Script to generate PaCRD certificate, key, and password files for mTLS

create-pacrd-mtls-cert.sh

#!/bin/bash

# This function creates a new password
newPassword() {
  echo $(openssl rand -base64 32)
}

# Add metadata for host spin-svc.namespace
print_san() {
  local svc
  svc="${1?}"
  printf '%s\n' "subjectAltName=DNS:localhost,DNS:pacrd-controller-manager-metrics-service.${LOCATION}"
}

# Service name
svc=pacrd
# New password
password=$(newPassword)
# Where certs are located and will be added - ca.pem and ca.key should be there
OUT_CERTS_DIR=.
# Namespace to form spin-svc.namespace
LOCATION=mtls
# CA password
CA_PASSWORD=password
# Create key and certificate
openssl genrsa -aes256 -passout "pass:${password}" -out "$OUT_CERTS_DIR/${svc}.key" 2048
openssl req -new -key "$OUT_CERTS_DIR/${svc}.key" -out "$OUT_CERTS_DIR/${svc}.csr" -subj /C=US/CN=spin-${svc}.${LOCATION} -passin "pass:${password}"
openssl x509 -req -in "$OUT_CERTS_DIR/${svc}.csr" -CA "$OUT_CERTS_DIR/ca.pem" -CAkey "$OUT_CERTS_DIR/ca.key" -CAcreateserial -out "$OUT_CERTS_DIR/${svc}.crt" -days 3650 -sha256 -passin "pass:${CA_PASSWORD}" -extfile <(print_san "$svc")
# Save password
echo ${password} > pacrd.pass.txt