#!/bin/bash
export SCRIPT_PATH=$( cd "$(dirname "${BASH_SOURCE}")" ; pwd -P )
# debug
#rm -rf $SCRIPT_PATH/$DEFAULT_DOMAIN/* > /dev/null 2>&1
#find $SCRIPT_PATH/$DEFAULT_DOMAIN/ -name "*.crt" -type f|xargs rm -f
##
# Create a simple CA-chain with openssl.
#
# Source: http://pki-tutorial.readthedocs.org/en/latest/advanced/index.html
#
# We create the Root CA based on reverse host. The Root CA signs the TLS CA for the reverse host and intermediate CAs for each domain.
# The intermediate CAs are signing the Email CA, TLS CA, the Software (Code Signing) CA for the domain; it signs also the Intermediate CA for each subdomain.
#
# ---
# #!/bin bash
# root_ca 'reverse.com' 'domain1.com;domain2.com' 'sub1;sub2'
# root_ca 'reverse.com' 'domain1.com' 'sub3'
# root_ca 'reverse.com' 'domain2.com' 'sub4'
# root_ca 'reverse.com' 'domain3.com'
# ---
# result
# - ./reverse.com
# - reverse.com.ca.crt (root CA)
# - reverse.com.ca-tls.crt
# - ./intermediate
# - ./domain1.com
# - domain1.com.ca.crt (sub root CA)
# - domain1.com.ca-tls.crt
# - domain1.com.ca-email.crt
# - domain1.com.ca-software.crt
# - ./intermediate
# - ./sub1.domain1.com
# - sub1.domain1.com.ca.crt (sub sub root CA)
# - sub1.domain1.com.ca-tls.crt
# - sub1.domain1.com.ca-email.crt
# - sub1.domain1.com.ca-software.crt
# - ./sub2.domain1.com
# - sub2.domain1.com.ca.crt (sub sub root CA)
# - sub2.domain1.com.ca-tls.crt
# - sub2.domain1.com.ca-email.crt
# - sub2.domain1.com.ca-software.crt
# - ./sub3.domain1.com
# - sub3.domain1.com.ca.crt (sub sub root CA)
# - sub3.domain1.com.ca-tls.crt
# - sub3.domain1.com.ca-email.crt
# - sub3.domain1.com.ca-software.crt
# - ./domain2.com
# - domain2.com.ca.crt (sub root CA)
# - domain2.com.ca-tls.crt
# - domain2.com.ca-email.crt
# - domain2.com.ca-software.crt
# - ./intermediate
# - ./sub1.domain1.com
# - sub1.domain2.com.ca.crt (sub sub root CA)
# - sub1.domain2.com.ca-tls.crt
# - sub1.domain2.com.ca-email.crt
# - sub1.domain2.com.ca-software.crt
# - ./sub2.domain1.com
# - sub2.domain2.com.ca.crt (sub sub root CA)
# - sub2.domain2.com.ca-tls.crt
# - sub2.domain2.com.ca-email.crt
# - sub2.domain2.com.ca-software.crt
# - ./sub4.domain1.com
# - sub4.domain2.com.ca.crt (sub sub root CA)
# - sub4.domain2.com.ca-tls.crt
# - sub4.domain2.com.ca-email.crt
# - sub4.domain2.com.ca-software.crt
# - ./domain3.com
# - domain3.com.ca.crt (sub root CA)
# - domain3.com.ca-tls.crt
# - domain3.com.ca-email.crt
# - domain3.com.ca-software.crt
#
#
# ---
# add mini lookup
root_ca()
{
#local DEFAULT_CA_RSA_KEYSIZE_PASSWORD=8192
#local DEFAULT_CA_RSA_KEYSIZE_PRIVATE_KEY=8192
#local DEFAULT_CA_RSA_KEYSIZE_REQUEST=4096
local DEFAULT_CA_RSA_KEYSIZE_PASSWORD=2048
local DEFAULT_CA_RSA_KEYSIZE_PRIVATE_KEY=2048
local DEFAULT_CA_RSA_KEYSIZE_REQUEST=2048
local DEFAULT_CA_PWD_GEN_PUBEXP=7
local DEFAULT_CA_MD=sha512
local DEFAULT_CA_MD_REQUEST=sha512
##############################################################
#
# constants
#
##############################################################
declare -A DIR_NAME
DIR_NAME[cnf]='etc'
DIR_NAME[db]='db'
DIR_NAME[private]='private'
DIR_NAME[public]='public'
DIR_NAME[intermediateDir]='intermediate'
DIR_NAME[lookup]='lookup'
DIR_NAME[caRoot]='ca'
DIR_NAME[caEmail]='ca-email'
DIR_NAME[caSoftware]='ca-software'
DIR_NAME[caTls]='ca-tls'
DIR_NAME[crtEmail]='crt-email'
DIR_NAME[crtSoftware]='crt-software'
DIR_NAME[crtTls]='crt-tls'
DIR_NAME[email]='email'
DIR_NAME[software]='software'
DIR_NAME[tls]='tls'
declare -A FILE_NAME
FILE_NAME[cnf]='%s.%s.cnf'
FILE_NAME[csr]='%s.%s.csr'
FILE_NAME[crt]='%s.%s.crt'
FILE_NAME[chainPem]='%s.%s.chain.pem'
FILE_NAME[crtDb]='%s.%s.crt.db'
FILE_NAME[crtSrl]='%s.%s.crt.srl'
FILE_NAME[crl]='%s.%s.crl'
FILE_NAME[crlPem]='%s.%s.crl.pem'
FILE_NAME[crlSrl]='%s.%s.crl.srl'
FILE_NAME[key]='%s.%s.key'
FILE_NAME[password]='%s.%s.pwd'
declare -A DIRECTORIES_CA_ROOT
DIRECTORIES_CA_ROOT[caPath]="${DIR_NAME[caRoot]}"
DIRECTORIES_CA_ROOT[dbPath]="${DIR_NAME[caRoot]}/${DIR_NAME[db]}"
DIRECTORIES_CA_ROOT[cnfPath]="${DIR_NAME[caRoot]}/${DIR_NAME[cnf]}"
DIRECTORIES_CA_ROOT[privatePath]="${DIR_NAME[caRoot]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CA_EMAIL
DIRECTORIES_CA_EMAIL[caPath]="${DIR_NAME[caEmail]}"
DIRECTORIES_CA_EMAIL[dbPath]="${DIR_NAME[caEmail]}/${DIR_NAME[db]}"
DIRECTORIES_CA_EMAIL[cnfPath]="${DIR_NAME[caEmail]}/${DIR_NAME[cnf]}"
DIRECTORIES_CA_EMAIL[privatePath]="${DIR_NAME[caEmail]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CRT_EMAIL
DIRECTORIES_CRT_EMAIL[crtPath]="${DIR_NAME[crtEmail]}"
DIRECTORIES_CRT_EMAIL[cnfPath]="${DIR_NAME[crtEmail]}/${DIR_NAME[cnf]}"
DIRECTORIES_CRT_EMAIL[privatePath]="${DIR_NAME[crtEmail]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CA_SOFTWARE
DIRECTORIES_CA_SOFTWARE[caPath]="${DIR_NAME[caSoftware]}"
DIRECTORIES_CA_SOFTWARE[dbPath]="${DIR_NAME[caSoftware]}/${DIR_NAME[db]}"
DIRECTORIES_CA_SOFTWARE[cnfPath]="${DIR_NAME[caSoftware]}/${DIR_NAME[cnf]}"
DIRECTORIES_CA_SOFTWARE[privatePath]="${DIR_NAME[caSoftware]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CRT_SOFTWARE
DIRECTORIES_CRT_SOFTWARE[crtPath]="${DIR_NAME[crtSoftware]}"
DIRECTORIES_CRT_SOFTWARE[cnfPath]="${DIR_NAME[crtSoftware]}/${DIR_NAME[cnf]}"
DIRECTORIES_CRT_SOFTWARE[privatePath]="${DIR_NAME[crtSoftware]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CA_TLS
DIRECTORIES_CA_TLS[caPath]="${DIR_NAME[caTls]}"
DIRECTORIES_CA_TLS[dbPath]="${DIR_NAME[caTls]}/${DIR_NAME[db]}"
DIRECTORIES_CA_TLS[cnfPath]="${DIR_NAME[caTls]}/${DIR_NAME[cnf]}"
DIRECTORIES_CA_TLS[privatePath]="${DIR_NAME[caTls]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CRT_TLS
DIRECTORIES_CRT_TLS[crtPath]="${DIR_NAME[crtTls]}"
DIRECTORIES_CRT_TLS[cnfPath]="${DIR_NAME[crtTls]}/${DIR_NAME[cnf]}"
DIRECTORIES_CRT_TLS[privatePath]="${DIR_NAME[crtTls]}/${DIR_NAME[private]}"
declare -A DIRECTORIES_CRT
DIRECTORIES_CRT[email]="${DIR_NAME[public]}/${DIR_NAME[email]}"
DIRECTORIES_CRT[software]="${DIR_NAME[public]}/${DIR_NAME[software]}"
DIRECTORIES_CRT[tls]="${DIR_NAME[public]}/${DIR_NAME[tls]}"
##############################################################
#
# CRT config partial factories
#
##############################################################
makeModulCsrConfigBlock_title()
{
local outputFile=$1
local domain=$2
local title=$3
{
echo "# $title certificate request for $domain"
echo ''
} >> $outputFile
}
makeModulCsrConfigBlock_csr_dn()
{
local outputFile=$1
local domain=$2
local defaultDn=$3
local defaultDn=$3
{
echo "[ $defaultDn ]"
echo 'countryName = "1. Country Name (2 letters) (eg, US) "'
echo 'countryName_max = 2'
echo 'countryName_default = "BE"'
echo 'stateOrProvinceName = "2. State or Province Name (eg, region) "'
echo 'localityName = "3. Locality Name (eg, city) "'
echo 'organizationName = "4. Organization Name (eg, company) "'
echo "organizationName_default = \""### Network $domain\"""
echo 'organizationalUnitName = "5. Organizational Unit Name (eg, section) "'
echo 'commonName = "6. Common Name (eg, full name)"'
echo 'commonName_max = 64'
echo "commonName_default = \""### Network $domain\"""
echo 'emailAddress = "7. Email Address (eg, name@fqdn)"'
echo 'emailAddress_max = 40'
echo ''
} >> $outputFile
}
##############################################################
#
# CRT config factories
#
##############################################################
modulCsrEmailConfig()
{
local outputFile=$1
local domain=$2
{
makeModulCsrConfigBlock_title $outputFile $domain 'Email'
echo '[ req ]'
echo 'default_bits = 2048 # RSA key size'
echo 'encrypt_key = yes # Protect private key'
echo 'default_md = sha1 # MD to use'
echo 'utf8 = yes # Input is UTF-8'
echo 'string_mask = utf8only # Emit UTF-8 strings'
echo 'prompt = yes # Prompt for DN'
echo 'distinguished_name = email_dn # DN template'
echo 'req_extensions = email_reqext # Desired extensions'
echo ''
makeModulCsrConfigBlock_csr_dn $outputFile $domain 'email_dn'
echo '[ email_reqext ]'
echo 'keyUsage = critical,digitalSignature,keyEncipherment'
echo 'extendedKeyUsage = emailProtection,clientAuth'
echo 'subjectKeyIdentifier = hash'
echo 'subjectAltName = email:move'
} >> $outputFile
}
modulCsrTlsClientConfig()
{
local outputFile=$1
local domain=$2
{
makeModulCsrConfigBlock_title $outputFile $domain 'TLS Client'
echo '[ req ]'
echo 'default_bits = 2048 # RSA key size'
echo 'encrypt_key = yes # Protect private key'
echo 'default_md = sha1 # MD to use'
echo 'utf8 = yes # Input is UTF-8'
echo 'string_mask = utf8only # Emit UTF-8 strings'
echo 'prompt = yes # Prompt for DN'
echo 'distinguished_name = client_dn # DN template'
echo 'req_extensions = client_reqext # Desired extensions'
echo ''
makeModulCsrConfigBlock_csr_dn $outputFile $domain 'client_dn'
echo ''
echo '[ client_reqext ]'
echo 'keyUsage = critical,digitalSignature'
echo 'extendedKeyUsage = clientAuth'
echo 'subjectKeyIdentifier = hash'
echo 'subjectAltName = email:move'
} >> $outputFile
}
modulCsrTlsServerConfig()
{
local outputFile=$1
local domain=$2
{
makeModulCsrConfigBlock_title $outputFile $domain 'TLS Server'
echo '[ req ]'
echo 'default_bits = 2048 # RSA key size'
echo 'encrypt_key = no # Protect private key'
echo 'default_md = sha1 # MD to use'
echo 'utf8 = yes # Input is UTF-8'
echo 'string_mask = utf8only # Emit UTF-8 strings'
echo 'prompt = yes # Prompt for DN'
echo 'distinguished_name = server_dn # DN template'
echo 'req_extensions = server_reqext # Desired extensions'
echo ''
makeModulCsrConfigBlock_csr_dn $outputFile $domain 'server_dn'
echo ''
echo '[ server_reqext ]'
echo 'keyUsage = critical,digitalSignature,keyEncipherment'
echo 'extendedKeyUsage = serverAuth,clientAuth'
echo 'subjectKeyIdentifier = hash'
echo 'subjectAltName = $ENV::SAN'
} >> $outputFile
}
modulCsrSoftwareConfig()
{
local outputFile=$1
local domain=$2
{
makeModulCsrConfigBlock_title $outputFile $domain 'Software'
echo '[ req ]'
echo 'default_bits = 2048 # RSA key size'
echo 'encrypt_key = yes # Protect private key'
echo 'default_md = sha1 # MD to use'
echo 'utf8 = yes # Input is UTF-8'
echo 'string_mask = utf8only # Emit UTF-8 strings'
echo 'prompt = yes # Prompt for DN'
echo 'distinguished_name = codesign_dn # DN template'
echo 'req_extensions = codesign_reqext # Desired extensions'
echo ''
echo '[ codesign_dn ]'
echo 'countryName = "1. Country Name (2 letters) (eg, US) "'
echo 'countryName_max = 2'
echo 'stateOrProvinceName = "2. State or Province Name (eg, region) "'
echo 'localityName = "3. Locality Name (eg, city) "'
echo 'organizationName = "4. Organization Name (eg, company) "'
echo 'organizationalUnitName = "5. Organizational Unit Name (eg, section) "'
echo 'commonName = "6. Common Name (eg, full name)"'
echo 'commonName_max = 64'
echo ''
echo '[ codesign_reqext ]'
echo 'keyUsage = critical,digitalSignature'
echo 'extendedKeyUsage = critical,codeSigning'
echo 'subjectKeyIdentifier = hash'
} >> $outputFile
}
##############################################################
#
# CA config partial factories
#
##############################################################
makeModulCaConfigBlock_title()
{
local outputFile=$1
local title=$2
{
echo "# $title"
echo ''
} >> $outputFile
}
makeModulCaConfigBlock_section()
{
local outputFile=$1
local title=$2
{
echo ''
echo ''
echo "# $title"
echo ''
} >> $outputFile
}
makeModulCaConfigBlock_default()
{
local outputFile=$1
local domain=$2
local level=$3
local type=$4
{
echo '[ default ]'
echo "ca = $domain"
echo "ca_type = $type"
echo 'ca_dir = $ca_type'
echo "db_dir = \$ca_dir/${DIR_NAME[db]}"
echo "private_dir = \$ca_dir/${DIR_NAME[private]}"
echo "dir = \$ENV::CA_${level}_SCRIPT_PATH # Top dir"
echo "base_url = http://$domain # CA base URL"
echo "ip_url = http://$DEFAULT_IP # CA base URL on IP"
echo 'aia_url = $base_url/$ca.$ca_type.cer # CA certificate URL'
echo 'ip_aia_url = $ip_url/$ca.$ca_type.cer # CA certificate URL'
echo 'crl_url = $base_url/$ca.$ca_type.crl # CRL distribution point'
echo 'ip_crl_url = $ip_url/$ca.$ca_type.cer # CRL distribution point'
echo 'name_opt = multiline,-esc_msb,utf8 # Display UTF-8 characters'
echo ''
} >> $outputFile
}
makeModulCaConfigBlock_req()
{
local outputFile=$1
{
echo '[ req ]'
echo "default_bits = $DEFAULT_CA_RSA_KEYSIZE_REQUEST # RSA key size"
echo 'encrypt_key = yes # Protect private key'
echo "default_md = $DEFAULT_CA_MD_REQUEST # MD to use"
echo 'utf8 = yes # Input is UTF-8'
echo 'string_mask = utf8only # Emit UTF-8 strings'
echo 'prompt = no # Dont prompt for DN'
echo 'distinguished_name = ca_dn # DN section'
echo 'req_extensions = ca_reqext # Desired extensions'
echo ''
} >> $outputFile
}
makeModulCaConfigBlock_ca_dn()
{
local outputFile=$1
local oN=$2
local cN=$3
{
echo '[ ca_dn ]'
echo 'countryName = "BE"'
echo "organizationName = \""### Network $oN\"""
echo 'organizationalUnitName = "interop"'
echo "commonName = \""### Network $cN\"""
echo ''
} >> $outputFile
}
makeModulCaConfigBlock_ca_reqext()
{
local outputFile=$1
local case=$2
if [ "$case" == 'signing' ]; then
{
echo '[ ca_reqext ]'
echo 'keyUsage = critical,keyCertSign,cRLSign'
echo 'basicConstraints = critical,CA:true,pathlen:0'
echo 'subjectKeyIdentifier = hash'
echo ''
} >> $outputFile
else
{
echo '[ ca_reqext ]'
echo 'keyUsage = critical,keyCertSign,cRLSign'
echo 'basicConstraints = critical,CA:true'
echo 'subjectKeyIdentifier = hash'
echo ''
} >> $outputFile
fi
}
makeModulCaConfigBlock_ca()
{
local outputFile=$1
local defaultCa=$2
local x509_extensions=$3
local copy_extensions=$4
local policy=$5
local days=$6
local crlDays=$7
local keyFileFormat=$(printf ${FILE_NAME[key]} '$ca' '$ca_type')
local crtSrlFileFormat=$(printf ${FILE_NAME[crtSrl]} '$ca' '$ca_type')
local crlSrlFileFormat=$(printf ${FILE_NAME[crlSrl]} '$ca' '$ca_type')
local crtDbFileFormat=$(printf ${FILE_NAME[crtDb]} '$ca' '$ca_type')
local crtFileFormat=$(printf ${FILE_NAME[crt]} '$ca' '$ca_type')
local pDir='$dir/$private_dir'
local dDir='$dir/$db_dir'
{
echo '[ ca ]'
echo "default_ca = $defaultCa # The default CA section"
echo ''
echo "[ $defaultCa ]"
echo "certificate = \$dir/$crtFileFormat # The CA cert"
echo 'new_certs_dir = $dir/$ca_dir # Certificate archive'
echo "private_key = $pDir/$keyFileFormat # CA private key"
echo "serial = $dDir/$crtSrlFileFormat # Serial number file"
echo "crlnumber = $dDir/$crlSrlFileFormat # CRL number file"
echo "database = $dDir/$crtDbFileFormat # Index file"
echo 'unique_subject = no # Require unique subject'
echo "default_days = $days # How long to certify for"
echo "default_md = $DEFAULT_CA_MD # MD to use"
echo "policy = $policy # Default naming policy"
echo 'email_in_dn = no # Add email to cert DN'
echo 'preserve = yes # Keep passed DN ordering'
echo 'name_opt = $name_opt # Subject DN display options'
echo 'cert_opt = ca_default # Certificate display options'
echo "copy_extensions = $copy_extensions # Copy extensions from CSR"
echo "x509_extensions = $x509_extensions # Default cert extensions"
echo "default_crl_days = $crlDays # How long before next CRL"
echo 'crl_extensions = crl_ext # CRL extensions'
echo ''
} >> $outputFile
}
##############################################################
#
# CA config factories
#
##############################################################
# args: out file, domain, nesting level (required for $ENV)
modulCaConfig()
{
local outputFile=$1
local domain=$2
local level=$3
if [ -z "$3" ]; then
level=0
fi
local suffix='CA'
if [ $level == '0' ]; then
suffix='Root CA'
fi
makeModulCaConfigBlock_title $outputFile "Network $domain $suffix"
makeModulCaConfigBlock_default $outputFile $domain $level 'ca'
makeModulCaConfigBlock_section $outputFile 'CA certificate request'
makeModulCaConfigBlock_req $outputFile
makeModulCaConfigBlock_ca_dn $outputFile $domain "$domain $suffix"
makeModulCaConfigBlock_ca_reqext $outputFile
makeModulCaConfigBlock_section $outputFile 'CA operational settings'
makeModulCaConfigBlock_ca $outputFile 'root_ca' 'server_ext' 'none' 'root_ca_pol' '730' '365'
{
echo '[ root_ca_pol ]'
echo 'countryName = match # Must match'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = match # Must match'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = match # Must match'
echo ''
echo '[ extension_ca_pol ]'
echo 'countryName = match # Must match'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = match # Must match'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = supplied # Must be present'
echo ''
echo '[ intermediate_ca_pol ]'
echo 'countryName = supplied # Must be present'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = supplied # Must be present'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = supplied # Must be present'
echo ''
echo ''
echo '# Extensions'
echo ''
echo '[ root_ca_ext ]'
echo 'keyUsage = critical,keyCertSign,cRLSign'
echo 'basicConstraints = critical,CA:true'
echo 'subjectKeyIdentifier = hash'
echo 'authorityKeyIdentifier = keyid:always'
echo ''
echo '[ signing_ca_ext ]'
echo 'keyUsage = critical,keyCertSign,cRLSign'
echo 'basicConstraints = critical,CA:true,pathlen:0'
echo 'subjectKeyIdentifier = hash'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo 'crlDistributionPoints = @crl_info'
echo ''
echo '[ crl_ext ]'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo ''
echo '[ issuer_info ]'
echo 'caIssuers;URI.0 = $aia_url'
echo 'caIssuers;URI.1 = $ip_aia_url'
echo ''
echo '[ crl_info ]'
echo 'URI.0 = $crl_url'
echo 'URI.1 = $ip_crl_url'
} >> $outputFile
}
# args: out file, domain, nesting level (required for $ENV)
modulCaTlsConfig()
{
local outputFile=$1
local domain=$2
local level=$3
makeModulCaConfigBlock_title $outputFile "Network $domain TLS CA"
makeModulCaConfigBlock_default $outputFile $domain $level 'ca-tls'
makeModulCaConfigBlock_section $outputFile 'CA certificate request'
makeModulCaConfigBlock_req $outputFile
makeModulCaConfigBlock_ca_dn $outputFile $domain "$domain TLS CA"
makeModulCaConfigBlock_ca_reqext $outputFile 'signing'
makeModulCaConfigBlock_section $outputFile 'CA operational settings'
makeModulCaConfigBlock_ca $outputFile 'tls_ca' 'server_ext' 'copy' 'match_pol' '730' '1'
{
echo '[ match_pol ]'
echo 'countryName = match # Must match NO'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = match # Must match Green AS'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = supplied # Must be present'
echo ''
echo '[ extern_pol ]'
echo 'countryName = supplied # Must be present'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = supplied # Must be present'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = supplied # Must be present'
echo ''
echo '[ any_pol ]'
echo 'domainComponent = optional'
echo 'countryName = optional'
echo 'stateOrProvinceName = optional'
echo 'localityName = optional'
echo 'organizationName = optional'
echo 'organizationalUnitName = optional'
echo 'commonName = optional'
echo 'emailAddress = optional'
echo ''
echo ''
echo '# Extensions'
echo ''
echo '[ server_ext ]'
echo 'keyUsage = critical,digitalSignature,keyEncipherment'
echo 'basicConstraints = CA:false'
echo 'extendedKeyUsage = serverAuth,clientAuth'
echo 'subjectKeyIdentifier = hash'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo 'crlDistributionPoints = @crl_info'
echo ''
echo '[ client_ext ]'
echo 'keyUsage = critical,digitalSignature'
echo 'basicConstraints = CA:false'
echo 'extendedKeyUsage = clientAuth'
echo 'subjectKeyIdentifier = hash'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo 'crlDistributionPoints = @crl_info'
echo ''
echo '[ crl_ext ]'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo ''
echo '[ issuer_info ]'
echo 'caIssuers;URI.0 = $aia_url'
echo ''
echo '[ crl_info ]'
echo 'URI.0 = $crl_url'
} >> $outputFile
}
# args: out file, domain, nesting level (required for $ENV)
modulCaEmailConfig()
{
local outputFile=$1
local domain=$2
local level=$3
makeModulCaConfigBlock_title $outputFile "Network $domain Email CA"
makeModulCaConfigBlock_default $outputFile $domain $level 'ca-email'
makeModulCaConfigBlock_section $outputFile 'CA certificate request'
makeModulCaConfigBlock_req $outputFile
makeModulCaConfigBlock_ca_dn $outputFile $domain "$domain Email CA"
makeModulCaConfigBlock_ca_reqext $outputFile 'signing'
makeModulCaConfigBlock_section $outputFile 'CA operational settings'
makeModulCaConfigBlock_ca $outputFile 'email_ca' 'email_ext' 'copy' 'match_pol' '730' '1'
{
echo '[ match_pol ]'
echo 'countryName = match # Must match NO'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = match # Must match Green AS'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = supplied # Must be present'
echo ''
echo '[ any_pol ]'
echo 'domainComponent = optional'
echo 'countryName = optional'
echo 'stateOrProvinceName = optional'
echo 'localityName = optional'
echo 'organizationName = optional'
echo 'organizationalUnitName = optional'
echo 'commonName = optional'
echo 'emailAddress = optional'
echo ''
echo ''
echo '# Extensions'
echo ''
echo '[ email_ext ]'
echo 'keyUsage = critical,digitalSignature,keyEncipherment'
echo 'basicConstraints = CA:false'
echo 'extendedKeyUsage = emailProtection,clientAuth,anyExtendedKeyUsage'
echo 'subjectKeyIdentifier = hash'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo 'crlDistributionPoints = @crl_info'
echo ''
echo '[ crl_ext ]'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo ''
echo '[ issuer_info ]'
echo 'caIssuers;URI.0 = $aia_url'
echo ''
echo '[ crl_info ]'
echo 'URI.0 = $crl_url'
} >> $outputFile
}
# args: out file, domain, nesting level (required for $ENV)
modulCaSoftwareConfig()
{
local outputFile=$1
local domain=$2
local level=$3
makeModulCaConfigBlock_title $outputFile "Network $domain Software CA"
makeModulCaConfigBlock_default $outputFile $domain $level 'ca-software'
makeModulCaConfigBlock_section $outputFile 'CA certificate request'
makeModulCaConfigBlock_req $outputFile
makeModulCaConfigBlock_ca_dn $outputFile $domain "$domain Software CA"
makeModulCaConfigBlock_ca_reqext $outputFile 'signing'
makeModulCaConfigBlock_section $outputFile 'CA operational settings'
makeModulCaConfigBlock_ca $outputFile 'software_ca' 'codesign_ext' 'copy' 'match_pol' '1826' '30'
{
echo '[ match_pol ]'
echo 'countryName = match # Must match NO'
echo 'stateOrProvinceName = optional # Included if present'
echo 'localityName = optional # Included if present'
echo 'organizationName = match # Must match Green AS'
echo 'organizationalUnitName = optional # Included if present'
echo 'commonName = supplied # Must be present'
echo ''
echo '[ any_pol ]'
echo 'domainComponent = optional'
echo 'countryName = optional'
echo 'stateOrProvinceName = optional'
echo 'localityName = optional'
echo 'organizationName = optional'
echo 'organizationalUnitName = optional'
echo 'commonName = optional'
echo 'emailAddress = optional'
echo ''
echo ''
echo '# Extensions'
echo ''
echo '[ codesign_ext ]'
echo 'keyUsage = critical,digitalSignature'
echo 'basicConstraints = CA:false'
echo 'extendedKeyUsage = critical,codeSigning'
echo 'subjectKeyIdentifier = hash'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo 'crlDistributionPoints = @crl_info'
echo ''
echo '[ crl_ext ]'
echo 'authorityKeyIdentifier = keyid:always'
echo 'authorityInfoAccess = @issuer_info'
echo ''
echo '[ issuer_info ]'
echo 'caIssuers;URI.0 = $aia_url'
echo ''
echo '[ crl_info ]'
echo 'URI.0 = $crl_url'
} >> $outputFile
}
##############################################################
#
# consolol
#
##############################################################
writeNewCert()
{
local domain=$1
local x=$(printf '%-64s' "create certificates for")
local y=$(printf '%-64s' "$domain")
local z=$(printf '%-64s' '')
echo -e "\e[90m$z\e[39m"
echo -e "\e[90m$x\e[39m"
echo -e "\e[96m$y\e[39m"
echo -e "\e[90m$z\e[39m"
}
writeNewType()
{
local type=$1
echo -e "\e[97m• create $type\e[39m"
}
writeNewItem()
{
local item=$1
echo -e "\e[90m - $item\e[39m"
}
writeNewItem2()
{
local item=$1
#echo -e "\e[90m --- $item\e[39m"
}
check_result()
{
if [ $1 -ne 0 ]; then
echo -e "\e[91m Error\e[39m $2"
exit $1
else
echo -e "\e[92m +\e[39m"
fi
}
##############################################################
#
# more factories!!!
#
##############################################################
makeConfigFile()
{
local domain=$1
local modul=$2
local outputFile=$3
local level=$4
if [ ! -e "$outputFile" ]; then
writeNewItem "CA config $modul"
eval $modul $outputFile $domain $level
check_result $? 'unable to create config'
fi
}
makeCsrConfigFile()
{
local domain=$1
local modul=$2
local outputFile=$3
if [ ! -e "$outputFile" ]; then
writeNewItem "certificate request config $modul"
eval $modul $outputFile $domain
check_result $? 'unable to create config'
fi
}
makeUserTlsCsrFiles()
{
local domain=$1
local cnfPath=$2
makeCsrConfigFile \
$domain \
'modulCsrTlsClientConfig' \
$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'tls-client')
makeCsrConfigFile \
$domain \
'modulCsrTlsServerConfig' \
$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'tls-server')
}
makeUserSoftwareCsrFiles()
{
local domain=$1
local cnfPath=$2
makeCsrConfigFile \
$domain \
'modulCsrSoftwareConfig' \
$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'code-signing')
}
makeUserEmailCsrFiles()
{
local domain=$1
local cnfPath=$2
makeCsrConfigFile \
$domain \
'modulCsrEmailConfig' \
$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'email')
}
makePasswordFile()
{
local domain=$1
local pwdFile=$2
if [ ! -e $pwdFile ]; then
writeNewItem 'pass'
openssl genpkey -algorithm RSA -out $pwdFile -pkeyopt rsa_keygen_bits:$DEFAULT_CA_RSA_KEYSIZE_PASSWORD -pkeyopt rsa_keygen_pubexp:$DEFAULT_CA_PWD_GEN_PUBEXP
check_result $? 'unable to create password'
fi
}
makeKeyFile()
{
local domain=$1
local keyFile=$2
local pwdFile=$3
if [ ! -e $keyFile ]; then
writeNewItem 'key'
openssl genrsa -aes256 -passout file:$pwdFile -out $keyFile $DEFAULT_CA_RSA_KEYSIZE_PRIVATE_KEY
check_result $? 'unable to create private key'
fi
}
makeDbFiles()
{
local domain=$1
local database=$2
local crtSerial=$3
local crlSerial=$4
if [ ! -e $database ]; then
writeNewItem 'database'
touch $database
check_result $? 'unable to create database'
writeNewItem 'crt serial'
echo 1000 > $crtSerial
check_result $? 'unable to create crt serial'
writeNewItem 'crl serial'
echo 1000 > $crlSerial
check_result $? 'unable to create crl serial'
fi
}
makeCsrFile()
{
local domain=$1
local cnfFile=$2
local csrFile=$3
local keyFile=$4
local pwdFile=$5
if [ ! -e $csrFile ]; then
writeNewItem 'csr'
openssl req -new \
-config $cnfFile \
-out $csrFile \
-key $keyFile -passin file:$pwdFile \
> /dev/null 2>&1
check_result $? 'unable to create csr'
fi
}
makeCrtFile()
{
local domain=$1
local cnfFile=$2
local csrFile=$3
local crtFile=$4
local pwdFile=$5
local case=$6
if [ ! -e $crtFile ]; then
writeNewItem 'crt'
if [ "$case" == 'root_ca' ]; then
openssl ca -selfsign -batch \
-config $cnfFile \
-in $csrFile \
-passin file:$pwdFile \
-out $crtFile \
-extensions root_ca_ext \
-enddate 20820508235959Z \
> /dev/null 2>&1
check_result $? 'unable to create crt'
fi
if [ "$case" == 'intermediate_ca' ]; then
openssl ca -batch \
-config $cnfFile \
-in $csrFile \
-passin file:$pwdFile \
-out $crtFile \
-extensions root_ca_ext \
-policy intermediate_ca_pol \
-enddate 20820508235959Z \
> /dev/null 2>&1
check_result $? 'unable to create crt'
fi
if [ "$case" == 'signing_ca' ]; then
openssl ca -batch \
-config $cnfFile \
-in $csrFile \
-passin file:$pwdFile \
-out $crtFile \
-extensions signing_ca_ext \
-policy extension_ca_pol \
-enddate 20820508235959Z \
> /dev/null 2>&1
check_result $? 'unable to create crt'
fi
fi
}
makeCrlFile()
{
local domain=$1
local cnfFile=$2
local crlFile=$3
local pwdFile=$4
if [ ! -e $crlFile ]; then
writeNewItem 'crl'
openssl ca -gencrl \
-config $cnfFile \
-passin file:$pwdFile \
-out $crlFile \
> /dev/null 2>&1
check_result $? 'unable to create crl'
fi
}
makeChain()
{
local domain=$1
local child=$2
local parents=$3
local chainFile=$4
if [ ! -e $chainFile ]; then
writeNewItem 'chained certificates'
cat $child $parents > $chainFile
check_result $? 'unable to create chained certificates'
fi
}
##############################################################
#
# CA factories
#
##############################################################
#
# the root! rooooooooooot!
#
# note: we need the env var for openssl config
#
# ./reverse root CA
#
makeRootCa()
{
local domain=$1
local baseDir=$2
local cnfFile=$3
local csrFile=$4
local keyFile=$5
local pwdFile=$6
local crtFile=$7
local crlFile=$8
export CA_0_SCRIPT_PATH="$baseDir"
makeCsrFile $domain $cnfFile $csrFile $keyFile $pwdFile
makeCrtFile $domain $cnfFile $csrFile $crtFile $pwdFile 'root_ca'
makeCrlFile $domain $cnfFile $crlFile $pwdFile
}
#
# intermediate CA level 1
#
# note: we need the env vars for openssl config
#
# ./reverse/domain root CA
#
makeIntermediateCa()
{
local domain=$1
local baseDir=$2
local cnfFile=$3
local csrFile=$4
local keyFile=$5
local pwdFile=$6
local crtFile=$7
local crlFile=$8
local chainFile=$9
local rootBaseDir=${10}
local rootCnfFile=${11}
local rootPwdFile=${12}
local rootCrtFile=${13}
export CA_1_SCRIPT_PATH="$baseDir"
export CA_0_SCRIPT_PATH="$rootBaseDir"
makeCsrFile $domain $cnfFile $csrFile $keyFile $pwdFile
makeCrtFile $domain $rootCnfFile $csrFile $crtFile $rootPwdFile 'intermediate_ca'
makeCrlFile $domain $cnfFile $crlFile $pwdFile
makeChain $domain $crtFile $rootCrtFile $chainFile
}
#
# intermediate CA level 2
#
# note: we need the env vars for openssl config
#
# ./reverse/domain/subdomain root CA
#
makeIntermediateIntermediateCa()
{
local domain=$1
local baseDir=$2
local cnfFile=$3
local csrFile=$4
local keyFile=$5
local pwdFile=$6
local crtFile=$7
local crlFile=$8
local chainFile=$9
local rootBaseDir=${10}
local rootCnfFile=${11}
local rootPwdFile=${12}
local rootCrtFile=${13}
export CA_2_SCRIPT_PATH="$baseDir"
export CA_1_SCRIPT_PATH="$rootBaseDir"
makeCsrFile $domain $cnfFile $csrFile $keyFile $pwdFile
makeCrtFile $domain $rootCnfFile $csrFile $crtFile $rootPwdFile 'intermediate_ca'
makeCrlFile $domain $cnfFile $crlFile $pwdFile
makeChain $domain $crtFile $rootCrtFile $chainFile
}
#
# signing CA
#
# note: we need the env var for openssl config
#
# ./reverse-tls
# ./reverse/domain-[tls|email|software]
# ./reverse/domain/subdomain-[tls|email|software]
#
makeSigningCa()
{
local domain=$1
local baseDir=$2
local cnfFile=$3
local csrFile=$4
local keyFile=$5
local pwdFile=$6
local crtFile=$7
local crlFile=$8
local chainFile=$9
local rootCnfFile=${10}
local rootPwdFile=${11}
local rootCrtFile=${12}
export CA_0_SCRIPT_PATH="$baseDir"
makeCsrFile $domain $cnfFile $csrFile $keyFile $pwdFile
makeCrtFile $domain $rootCnfFile $csrFile $crtFile $rootPwdFile 'signing_ca'
makeCrlFile $domain $cnfFile $crlFile $pwdFile
makeChain $domain $crtFile $rootCrtFile $chainFile
}
##############################################################
#
# output
#
##############################################################
#
# LEVEL 0 (reverse)
#
declare -A LEVEL0
LEVEL0[domain]=$1
LEVEL0[path]="$SCRIPT_PATH/$1"
declare -A LEVEL0_PATH
# lookup table
LEVEL0_PATH[lookup]="${LEVEL0[path]}/${DIR_NAME[lookup]}"
# root ca
LEVEL0_PATH[caPath]="${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[caPath]}"
LEVEL0_PATH[caDbPath]="${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[dbPath]}"
LEVEL0_PATH[caCnfPath]="${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[cnfPath]}"
LEVEL0_PATH[caPrvPath]="${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[privatePath]}"
# tls ca
LEVEL0_PATH[caTlsPath]="${LEVEL0[path]}/${DIRECTORIES_CA_TLS[caPath]}"
LEVEL0_PATH[caTlsDbPath]="${LEVEL0[path]}/${DIRECTORIES_CA_TLS[dbPath]}"
LEVEL0_PATH[caTlsCnfPath]="${LEVEL0[path]}/${DIRECTORIES_CA_TLS[cnfPath]}"
LEVEL0_PATH[caTlsPrvPath]="${LEVEL0[path]}/${DIRECTORIES_CA_TLS[privatePath]}"
# domains
LEVEL0_PATH[intermediatePath]="${LEVEL0[path]}/${DIR_NAME[intermediateDir]}"
# tls crt
LEVEL0_PATH[crtTlsPath]="${LEVEL0[path]}/${DIRECTORIES_CRT_TLS[crtPath]}"
LEVEL0_PATH[crtTlsCnfPath]="${LEVEL0[path]}/${DIRECTORIES_CRT_TLS[cnfPath]}"
LEVEL0_PATH[crtTlsPrvPath]="${LEVEL0[path]}/${DIRECTORIES_CRT_TLS[privatePath]}"
# pub
LEVEL0_PATH[crtTls]="${LEVEL0[path]}/${DIRECTORIES_CRT[tls]}"
writeNewCert ${LEVEL0[domain]}
writeNewType 'directories'
for index in "${!LEVEL0_PATH[@]}"
do
echo "create dir ${LEVEL0_PATH[$index]}"
mkdir -p "${LEVEL0_PATH[$index]}" > /dev/null 2>&1
check_result $? 'unable to create directory'
done
##############################################################
#
# lookup
#
# ca=$(head -n 1 $lookup/$domain)
#
##############################################################
lookupAdd()
{
local domain=$1
local path=$2
local lookup=${LEVEL0_PATH[lookup]}
rm $lookup/$domain > /dev/null 2>&1
echo $path >> $lookup/$domain
}
writeNewType 'lookup'
lookupAdd ${LEVEL0[domain]} ${LEVEL0[path]}
writeNewType 'user request configs'
makeUserTlsCsrFiles \
${LEVEL0[domain]} \
${LEVEL0_PATH[crtTlsCnfPath]}
#
# The following part is the worst thing you've ever seen. \o/
# Thanks to openssl's path party.
#
#
# root CA
#
writeNewType 'Root CA'
# ./
local __0__caCsr=${LEVEL0[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
local __0__caCrt=${LEVEL0[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
# ./db
local __0__caCrtDb=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
local __0__caCrtSrl=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
local __0__caCrlSrl=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
local __0__caCrl=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
# ./etc
local __0__caConfig=${LEVEL0_PATH[caCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
# ./private
local __0__caPwd=${LEVEL0_PATH[caPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
local __0__caKey=${LEVEL0_PATH[caPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
makeConfigFile \
${LEVEL0[domain]} \
'modulCaConfig' \
$__0__caConfig \
'0'
makePasswordFile \
${LEVEL0[domain]} \
$__0__caPwd
makeKeyFile \
${LEVEL0[domain]} \
$__0__caKey \
$__0__caPwd
makeDbFiles \
${LEVEL0[domain]} \
$__0__caCrtDb \
$__0__caCrtSrl \
$__0__caCrlSrl
makeRootCa \
${LEVEL0[domain]} \
${LEVEL0[path]} \
$__0__caConfig \
$__0__caCsr \
$__0__caKey \
$__0__caPwd \
$__0__caCrt \
$__0__caCrl
#
# tls CA
#
writeNewType 'TLS CA'
# ./
local __0__tlsCsr=${LEVEL0[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
local __0__tlsCrt=${LEVEL0[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
local __0__tlsChainPem=${LEVEL0[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
# ./db
local __0__tlsCrtDb=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
local __0__tlsCrtSrl=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
local __0__tlsCrlSrl=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
local __0__tlsCrl=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
# ./etc
local __0__tlsConfig=${LEVEL0_PATH[caTlsCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
# ./private
local __0__tlsPwd=${LEVEL0_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
local __0__tlsKey=${LEVEL0_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
makeConfigFile \
${LEVEL0[domain]} \
'modulCaTlsConfig' \
$__0__tlsConfig \
'0'
makePasswordFile \
${LEVEL0[domain]} \
$__0__tlsPwd
makeKeyFile \
${LEVEL0[domain]} \
$__0__tlsKey \
$__0__tlsPwd
makeDbFiles \
${LEVEL0[domain]} \
$__0__tlsCrtDb \
$__0__tlsCrtSrl \
$__0__tlsCrlSrl
makeSigningCa \
${LEVEL0[domain]} \
${LEVEL0[path]} \
$__0__tlsConfig \
$__0__tlsCsr \
$__0__tlsKey \
$__0__tlsPwd \
$__0__tlsCrt \
$__0__tlsCrl \
$__0__tlsChainPem \
$__0__caConfig \
$__0__caPwd \
$__0__caCrt
#
# LEVEL 1 (domain)
#
# intermediate CA for domain level
# ./intermediate
if [ ! -z "$2" ]; then
level1domains=$(echo $2 | tr ";" "\n")
for level1domain in $level1domains
do
#
# LEVEL 1 (domain)
#
declare -A LEVEL1
LEVEL1[domain]=$level1domain
LEVEL1[path]="${LEVEL0_PATH[intermediatePath]}/$level1domain"
declare -A LEVEL1_PATH
# sub root ca
LEVEL1_PATH[caPath]="${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[caPath]}"
LEVEL1_PATH[caDbPath]="${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[dbPath]}"
LEVEL1_PATH[caCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[cnfPath]}"
LEVEL1_PATH[caPrvPath]="${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[privatePath]}"
# email ca
LEVEL1_PATH[caEmailPath]="${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[caPath]}"
LEVEL1_PATH[caEmailDbPath]="${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[dbPath]}"
LEVEL1_PATH[caEmailCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[cnfPath]}"
LEVEL1_PATH[caEmailPrvPath]="${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[privatePath]}"
# software ca
LEVEL1_PATH[caSoftwarePath]="${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[caPath]}"
LEVEL1_PATH[caSoftwareDbPath]="${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[dbPath]}"
LEVEL1_PATH[caSoftwareCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[cnfPath]}"
LEVEL1_PATH[caSoftwarePrvPath]="${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[privatePath]}"
# tls ca
LEVEL1_PATH[caTlsPath]="${LEVEL1[path]}/${DIRECTORIES_CA_TLS[caPath]}"
LEVEL1_PATH[caTlsDbPath]="${LEVEL1[path]}/${DIRECTORIES_CA_TLS[dbPath]}"
LEVEL1_PATH[caTlsCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CA_TLS[cnfPath]}"
LEVEL1_PATH[caTlsPrvPath]="${LEVEL1[path]}/${DIRECTORIES_CA_TLS[privatePath]}"
# email crt
LEVEL1_PATH[crtEmailPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_EMAIL[crtPath]}"
LEVEL1_PATH[crtEmailCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_EMAIL[cnfPath]}"
LEVEL1_PATH[crtEmailPrvPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_EMAIL[privatePath]}"
# software crt
LEVEL1_PATH[crtSoftwarePath]="${LEVEL1[path]}/${DIRECTORIES_CRT_SOFTWARE[crtPath]}"
LEVEL1_PATH[crtSoftwareCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_SOFTWARE[cnfPath]}"
LEVEL1_PATH[crtSoftwarePrvPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_SOFTWARE[privatePath]}"
# tls crt
LEVEL1_PATH[crtTlsPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_TLS[crtPath]}"
LEVEL1_PATH[crtTlsCnfPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_TLS[cnfPath]}"
LEVEL1_PATH[crtTlsPrvPath]="${LEVEL1[path]}/${DIRECTORIES_CRT_TLS[privatePath]}"
# subdomains
LEVEL1_PATH[intermediatePath]="${LEVEL1[path]}/${DIR_NAME[intermediateDir]}"
# pub
LEVEL1_PATH[pubTls]="${LEVEL1[path]}/${DIRECTORIES_CRT[tls]}"
LEVEL1_PATH[pubSoftware]="${LEVEL1[path]}/${DIRECTORIES_CRT[software]}"
LEVEL1_PATH[pubEmail]="${LEVEL1[path]}/${DIRECTORIES_CRT[email]}"
writeNewCert ${LEVEL1[domain]}
writeNewType 'directories'
for index in "${!LEVEL1_PATH[@]}"
do
mkdir -p "${LEVEL1_PATH[$index]}" > /dev/null 2>&1
done
check_result $? 'unable to create directory'
writeNewType 'lookup'
lookupAdd ${LEVEL1[domain]} ${LEVEL1[path]}
writeNewType 'user request configs'
makeUserSoftwareCsrFiles \
${LEVEL1[domain]} \
${LEVEL1_PATH[crtSoftwareCnfPath]}
makeUserEmailCsrFiles \
${LEVEL1[domain]} \
${LEVEL1_PATH[crtEmailCnfPath]}
makeUserTlsCsrFiles \
${LEVEL1[domain]} \
${LEVEL1_PATH[crtTlsCnfPath]}
#
# sub root CA
#
writeNewType 'Intermediate CA'
# ./
local __1__caCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
local __1__caCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
local __1__caChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
# ./db
local __1__caCrtDb=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
local __1__caCrtSrl=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
local __1__caCrlSrl=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
local __1__caCrl=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
# ./etc
local __1__caConfig=${LEVEL1_PATH[caCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
# ./private
local __1__caPwd=${LEVEL1_PATH[caPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
local __1__caKey=${LEVEL1_PATH[caPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
makeConfigFile \
${LEVEL1[domain]} \
'modulCaConfig' \
$__1__caConfig \
'1'
makePasswordFile \
${LEVEL1[domain]} \
$__1__caPwd
makeKeyFile \
${LEVEL1[domain]} \
$__1__caKey \
$__1__caPwd
makeDbFiles \
${LEVEL1[domain]} \
$__1__caCrtDb \
$__1__caCrtSrl \
$__1__caCrlSrl
makeIntermediateCa \
${LEVEL1[domain]} \
${LEVEL1[path]} \
$__1__caConfig \
$__1__caCsr \
$__1__caKey \
$__1__caPwd \
$__1__caCrt \
$__1__caCrl \
$__1__caChainPem \
${LEVEL0[path]} \
$__0__caConfig \
$__0__caPwd \
$__0__caCrt
#
# tls CA
#
writeNewType 'TLS CA'
# ./
local __1__tlsCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
local __1__tlsCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
local __1__tlsChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
# ./db
local __1__tlsCrtDb=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
local __1__tlsCrtSrl=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
local __1__tlsCrlSrl=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
local __1__tlsCrl=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
# ./etc
local __1__tlsConfig=${LEVEL1_PATH[caTlsCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
# ./private
local __1__tlsPwd=${LEVEL1_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
local __1__tlsKey=${LEVEL1_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
makeConfigFile \
${LEVEL1[domain]} \
'modulCaTlsConfig' \
$__1__tlsConfig \
'1'
makePasswordFile \
${LEVEL1[domain]} \
$__1__tlsPwd
makeKeyFile \
${LEVEL1[domain]} \
$__1__tlsKey \
$__1__tlsPwd
makeDbFiles \
${LEVEL1[domain]} \
$__1__tlsCrtDb \
$__1__tlsCrtSrl \
$__1__tlsCrlSrl
makeSigningCa \
${LEVEL1[domain]} \
${LEVEL1[path]} \
$__1__tlsConfig \
$__1__tlsCsr \
$__1__tlsKey \
$__1__tlsPwd \
$__1__tlsCrt \
$__1__tlsCrl \
$__1__tlsChainPem \
$__1__caConfig \
$__1__caPwd \
$__1__caChainPem
#
# email CA
#
writeNewType 'Email CA'
# ./
local __1__emailCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
local __1__emailCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
local __1__emailChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
# ./db
local __1__emailCrtDb=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
local __1__emailCrtSrl=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
local __1__emailCrlSrl=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
local __1__emailCrl=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
# ./etc
local __1__emailConfig=${LEVEL1_PATH[caEmailCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
# ./private
local __1__emailPwd=${LEVEL1_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
local __1__emailKey=${LEVEL1_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
makeConfigFile \
${LEVEL1[domain]} \
'modulCaEmailConfig' \
$__1__emailConfig \
'1'
makePasswordFile \
${LEVEL1[domain]} \
$__1__emailPwd
makeKeyFile \
${LEVEL1[domain]} \
$__1__emailKey \
$__1__emailPwd
makeDbFiles \
${LEVEL1[domain]} \
$__1__emailCrtDb \
$__1__emailCrtSrl \
$__1__emailCrlSrl
makeSigningCa \
${LEVEL1[domain]} \
${LEVEL1[path]} \
$__1__emailConfig \
$__1__emailCsr \
$__1__emailKey \
$__1__emailPwd \
$__1__emailCrt \
$__1__emailCrl \
$__1__emailChainPem \
$__1__caConfig \
$__1__caPwd \
$__1__caChainPem
#
# software CA
#
writeNewType 'Software CA'
# ./
local __1__softwareCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
local __1__softwareCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
local __1__softwareChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
# ./db
local __1__softwareCrtDb=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
local __1__softwareCrtSrl=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
local __1__softwareCrlSrl=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
local __1__softwareCrl=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
# ./etc
local __1__softwareConfig=${LEVEL1_PATH[caSoftwareCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
# ./private
local __1__softwarePwd=${LEVEL1_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
local __1__softwareKey=${LEVEL1_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
makeConfigFile \
${LEVEL1[domain]} \
'modulCaSoftwareConfig' \
$__1__softwareConfig \
'1'
makePasswordFile \
${LEVEL1[domain]} \
$__1__softwarePwd
makeKeyFile \
${LEVEL1[domain]} \
$__1__softwareKey \
$__1__softwarePwd
makeDbFiles \
${LEVEL1[domain]} \
$__1__softwareCrtDb \
$__1__softwareCrtSrl \
$__1__softwareCrlSrl
makeSigningCa \
${LEVEL1[domain]} \
${LEVEL1[path]} \
$__1__softwareConfig \
$__1__softwareCsr \
$__1__softwareKey \
$__1__softwarePwd \
$__1__softwareCrt \
$__1__softwareCrl \
$__1__softwareChainPem \
$__1__caConfig \
$__1__caPwd \
$__1__caChainPem
#
# LEVEL 2 (subdomains)
#
# intermediate intermediate CA for subdomain level
# ./intermediate/domain/intermediate
if [ ! -z "$3" ]; then
level2domains=$(echo $3 | tr ";" "\n")
for level2domain in $level2domains
do
#
# LEVEL 2 (subs)
#
# I don't split anything by '.' - a mail.foo.tld is like bob.mail.foo.tld.
# feel free to create the third level for bob.
#
# in that case
# - intermediate CA @ level 3:
# - you MUST fork the makeIntermediateIntermediateCa function as makeIntermediateIntermediateIntermediateCa (or whatever);
# - you MUST redefine export CA_2_SCRIPT_PATH="$baseDir" and export CA_1_SCRIPT_PATH="$rootBaseDir"
# as export CA_3_SCRIPT_PATH="$baseDir" and export CA_2_SCRIPT_PATH="$rootBaseDir"
# - you MUST call makeConfigFile with '4' as the fourth parameter
# otherwise openssl fails on relative paths. you can walk through the directories - but that's also nasty.
# @see makeModulCaConfigBlock_default::$level
# - signing CAs @ level 3 are fun: s/2/3/ && s/1/2/
#
declare -A LEVEL2
LEVEL2[domain]="$level2domain.${LEVEL1[domain]}"
LEVEL2[path]="${LEVEL1_PATH[intermediatePath]}/$level2domain"
declare -A LEVEL2_PATH
# sub sub root ca
LEVEL2_PATH[caPath]="${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[caPath]}"
LEVEL2_PATH[caDbPath]="${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[dbPath]}"
LEVEL2_PATH[caCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[cnfPath]}"
LEVEL2_PATH[caPrvPath]="${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[privatePath]}"
# email ca
LEVEL2_PATH[caEmailPath]="${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[caPath]}"
LEVEL2_PATH[caEmailDbPath]="${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[dbPath]}"
LEVEL2_PATH[caEmailCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[cnfPath]}"
LEVEL2_PATH[caEmailPrvPath]="${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[privatePath]}"
# software ca
LEVEL2_PATH[caSoftwarePath]="${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[caPath]}"
LEVEL2_PATH[caSoftwareDbPath]="${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[dbPath]}"
LEVEL2_PATH[caSoftwareCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[cnfPath]}"
LEVEL2_PATH[caSoftwarePrvPath]="${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[privatePath]}"
# tls ca
LEVEL2_PATH[caTlsPath]="${LEVEL2[path]}/${DIRECTORIES_CA_TLS[caPath]}"
LEVEL2_PATH[caTlsDbPath]="${LEVEL2[path]}/${DIRECTORIES_CA_TLS[dbPath]}"
LEVEL2_PATH[caTlsCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CA_TLS[cnfPath]}"
LEVEL2_PATH[caTlsPrvPath]="${LEVEL2[path]}/${DIRECTORIES_CA_TLS[privatePath]}"
# email crt
LEVEL2_PATH[crtEmailPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_EMAIL[crtPath]}"
LEVEL2_PATH[crtEmailCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_EMAIL[cnfPath]}"
LEVEL2_PATH[crtEmailPrvPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_EMAIL[privatePath]}"
# software crt
LEVEL2_PATH[crtSoftwarePath]="${LEVEL2[path]}/${DIRECTORIES_CRT_SOFTWARE[crtPath]}"
LEVEL2_PATH[crtSoftwareCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_SOFTWARE[cnfPath]}"
LEVEL2_PATH[crtSoftwarePrvPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_SOFTWARE[privatePath]}"
# tls crt
LEVEL2_PATH[crtTlsPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_TLS[crtPath]}"
LEVEL2_PATH[crtTlsCnfPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_TLS[cnfPath]}"
LEVEL2_PATH[crtTlsPrvPath]="${LEVEL2[path]}/${DIRECTORIES_CRT_TLS[privatePath]}"
# pub
LEVEL2_PATH[pubTls]="${LEVEL2[path]}/${DIRECTORIES_CRT[tls]}"
LEVEL2_PATH[pubSoftware]="${LEVEL2[path]}/${DIRECTORIES_CRT[software]}"
LEVEL2_PATH[pubEmail]="${LEVEL2[path]}/${DIRECTORIES_CRT[email]}"
writeNewCert ${LEVEL2[domain]}
writeNewType 'directories'
for index in "${!LEVEL2_PATH[@]}"
do
mkdir -p "${LEVEL2_PATH[$index]}" > /dev/null 2>&1
done
check_result $? 'unable to create directory'
writeNewType 'lookup'
lookupAdd ${LEVEL2[domain]} ${LEVEL2[path]}
writeNewType 'user request configs'
makeUserSoftwareCsrFiles \
${LEVEL2[domain]} \
${LEVEL2_PATH[crtSoftwareCnfPath]}
makeUserEmailCsrFiles \
${LEVEL2[domain]} \
${LEVEL2_PATH[crtEmailCnfPath]}
makeUserTlsCsrFiles \
${LEVEL2[domain]} \
${LEVEL2_PATH[crtTlsCnfPath]}
#
# sub sub root CA
#
writeNewType 'Intermediate CA'
# ./
local __2__caCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
local __2__caCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
local __2__caChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
# ./db
local __2__caCrtDb=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
local __2__caCrtSrl=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
local __2__caCrlSrl=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
local __2__caCrl=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
# ./etc
local __2__caConfig=${LEVEL2_PATH[caCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
# ./private
local __2__caPwd=${LEVEL2_PATH[caPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
local __2__caKey=${LEVEL2_PATH[caPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
makeConfigFile \
${LEVEL2[domain]} \
'modulCaConfig' \
$__2__caConfig \
'2'
makePasswordFile \
${LEVEL2[domain]} \
$__2__caPwd
makeKeyFile \
${LEVEL2[domain]} \
$__2__caKey \
$__2__caPwd
makeDbFiles \
${LEVEL2[domain]} \
$__2__caCrtDb \
$__2__caCrtSrl \
$__2__caCrlSrl
makeIntermediateIntermediateCa \
${LEVEL2[domain]} \
${LEVEL2[path]} \
$__2__caConfig \
$__2__caCsr \
$__2__caKey \
$__2__caPwd \
$__2__caCrt \
$__2__caCrl \
$__2__caChainPem \
${LEVEL1[path]} \
$__1__caConfig \
$__1__caPwd \
$__1__caChainPem
#
# tls CA
#
writeNewType 'TLS CA'
# ./
local __2__tlsCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
local __2__tlsCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
local __2__tlsChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
# ./db
local __2__tlsCrtDb=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
local __2__tlsCrtSrl=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
local __2__tlsCrlSrl=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
local __2__tlsCrl=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
# ./etc
local __2__tlsConfig=${LEVEL2_PATH[caTlsCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
# ./private
local __2__tlsPwd=${LEVEL2_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
local __2__tlsKey=${LEVEL2_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
makeConfigFile \
${LEVEL2[domain]} \
'modulCaTlsConfig' \
$__2__tlsConfig \
'2'
makePasswordFile \
${LEVEL2[domain]} \
$__2__tlsPwd
makeKeyFile \
${LEVEL2[domain]} \
$__2__tlsKey \
$__2__tlsPwd
makeDbFiles \
${LEVEL2[domain]} \
$__2__tlsCrtDb \
$__2__tlsCrtSrl \
$__2__tlsCrlSrl
makeSigningCa \
${LEVEL2[domain]} \
${LEVEL2[path]} \
$__2__tlsConfig \
$__2__tlsCsr \
$__2__tlsKey \
$__2__tlsPwd \
$__2__tlsCrt \
$__2__tlsCrl \
$__2__tlsChainPem \
$__2__caConfig \
$__2__caPwd \
$__2__caChainPem
#
# email CA
#
writeNewType 'Email CA'
# ./
local __2__emailCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
local __2__emailCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
local __2__emailChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
# ./db
local __2__emailCrtDb=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
local __2__emailCrtSrl=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
local __2__emailCrlSrl=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
local __2__emailCrl=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
# ./etc
local __2__emailConfig=${LEVEL2_PATH[caEmailCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
# ./private
local __2__emailPwd=${LEVEL2_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
local __2__emailKey=${LEVEL2_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
makeConfigFile \
${LEVEL2[domain]} \
'modulCaEmailConfig' \
$__2__emailConfig \
'2'
makePasswordFile \
${LEVEL2[domain]} \
$__2__emailPwd
makeKeyFile \
${LEVEL2[domain]} \
$__2__emailKey \
$__2__emailPwd
makeDbFiles \
${LEVEL2[domain]} \
$__2__emailCrtDb \
$__2__emailCrtSrl \
$__2__emailCrlSrl
makeSigningCa \
${LEVEL2[domain]} \
${LEVEL2[path]} \
$__2__emailConfig \
$__2__emailCsr \
$__2__emailKey \
$__2__emailPwd \
$__2__emailCrt \
$__2__emailCrl \
$__2__emailChainPem \
$__2__caConfig \
$__2__caPwd \
$__2__caChainPem
#
# software CA
#
writeNewType 'Software CA'
# ./
local __2__softwareCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
local __2__softwareCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
local __2__softwareChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
# ./db
local __2__softwareCrtDb=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
local __2__softwareCrtSrl=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
local __2__softwareCrlSrl=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
local __2__softwareCrl=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
# ./etc
local __2__softwareConfig=${LEVEL2_PATH[caSoftwareCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
# ./private
local __2__softwarePwd=${LEVEL2_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
local __2__softwareKey=${LEVEL2_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
makeConfigFile \
${LEVEL2[domain]} \
'modulCaSoftwareConfig' \
$__2__softwareConfig \
'2'
makePasswordFile \
${LEVEL2[domain]} \
$__2__softwarePwd
makeKeyFile \
${LEVEL2[domain]} \
$__2__softwareKey \
$__2__softwarePwd
makeDbFiles \
${LEVEL2[domain]} \
$__2__softwareCrtDb \
$__2__softwareCrtSrl \
$__2__softwareCrlSrl
makeSigningCa \
${LEVEL2[domain]} \
${LEVEL2[path]} \
$__2__softwareConfig \
$__2__softwareCsr \
$__2__softwareKey \
$__2__softwarePwd \
$__2__softwareCrt \
$__2__softwareCrl \
$__2__softwareChainPem \
$__2__caConfig \
$__2__caPwd \
$__2__caChainPem
done
fi
done
fi
}
Comments