73 lines
2.0 KiB
Bash
Executable File
73 lines
2.0 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
PKI_ROOT=/etc/lisglosips/pki
|
|
CA_DIR="$PKI_ROOT/ca"
|
|
CERT_DIR="$PKI_ROOT/certs"
|
|
PRIVATE_DIR="$PKI_ROOT/private"
|
|
HOST_NAME=${HOST_NAME:-yanzi}
|
|
TAILSCALE_IP=${TAILSCALE_IP:-100.90.90.91}
|
|
|
|
umask 077
|
|
install -d -m 0700 "$CA_DIR"
|
|
install -d -m 0755 "$CERT_DIR"
|
|
install -d -m 0700 "$PRIVATE_DIR"
|
|
|
|
if [ ! -s "$CA_DIR/lisglosips-dev-ca.key" ] || [ ! -s "$CA_DIR/lisglosips-dev-ca.crt" ]; then
|
|
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
|
|
-subj '/CN=LisgloSIPS Development CA/O=LisgloSIPS' \
|
|
-keyout "$CA_DIR/lisglosips-dev-ca.key" \
|
|
-out "$CA_DIR/lisglosips-dev-ca.crt"
|
|
fi
|
|
|
|
cat >"$PKI_ROOT/server-cert.cnf" <<EOF
|
|
[req]
|
|
prompt = no
|
|
distinguished_name = dn
|
|
req_extensions = req_ext
|
|
|
|
[dn]
|
|
CN = lisglosips.local
|
|
O = LisgloSIPS
|
|
|
|
[req_ext]
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
DNS.1 = lisglosips.local
|
|
DNS.2 = $HOST_NAME
|
|
DNS.3 = grafana.lisglosips.local
|
|
DNS.4 = homer.lisglosips.local
|
|
IP.1 = $TAILSCALE_IP
|
|
IP.2 = 127.0.0.1
|
|
|
|
[server_ext]
|
|
basicConstraints = critical,CA:FALSE
|
|
keyUsage = critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
subjectAltName = @alt_names
|
|
EOF
|
|
|
|
openssl req -new -newkey rsa:3072 -nodes -sha256 \
|
|
-config "$PKI_ROOT/server-cert.cnf" \
|
|
-keyout "$PRIVATE_DIR/server.key" \
|
|
-out "$PKI_ROOT/server.csr"
|
|
|
|
openssl x509 -req -sha256 -days 397 \
|
|
-in "$PKI_ROOT/server.csr" \
|
|
-CA "$CA_DIR/lisglosips-dev-ca.crt" \
|
|
-CAkey "$CA_DIR/lisglosips-dev-ca.key" \
|
|
-CAcreateserial \
|
|
-extfile "$PKI_ROOT/server-cert.cnf" \
|
|
-extensions server_ext \
|
|
-out "$CERT_DIR/server.crt"
|
|
|
|
chown root:root "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
|
|
chown root:www-data "$PRIVATE_DIR/server.key"
|
|
chown root:root "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
|
|
chmod 0600 "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
|
|
chmod 0640 "$PRIVATE_DIR/server.key"
|
|
chmod 0644 "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
|
|
|
|
openssl verify -CAfile "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
|