bao3/cert-client.sh

## cert-client.sh
#! /bin/sh
#! /usr/bin/expect -f


certtool --generate-privkey --outfile $1-key.pem
sed -i "1ccn = "${1}"" client.tmpl
sed -i "3cemail = ${1}@abc.org" client.tmpl
certtool --generate-certificate --load-privkey $1-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template client.tmpl --outfile $1-cert.pem
openssl pkcs12 -export -inkey $1-key.pem -in $1-cert.pem -name "$1 VPN Client Cert" -certfile ca-cert.pem -out $1.cert.p12


exit 0

## 签发证书配置文件_ca.tmpl
cn = "abc.org VPN CA"
state = "Shanghai"
country = CN
organization = "Tyrael Ltd."
serial = 1
expiration_days = 3650
email = "ca@abc.org"
dns_name = "anyconnect.abc.org"
ca
signing_key
encryption_key
ipsec_ike_key
cert_signing_key
crl_signing_key

## 签发证书配置文件_server.tmpl
cn = "anyconnect.abc.org"
o = "Tyrael Ltd."
email = server@abc.org

dns_name = "anyconnect.abc.org"
country = CN
state = "Shanghai"

serial = 2
expiration_days = 3650

signing_key
encryption_key #only if the generated key is an RSA one
tls_www_server
ipsec_ike_key
time_stamping_key

## 证书签发配置_client.tmpl
cn = test
o = "Tyrael Ltd."
email = test@abc.org
dns_name = "anyconnect.abc.org"
country = CN
state = "Shanghai"
serial = 3
expiration_days = 3650
signing_key
encryption_key #only if the generated key is an RSA one
tls_www_client
ipsec_ike_key
time_stamping_key
	#! /bin/sh
	#! /usr/bin/expect -f


	certtool --generate-privkey --outfile $1-key.pem
	sed -i "1ccn = "${1}"" client.tmpl
	sed -i "3cemail = ${1}@abc.org" client.tmpl
	certtool --generate-certificate --load-privkey $1-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template client.tmpl --outfile $1-cert.pem
	openssl pkcs12 -export -inkey $1-key.pem -in $1-cert.pem -name "$1 VPN Client Cert" -certfile ca-cert.pem -out $1.cert.p12



	exit 0
	cn = "abc.org VPN CA"
	state = "Shanghai"
	country = CN
	organization = "Tyrael Ltd."
	serial = 1
	expiration_days = 3650
	email = "ca@abc.org"
	dns_name = "anyconnect.abc.org"
	ca
	signing_key
	encryption_key
	ipsec_ike_key
	cert_signing_key
	crl_signing_key
	cn = "anyconnect.abc.org"
	o = "Tyrael Ltd."
	email = server@abc.org

	dns_name = "anyconnect.abc.org"
	country = CN
	state = "Shanghai"

	serial = 2
	expiration_days = 3650

	signing_key
	encryption_key #only if the generated key is an RSA one
	tls_www_server
	ipsec_ike_key
	time_stamping_key
	cn = test
	o = "Tyrael Ltd."
	email = test@abc.org
	dns_name = "anyconnect.abc.org"
	country = CN
	state = "Shanghai"
	serial = 3
	expiration_days = 3650
	signing_key
	encryption_key #only if the generated key is an RSA one
	tls_www_client
	ipsec_ike_key
	time_stamping_key