gen.sh

gen.sh

#!/bin/sh

VHOST="$1"
TYPE="ecdsa"
DIGEST="sha512"

for san in $@; do
	SAN+="--san $san "
done

echo $SAN

/usr/sbin/ipsec pki --gen --type "${TYPE}" --size 521 > "${VHOST}.key.der"
/usr/sbin/ipsec pki --pub --type "${TYPE}" --in "${VHOST}.key.der" | /usr/sbin/ipsec pki --issue \
								--cacert ca.crt.der \
								--cakey ca.key.der \
								${SAN} \
								--digest "${DIGEST}" > "${VHOST}.crt.der"

openssl ec -inform der -in "${VHOST}.key.der" -out "${VHOST}.key"
openssl x509 -inform der -in "${VHOST}.crt.der" -out "${VHOST}.crt"
openssl pkcs12 -export -out "${VHOST}.p12" -inkey "${VHOST}.key" -in "${VHOST}.crt" -certfile ca.crt