OpenSSL/CA.sh
をテンプレートにして作成
[
トップ
] [
タイトル一覧
|
ページ一覧
|
新規
|
検索
|
最終更新
|
ヘルプ
|
ログイン
]
開始行:
* CA.sh
<pre>
#!/bin/sh
#
# CA - wrapper around ca to make it easier to use ... bas...
# some setup stuff to be done before you can use it ...
# things easier between now and when Eric is convinc...
#
# CA -newca ... will setup the right stuff
# CA -newreq ... will generate a certificate request
# CA -sign ... will sign the generated request and output
#
# At the end of that grab newreq.pem and newcert.pem (one...
# and the other the certificate) and cat them together an...
# you want/need ... I'll make even this a little cleaner ...
#
#
# 12-Jan-96 tjh Added more things ... including CA -si...
# converts a certificate to a request an...
# 10-Jan-96 eay Fixed a few more bugs and added the SS...
# environment variable so this can be dr...
# a script.
# 25-Jul-96 eay Cleaned up filenames some more.
# 11-Jun-96 eay Fixed a few filename missmatches.
# 03-May-96 eay Modified to use 'ssleay cmd' instead o...
# 18-Apr-96 tjh Original hacking
#
# Tim Hudson
# tjh@cryptsoft.com
#
# default openssl.cnf file has setup as per the following
# demoCA ... where everything is stored
DAYS="-days 4380"
REQ="/usr/bin/openssl req $SSLEAY_CONFIG"
CA="/usr/bin/openssl ca $SSLEAY_CONFIG"
VERIFY="openssl verify"
X509="openssl x509"
CATOP=./demoCA
CAKEY=./cakey.pem
CACERT=./cacert.pem
for i
do
case $i in
-\?|-h|-help)
echo "usage: CA -newcert|-newreq|-newca|-sign|-verify...
exit 0
;;
-newcert)
# create a certificate
$REQ -new -x509 -keyout newreq.pem -out newreq.pem $D...
RET=$?
echo "Certificate (and private key) is in newreq.pem"
;;
-newreq)
# create a certificate request
$REQ -new -keyout newreq.pem -out newreq.pem $DAYS
RET=$?
echo "Request (and private key) is in newreq.pem"
;;
-newca)
# if explicitly asked for or it doesn't exist then se...
# structure that Eric likes to manage things
NEW="1"
if [ "$NEW" -o ! -f ${CATOP}/serial ]; then
# create the directory hierarchy
mkdir ${CATOP}
mkdir ${CATOP}/certs
mkdir ${CATOP}/crl
mkdir ${CATOP}/newcerts
mkdir ${CATOP}/private
echo "01" > ${CATOP}/serial
touch ${CATOP}/index.txt
fi
if [ ! -f ${CATOP}/private/$CAKEY ]; then
echo "CA certificate filename (or enter to create)"
read FILE
# ask user for existing CA certificate
if [ "$FILE" ]; then
cp $FILE ${CATOP}/private/$CAKEY
RET=$?
else
echo "Making CA certificate ..."
$REQ -new -x509 -keyout ${CATOP}/private/$CAK...
-out ${CATOP}/$CACERT $DAYS
RET=$?
fi
fi
;;
-xsign)
$CA -policy policy_anything -infiles newreq.pem
RET=$?
;;
-sign|-signreq)
$CA -policy policy_anything -out newcert.pem -infiles...
RET=$?
cat newcert.pem
echo "Signed certificate is in newcert.pem"
;;
-signcert)
echo "Cert passphrase will be requested twice - bug?"
$X509 -x509toreq -in newreq.pem -signkey newreq.pem -...
$CA -policy policy_anything -out newcert.pem -infiles...
cat newcert.pem
echo "Signed certificate is in newcert.pem"
;;
-verify)
shift
if [ -z "$1" ]; then
$VERIFY -CAfile $CATOP/$CACERT newcert.pem
RET=$?
else
for j
do
$VERIFY -CAfile $CATOP/$CACERT $j
if [ $? != 0 ]; then
RET=$?
fi
done
fi
exit 0
;;
*)
echo "Unknown arg $i";
exit 1
;;
esac
done
exit $RET
</pre>
終了行:
* CA.sh
<pre>
#!/bin/sh
#
# CA - wrapper around ca to make it easier to use ... bas...
# some setup stuff to be done before you can use it ...
# things easier between now and when Eric is convinc...
#
# CA -newca ... will setup the right stuff
# CA -newreq ... will generate a certificate request
# CA -sign ... will sign the generated request and output
#
# At the end of that grab newreq.pem and newcert.pem (one...
# and the other the certificate) and cat them together an...
# you want/need ... I'll make even this a little cleaner ...
#
#
# 12-Jan-96 tjh Added more things ... including CA -si...
# converts a certificate to a request an...
# 10-Jan-96 eay Fixed a few more bugs and added the SS...
# environment variable so this can be dr...
# a script.
# 25-Jul-96 eay Cleaned up filenames some more.
# 11-Jun-96 eay Fixed a few filename missmatches.
# 03-May-96 eay Modified to use 'ssleay cmd' instead o...
# 18-Apr-96 tjh Original hacking
#
# Tim Hudson
# tjh@cryptsoft.com
#
# default openssl.cnf file has setup as per the following
# demoCA ... where everything is stored
DAYS="-days 4380"
REQ="/usr/bin/openssl req $SSLEAY_CONFIG"
CA="/usr/bin/openssl ca $SSLEAY_CONFIG"
VERIFY="openssl verify"
X509="openssl x509"
CATOP=./demoCA
CAKEY=./cakey.pem
CACERT=./cacert.pem
for i
do
case $i in
-\?|-h|-help)
echo "usage: CA -newcert|-newreq|-newca|-sign|-verify...
exit 0
;;
-newcert)
# create a certificate
$REQ -new -x509 -keyout newreq.pem -out newreq.pem $D...
RET=$?
echo "Certificate (and private key) is in newreq.pem"
;;
-newreq)
# create a certificate request
$REQ -new -keyout newreq.pem -out newreq.pem $DAYS
RET=$?
echo "Request (and private key) is in newreq.pem"
;;
-newca)
# if explicitly asked for or it doesn't exist then se...
# structure that Eric likes to manage things
NEW="1"
if [ "$NEW" -o ! -f ${CATOP}/serial ]; then
# create the directory hierarchy
mkdir ${CATOP}
mkdir ${CATOP}/certs
mkdir ${CATOP}/crl
mkdir ${CATOP}/newcerts
mkdir ${CATOP}/private
echo "01" > ${CATOP}/serial
touch ${CATOP}/index.txt
fi
if [ ! -f ${CATOP}/private/$CAKEY ]; then
echo "CA certificate filename (or enter to create)"
read FILE
# ask user for existing CA certificate
if [ "$FILE" ]; then
cp $FILE ${CATOP}/private/$CAKEY
RET=$?
else
echo "Making CA certificate ..."
$REQ -new -x509 -keyout ${CATOP}/private/$CAK...
-out ${CATOP}/$CACERT $DAYS
RET=$?
fi
fi
;;
-xsign)
$CA -policy policy_anything -infiles newreq.pem
RET=$?
;;
-sign|-signreq)
$CA -policy policy_anything -out newcert.pem -infiles...
RET=$?
cat newcert.pem
echo "Signed certificate is in newcert.pem"
;;
-signcert)
echo "Cert passphrase will be requested twice - bug?"
$X509 -x509toreq -in newreq.pem -signkey newreq.pem -...
$CA -policy policy_anything -out newcert.pem -infiles...
cat newcert.pem
echo "Signed certificate is in newcert.pem"
;;
-verify)
shift
if [ -z "$1" ]; then
$VERIFY -CAfile $CATOP/$CACERT newcert.pem
RET=$?
else
for j
do
$VERIFY -CAfile $CATOP/$CACERT $j
if [ $? != 0 ]; then
RET=$?
fi
done
fi
exit 0
;;
*)
echo "Unknown arg $i";
exit 1
;;
esac
done
exit $RET
</pre>
ページ名:
![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
