generate-self-signed-certificate.sh

#!/bin/bash
set -eu;
# =============================================================================
# generate-self-signed-certificate.sh
#
# Issue single-purpose Self-Signed Certificate for intranet service
# Root CA key is discared during the signing process
# Output: ServiceRootCA Cert + Service Cert + Service Cert Key
# Drawback: Must install Service Root CA Certificate for every service
# Plus: Improved security as the Root CA Key is discarded :)
# Install ${orgO}-${base}-RootCA.crt to access the service over TLS
# =============================================================================

# See https://gist.github.com/shreeve/3358901a26a21d4ddee0e1342be7749d
# See https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309
# See https://github.com/cert-manager/cert-manager/issues/279
# See https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309?permalink_comment_id=3063255
# Docs: https://www.openssl.org/docs/

# 1. Configure variables:
myip="192.168.1.42"
base="hostname.lan"
orgO="SelfSignedCerts"
orgU="DEV"
country="CZ"
loc="Prague"
state="Czech Republic"
mail="cert@example.cz"
root=$(echo "${orgO}-${base}-RootCA" | tr ' ' '-')
days=36500 # 100 years

# Generate the RSA private key and save it to a variable
root_key=$(openssl genrsa 3072)
root_cn="${orgO} ${orgU} (${base}) Root"

# create root key and certificate
openssl req -x509 -nodes -sha256 -key <(echo "$root_key") -out "${root}.crt" -days ${days} \
  -subj "/CN=${root_cn}" \
  -addext "keyUsage = critical, keyCertSign" \
  -addext "basicConstraints = critical, CA:TRUE, pathlen:0" \
  -addext "authorityKeyIdentifier = keyid:always,issuer:always" \
  -addext "subjectKeyIdentifier = hash"

# create our key and certificate signing request
# SAN can include IP addresses in addition to domain names
openssl genrsa -out "${base}.key" 3072
openssl req -sha256 -new -nodes -key "${base}.key" -out "${base}.csr" \
  -subj "/CN=${base}/O=${orgO}/OU=${orgU}/emailAddress=${mail}/C=${country}/ST=${state}/L=${location}" \
  -reqexts SAN -config <(echo "[SAN]\nsubjectAltName=DNS:${base},DNS:localhost,IP:${myip},IP:127.0.0.1\n")

# create our final certificate and sign it
openssl x509 -req -sha256 -in "${base}.csr" -out "${base}.crt" -days ${days} \
  -CAkey <(echo "$root_key") -CA "${root}.crt" -CAcreateserial -extfile <(cat <<END
    subjectAltName = DNS:${base},DNS:localhost,IP:${myip},IP:127.0.0.1
    keyUsage = critical, digitalSignature, keyEncipherment
    basicConstraints = CA:FALSE
    extendedKeyUsage = serverAuth
    authorityKeyIdentifier = keyid:always
    subjectKeyIdentifier = none
END
)

# Review generated cert files
echo "################################"
echo "-------- ${root}.crt:"; openssl x509 -in "${root}.crt" -noout -text
echo "-------- ${base}.csr"; openssl req  -in "${base}.csr" -noout -text
echo "-------- ${base}.crt"; openssl x509 -in "${base}.crt" -noout -text
echo "-------- Done.";

# 1. Configure variables
# 2. chmod +x generate-self-signed-certificate.sh
# 3. mkdir self-rigned-cert && cd self-rigned-cert"
# ../generate-self-signed-certificate.sh