Skip to content

Commit 71b1053

Browse files
aledbfaledbf
committed
Check if fullchain_with_key.pem already exists
1 parent cb15aef commit 71b1053

File tree

1 file changed

+40
-39
lines changed

1 file changed

+40
-39
lines changed

‎create_ca_cert.sh

Lines changed: 40 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,17 @@ CN_CA=${CN_CA:0:64}
2222
CN_IA=${CN_IA:0:64}
2323
CN_WEB=${CN_WEB:0:64}
2424

25-
mkdir -p /certs /ca
25+
mkdir -p /ca /certs
2626
cd /ca
2727

2828
CA_KEY_FILE=${CA_KEY_FILE:-/ca/ca.key}
2929
CA_CRT_FILE=${CA_CRT_FILE:-/ca/ca.crt}
3030
CA_SRL_FILE=${CA_SRL_FILE:-/ca/ca.srl}
3131

32-
if [ -f "$CA_CRT_FILE" ] ; then
32+
if [ -f "$CA_CRT_FILE" ]; then
3333
logInfo "CA already exists. Good. We'll reuse it."
34-
if [ ! -f "$CA_SRL_FILE" ] ; then
35-
echo 01 > ${CA_SRL_FILE}
34+
if [ ! -f "$CA_SRL_FILE" ]; then
35+
echo 01 >${CA_SRL_FILE}
3636
fi
3737
else
3838
logInfo "No CA was found. Generating one."
@@ -42,7 +42,7 @@ else
4242

4343
logInfo "generate CA cert with key and self sign it: ${CAID}"
4444
openssl req -new -x509 -days 1300 -sha256 -key ${CA_KEY_FILE} -out ${CA_CRT_FILE} -passin pass:foobar -subj "/C=NL/ST=Noord Holland/L=Amsterdam/O=ME/OU=IT/CN=${CN_CA}" -extensions IA -config <(
45-
cat <<-EOF
45+
cat <<-EOF
4646
[req]
4747
distinguished_name = dn
4848
[dn]
@@ -51,23 +51,24 @@ basicConstraints = critical,CA:TRUE
5151
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
5252
subjectKeyIdentifier = hash
5353
EOF
54-
)
54+
)
5555

5656
[[ ${DEBUG} -gt 0 ]] && logInfo "show the CA cert details"
5757
[[ ${DEBUG} -gt 0 ]] && openssl x509 -noout -text -in ${CA_CRT_FILE}
5858

59-
echo 01 > ${CA_SRL_FILE}
59+
echo 01 >${CA_SRL_FILE}
6060

6161
fi
6262

6363
cd /certs
6464

65-
logInfo "Generate IA key"
66-
openssl genrsa -des3 -passout pass:foobar -out ia.key 4096 &> /dev/null
65+
if [ -f "fullchain_with_key.pem" ]; then
66+
logInfo "Generate IA key"
67+
openssl genrsa -des3 -passout pass:foobar -out ia.key 4096 &>/dev/null
6768

68-
logInfo "Create a signing request for the IA: ${CAID}"
69-
openssl req -new -key ia.key -out ia.csr -passin pass:foobar -subj "/C=NL/ST=Noord Holland/L=Amsterdam/O=ME/OU=IT/CN=${CN_IA}" -reqexts IA -config <(
70-
cat <<-EOF
69+
logInfo "Create a signing request for the IA: ${CAID}"
70+
openssl req -new -key ia.key -out ia.csr -passin pass:foobar -subj "/C=NL/ST=Noord Holland/L=Amsterdam/O=ME/OU=IT/CN=${CN_IA}" -reqexts IA -config <(
71+
cat <<-EOF
7172
[req]
7273
distinguished_name = dn
7374
[dn]
@@ -76,14 +77,14 @@ basicConstraints = critical,CA:TRUE,pathlen:0
7677
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
7778
subjectKeyIdentifier = hash
7879
EOF
79-
)
80+
)
8081

81-
[[ ${DEBUG} -gt 0 ]] && logInfo "Show the singing request, to make sure extensions are there"
82-
[[ ${DEBUG} -gt 0 ]] && openssl req -in ia.csr -noout -text
82+
[[ ${DEBUG} -gt 0 ]] && logInfo "Show the singing request, to make sure extensions are there"
83+
[[ ${DEBUG} -gt 0 ]] && openssl req -in ia.csr -noout -text
8384

84-
logInfo "Sign the IA request with the CA cert and key, producing the IA cert"
85-
openssl x509 -req -days 730 -in ia.csr -CA ${CA_CRT_FILE} -CAkey ${CA_KEY_FILE} -CAserial ${CA_SRL_FILE} -out ia.crt -passin pass:foobar -extensions IA -extfile <(
86-
cat <<-EOF
85+
logInfo "Sign the IA request with the CA cert and key, producing the IA cert"
86+
openssl x509 -req -days 730 -in ia.csr -CA ${CA_CRT_FILE} -CAkey ${CA_KEY_FILE} -CAserial ${CA_SRL_FILE} -out ia.crt -passin pass:foobar -extensions IA -extfile <(
87+
cat <<-EOF
8788
[req]
8889
distinguished_name = dn
8990
[dn]
@@ -92,33 +93,33 @@ basicConstraints = critical,CA:TRUE,pathlen:0
9293
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
9394
subjectKeyIdentifier = hash
9495
EOF
95-
) &> /dev/null
96+
) &>/dev/null
9697

98+
[[ ${DEBUG} -gt 0 ]] && logInfo "show the IA cert details"
99+
[[ ${DEBUG} -gt 0 ]] && openssl x509 -noout -text -in ia.crt
97100

98-
[[ ${DEBUG} -gt 0 ]] && logInfo "show the IA cert details"
99-
[[ ${DEBUG} -gt 0 ]] && openssl x509 -noout -text -in ia.crt
101+
logInfo "Initialize the serial number for signed certificates"
102+
echo 01 >ia.srl
100103

101-
logInfo "Initialize the serial number for signed certificates"
102-
echo 01 > ia.srl
104+
logInfo "Create the key (w/o passphrase..)"
105+
openssl genrsa -des3 -passout pass:foobar -out web.orig.key 2048 &>/dev/null
106+
openssl rsa -passin pass:foobar -in web.orig.key -out web.key &>/dev/null
103107

104-
logInfo "Create the key (w/o passphrase..)"
105-
openssl genrsa -des3 -passout pass:foobar -out web.orig.key 2048 &> /dev/null
106-
openssl rsa -passin pass:foobar -in web.orig.key -out web.key &> /dev/null
108+
logInfo "Create the signing request, using extensions"
109+
openssl req -new -key web.key -sha256 -out web.csr -passin pass:foobar -subj "/C=NL/ST=Noord Holland/L=Amsterdam/O=ME/OU=IT/CN=${CN_WEB}" -reqexts SAN -config <(cat <(printf "[req]\ndistinguished_name = dn\n[dn]\n[SAN]\nsubjectAltName=${ALLDOMAINS}"))
107110

108-
logInfo "Create the signing request, using extensions"
109-
openssl req -new -key web.key -sha256 -out web.csr -passin pass:foobar -subj "/C=NL/ST=Noord Holland/L=Amsterdam/O=ME/OU=IT/CN=${CN_WEB}" -reqexts SAN -config <(cat <(printf "[req]\ndistinguished_name = dn\n[dn]\n[SAN]\nsubjectAltName=${ALLDOMAINS}"))
111+
[[ ${DEBUG} -gt 0 ]] && logInfo "Show the singing request, to make sure extensions are there"
112+
[[ ${DEBUG} -gt 0 ]] && openssl req -in web.csr -noout -text
110113

111-
[[ ${DEBUG} -gt 0 ]] && logInfo "Show the singing request, to make sure extensions are there"
112-
[[ ${DEBUG} -gt 0 ]] && openssl req -in web.csr -noout -text
114+
logInfo "Sign the request, using the intermediate cert and key"
115+
openssl x509 -req -days 365 -in web.csr -CA ia.crt -CAkey ia.key -out web.crt -passin pass:foobar -extensions SAN -extfile <(cat <(printf "[req]\ndistinguished_name = dn\n[dn]\n[SAN]\nsubjectAltName=${ALLDOMAINS}")) &>/dev/null
113116

114-
logInfo "Sign the request, using the intermediate cert and key"
115-
openssl x509 -req -days 365 -in web.csr -CA ia.crt -CAkey ia.key -out web.crt -passin pass:foobar -extensions SAN -extfile <(cat <(printf "[req]\ndistinguished_name = dn\n[dn]\n[SAN]\nsubjectAltName=${ALLDOMAINS}")) &> /dev/null
117+
[[ ${DEBUG} -gt 0 ]] && logInfo "Show the final cert details"
118+
[[ ${DEBUG} -gt 0 ]] && openssl x509 -noout -text -in web.crt
116119

117-
[[ ${DEBUG} -gt 0 ]] && logInfo "Show the final cert details"
118-
[[ ${DEBUG} -gt 0 ]] && openssl x509 -noout -text -in web.crt
120+
logInfo "Concatenating fullchain.pem..."
121+
cat web.crt ia.crt ${CA_CRT_FILE} >fullchain.pem
119122

120-
logInfo "Concatenating fullchain.pem..."
121-
cat web.crt ia.crt ${CA_CRT_FILE} > fullchain.pem
122-
123-
logInfo "Concatenating fullchain_with_key.pem"
124-
cat fullchain.pem web.key > fullchain_with_key.pem
123+
logInfo "Concatenating fullchain_with_key.pem"
124+
cat fullchain.pem web.key >fullchain_with_key.pem
125+
fi

0 commit comments

Comments
 (0)