Self-Signed X.509 Certificates (Server/Client/Mail) with OpenSSL - Linux

self-signed-cert-generator.sh

#!/bin/bash
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Original Source:
# https://gist.github.com/ggrandes/8519566
#
# Generate Self-Signed certificates (not for production)
# Default Password por PKCS12 file is "changeit"
# Default Expire 5 years
EXPIRE_DAYS=${EXPIRE_DAYS:-$[365 * 5 + 1]}
usage () {
  echo "$0 <client|server> <CN> <outputname>"
  echo "usage:"
  echo "$0 client coyote coyote"
  echo "$0 server '*.acme.com' acme"
  exit 0;
}
case "$1" in
  client);;
  server);;
  *) usage;;
esac
if [ "$3" = "" ]; then
  usage;
fi
TYPE="$1"
CN="$2"
NAME="${TYPE}-$3"
cat >/tmp/.tmp.openssl.cnf <<END
RANDFILE = \$ENV::HOME/.rnd

[ req ]
x509_extensions = v3_ca # The extentions to add to the self signed cert
string_mask = nombstr
distinguished_name = req_distinguished_name
prompt = no
encrypt_key = no
default_md = sha256

[ req_distinguished_name ]
#C = ES
#O = ACME
CN = ${CN}
#emailAddress = Email Address

[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
#subjectAltName=email:coyote@acme.com,DNS:*.acme.com
basicConstraints = critical, CA:TRUE, pathlen:0
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyCertSign
extendedKeyUsage = ${TYPE}Auth, emailProtection
nsCertType = ${TYPE}, email, sslCA, emailCA
nsComment="Self-signed certificate"

[ crl_ext ]
authorityKeyIdentifier=keyid:always,issuer:always

[ engine ]
default = openssl

END
#
(
export OPENSSL_CONF="/tmp/.tmp.openssl.cnf"
openssl genrsa 2048 > ${NAME}.key
chmod 600 ${NAME}.key
echo;echo Generating x509;echo
serial="-set_serial $(date +%s)"
case "$(openssl version)" in *0.9.6*) serial="";; esac
openssl req -new -x509 $serial -days $EXPIRE_DAYS -key ${NAME}.key > ${NAME}.crt
(cat ${NAME}.key; echo; cat ${NAME}.crt; echo;) > ${NAME}.pem
chmod 600 ${NAME}.pem
echo;echo Generating PKCS12;echo; sync
openssl pkcs12 -export -in ${NAME}.pem -inkey ${NAME}.key -out ${NAME}.p12 -name "private" -descert -passout pass:changeit
ls -al ${NAME}.*
)
#
#ln -s ${NAME}.pem `openssl x509 -noout -hash < ${NAME}.pem`.0
#