create-server

#!/bin/bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>

set -eu
set -o pipefail

umask 0077

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
# shellcheck disable=SC1090
source "${BIN_DIR}/functions"
# shellcheck disable=SC1090
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 -s SHORT_NAME -a ALT_NAME [-a ALT_NAME2]..."
    echo "Issues a server certificate for SHORT_NAME"
    echo
    echo "Options:"
    echo "    -s SHORT_NAME   Server hostname (commonName) for the new cert"
    echo "    -a ALT_NAME     One (or more) subjectAltNames for the new cert"
    echo
}

if [ ! -f ca/ca.crt ]; then
    echo -e "$ERR Must be run inside a CA directory!"
    exit 2
fi

SERVER_NAME=
ALT_NAME=

while getopts s:a:h FLAG; do
    case $FLAG in
        h) echo -e -n "$SUCC " && usage && exit 0
           ;;
        s) SERVER_NAME="${OPTARG}"
           ;;
        a) if [ -z "${ALT_NAME}" ]; then
               ALT_NAME="DNS:${OPTARG}"
           else
               ALT_NAME="${ALT_NAME}, DNS:${OPTARG}"
           fi
           ;;
        *) echo -e -n "$ERR " && usage && exit 2
           ;;
    esac
done

if [ $OPTIND -le $# ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [ "$SERVER_NAME" = "" ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [ "$ALT_NAME" = "" ]; then
    echo -e -n "$ERR " && usage && exit 2
fi

# Sanitize the commonName to make it suitable for use in filenames
SAFE_NAME=$(echo "$SERVER_NAME" | sed 's/\*/star/g' | sed 's/[^A-Za-z0-9-]/-/g')

echo -e "$NOTE Creating new SSL server certificate for:"
echo -e "$NOTE commonName       $SERVER_NAME"
echo -e "$NOTE subjectAltName   $ALT_NAME"

pushd "$BIN_DIR/.." > /dev/null

if [ -d "certs/server/$SAFE_NAME" ]; then
    echo -e "$ERR Configuration already exists for '$SERVER_NAME', exiting."
    exit 1
fi


echo
echo -e -n "$INPUT Enter passphase for signing CA key: "
read -r -s PASS
echo
export CA_PASS="${PASS}"
openssl rsa -check \
            -in ca/private/ca.key \
            -passin env:CA_PASS \
            -noout

trap 'rm -Rf "certs/server/$SAFE_NAME"' 0 2
mkdir "certs/server/$SAFE_NAME"

# Generate the server openssl config
export CA_HOSTNAME="${SERVER_NAME}"
export SAN="${ALT_NAME}"
ask_server_cert_questions
template "${BIN_DIR}/templates/server.tpl" "certs/server/$SAFE_NAME/$SAFE_NAME.conf"

echo -e "$NOTE Creating the server key and csr"

openssl req -new -nodes \
            -batch \
            -config "certs/server/$SAFE_NAME/$SAFE_NAME.conf" \
            -keyout "certs/server/$SAFE_NAME/$SAFE_NAME.key" \
            -out "certs/server/$SAFE_NAME/$SAFE_NAME.csr"
openssl rsa -noout -check -in "certs/server/$SAFE_NAME/$SAFE_NAME.key"
chmod 0400 "certs/server/$SAFE_NAME/$SAFE_NAME.key"

echo -e "$NOTE Creating the server certificate"

openssl ca -batch -notext \
           -config ca/ca.conf \
           -in "certs/server/$SAFE_NAME/$SAFE_NAME.csr" \
           -out "certs/server/$SAFE_NAME/$SAFE_NAME.crt" \
           -extensions server_ext \
           -passin env:CA_PASS

echo -e "$NOTE Verifying certificate/key pair"

key_mod=$(openssl rsa -noout -modulus -in "certs/server/$SAFE_NAME/$SAFE_NAME.key")
cert_mod=$(openssl x509 -noout -modulus -in "certs/server/$SAFE_NAME/$SAFE_NAME.crt")

if [ ! "$key_mod" = "$cert_mod" ];then
    echo -e "$ERR Certificate/Key pair invalid:"
    echo -e "$ERR     <>$cert_mod<>"
    echo -e "$ERR     <>$key_mod<>"
    echo
    exit 2
fi

echo -e "$NOTE Verifying trusted chain"

openssl verify -CAfile ca/chain.pem "certs/server/$SAFE_NAME/$SAFE_NAME.crt"

popd > /dev/null

unset CA_PASS

trap - 0 2

echo -e "$SUCC Server certificate for '${SERVER_NAME}' created."