRASE EOF +# Make Issuer name +ISSUER=$(openssl x509 -subject -noout -in $SIGNER_CRT | cut -c 10-) +for I in ${ISSUER//\// }; do + if [ -n "$CADI_X509_ISSUER" ]; then + CADI_X509_ISSUER=", $CADI_X509_ISSUER" + fi + CADI_X509_ISSUER="$I$CADI_X509_ISSUER" +done +echo $CADI_X509_ISSUER > $BOOTSTRAP_ISSUER + # Cleanup -rm -f $BOOTSTRAP_SAN $BOOTSTRAP_KEY $BOOTSTRAP_CSR $BOOTSTRAP_CRT $BOOTSTRAP_CHAIN $SIGNER_KEY $SIGNER_CRT +rm -f $BOOTSTRAP_SAN $BOOTSTRAP_KEY $BOOTSTRAP_CSR $BOOTSTRAP_CRT $SIGNER_KEY $SIGNER_CRT $BOOTSTRAP_CHAIN |