From 4c703e69ae0cde46d807de8f6d23b9f2a53a08fe Mon Sep 17 00:00:00 2001 From: John Steel Date: Mon, 28 Sep 2020 08:26:20 -0400 Subject: [PATCH] Container SSL README.md changed to create_ca_and_ee.sh (#559) * Rename README.md README.md wasn't actually a readme but an example for how to make a simple pki. * Updating ssl script + Adding shebang line (#!/usr/bin/env bash) + Adding variables for key type and subject + Adding comments + Adding openssl verify --- containers/ssl/README.md | 4 ---- containers/ssl/create_ca_and_ee.sh | 18 ++++++++++++++++++ 2 files changed, 18 insertions(+), 4 deletions(-) delete mode 100644 containers/ssl/README.md create mode 100755 containers/ssl/create_ca_and_ee.sh diff --git a/containers/ssl/README.md b/containers/ssl/README.md deleted file mode 100644 index 3fc75db..0000000 --- a/containers/ssl/README.md +++ /dev/null @@ -1,4 +0,0 @@ -openssl req -x509 -nodes -new -sha256 -days 1024 -newkey rsa:2048 -keyout RootCA.key -out RootCA.pem -subj "/C=US/CN=Root-CA" -openssl x509 -outform pem -in RootCA.pem -out RootCA.crt -openssl req -new -nodes -newkey rsa:2048 -keyout lesspass.key -out lesspass.csr -subj "/C=FR/ST=Gironde/L=Bordeaux/O=LessPass/CN=lesspass.local" -openssl x509 -req -sha256 -days 1024 -in lesspass.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -extfile domains.ext -out lesspass.crt \ No newline at end of file diff --git a/containers/ssl/create_ca_and_ee.sh b/containers/ssl/create_ca_and_ee.sh new file mode 100755 index 0000000..b8304b7 --- /dev/null +++ b/containers/ssl/create_ca_and_ee.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +# This script will create a custom Certificate Authority (CA) and End Entity (EE) certificates. +# +# for local development this should be fine and you can ignore certificate trust errors related to +# an untrusted root. For public facing access, you can submit the generated lesspass.csr to a trusted +# ca so that they can provide you with a trusted certificate to replace this development certificate. + +CA_CRT_SUBJ="${CA_CRT_SUBJ:-/C=US/CN=Root-CA}" +CA_KEY_TYPE="${CA_KEY_TYPE:-rsa:2048}" +EE_CRT_SUBJ="${EE_CRT_SUBJ:-/C=FR/ST=Gironde/L=Bordeaux/O=LessPass/CN=lesspass.local}" +EE_KEY_TYPE="${EE_KEY_TYPE:-${CA_KEY_TYPE}}" + +openssl req -x509 -nodes -new -sha256 -days 1024 -newkey "$CA_KEY_TYPE" -keyout RootCA.key -out RootCA.pem -subj "$CA_CRT_SUBJ" +openssl x509 -outform pem -in RootCA.pem -out RootCA.crt +openssl req -new -nodes -newkey "$EE_KEY_TYPE" -keyout lesspass.key -out lesspass.csr -subj "$EE_CRT_SUBJ" +openssl x509 -req -sha256 -days 1024 -in lesspass.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -extfile domains.ext -out lesspass.crt + +openssl verify -verbose -CAfile RootCA.crt RootCA.crt lesspass.crt