File: //proc/self/root/bin/turnkey-make-ssl-cert
#! /bin/bash -e
# ---------------------------------------------------------------------------
# turnkey-make-ssl-cert - "Make server cert for TurnKey GNU/Linux appliance"
# Copyright 2014,2015, John Carver <dude4linux@gmail.com>
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License at (http://www.gnu.org/licenses/) for
# more details.
# Usage: turnkey-make-ssl-cert [-h|--help] [-o|--out file] [-d|--default] [-w|--wild] [-t|--template file] [-i|--ip] [-v|--verbose] [-f|--force] [-r|--csr] FQDN .. [FQDN]
# Purpose:
# - Make default certificate for TurnKey GNU/Linux appliance [-d|--default]
#
# cat \
# /usr/local/share/ca-certificates/cert.crt \
# /etc/ssl/private/cert.key \
# /etc/ssl/private/dhparams.pem > /etc/ssl/private/cert.pem
#
# - Make server certificates for Apache/Nginx virtual hosts
# - Make wildcard certificate for one or more domains [-w|--wild]
# - Use sha256 and aes128 for additional security "Bulletproof SSL and TLS"
# - Use Subject Alternate Names (SAN) for host and domain names
# - Optionally generate a certificate signing request (csr)
# - Optionally include ip addresses in SAN list [-i|--ip]
# - Store keys in /etc/ssl/private for security
# - Follow Debian conventions and best practices
# Revision history:
# 2014-08-28 Created by new-script ver. 3.0
# 2014-09-12 Released tkl-make-ssl-cert ver. 1.0
# 2014-10-02 Released tkl-make-ssl-cert ver. 1.1
# 2015-08-06 Released turnkey-make-ssl-cert ver. 1.2
# 2017-03-06 Released turnkey-make-ssl-cert ver. 1.3
# ---------------------------------------------------------------------------
[[ $DEBUG != y ]] || set -x
PROGNAME=${0##*/}
VERSION="1.3"
# use extended globbing
shopt -s extglob
# set defaults
CERT_DIR="/usr/local/share/ca-certificates"
KEY_DIR="/etc/ssl/private"
TEMPLATE="/etc/ssl/turnkey.cnf"
DEFAULT=false
LE=false
IP=false
OUT=false
VERBOSE=false
REQUEST=false
WILD=false
OVERWRITE=false
EXPIRY=10y
GEN_DH=false
DH_ONLY=false
DH_BITS=${DH_BITS:-2048}
clean_up() { # Perform pre-exit housekeeping
[[ $DEBUG == y ]] || rm -f $TMPFILE $TMPOUT
}
info() { echo "INFO [$PROGNAME]: $@"; }
warning() { echo "WARNING [$PROGNAME]: $@" >&2 ; }
error_exit() {
echo -e ERROR [${PROGNAME}]: ${1:-"Unknown Error"} >&2
if [[ $2 ]] && [[ -f $2 ]]; then
cat $2 >&2
fi
clean_up
exit 1
}
graceful_exit() {
clean_up
exit
}
signal_exit() { # Handle trapped signals
case $1 in
INT) error_exit "Program interrupted by user";;
TERM) echo -e "\n$PROGNAME: Program terminated" >&2; graceful_exit;;
*) error_exit "Terminating on unknown signal";;
esac
}
usage() {
cat <<EOF
Usage: $PROGNAME [-o|--out file] [-t|--template file] [-i|--ip] [-v|--verbose] [-f|--force] FQDN .. [FQDN]
Generate a certificate/key pair using the list of FQDNs.
Usage: $PROGNAME [-d|--default] [-t|--template file] [-i|--ip] [-v|--verbose] [-f|--force]
Generate the default cert.crt, cert.key, dhparam.pem file and default cert.pem file; using the hostname.
Usage: $PROGNAME [-o|--out file] [-t|--template file] [-i|--ip] [-v|--verbose] [-f|--force] [-w|--wild] domainName .. [domainName]
Generate a wildcard certificate for the list of domains.
Usage: $PROGNAME [-d|--default] [-t|--template file] [-i|--ip] [-v|--verbose] [-f|--force] [-r|--csr] FQDN .. [FQDN]
Generate an optional certificate signing request for the list of FQDNs.
Usage: $PROGNAME -p|--dh-only
Generate just a new dhparam.pem file. Also rebuilds the default cerm.pem file with update DH params.
Usage: $PROGNAME [-h|--help]
Display the help message and exit.
EOF
return
}
help_message() {
cat <<EOF
$PROGNAME ver. $VERSION
"Make server cert for TurnKey GNU/Linux appliance"
$(usage)
Options:
-h|--help Display this help message and exit
-o|--out [/PATH/]FILE Write certificate to alternate location
-d|--default Generate default cert, key & dhparams files plus a
combined file /etc/ssl/private/cert.pem
-e|--expiry Set certificate expiry date
default: 10y
-p|--dh-only Generate a Diffie-Hellman parameters file only
(Also rebuilds default cert.pem file)
-r|--csr Generate a certificate signing request
-w|--wild Generate wildcard certificate
-t|--template FILE Use alternate template file
default: /etc/ssl/turnkey.cnf
-i|--ip Optionally include host ip addresses
-v|--verbose Display generated certificate
-f|--force Force overwrite of existing certificate files
--force-overwrite [Deprecated] Same as -f|--force
NOTE: You must be the superuser to run this script.
En vars:
DH_BITS Bit size of Diffie-Hellman parameters to use,
defaults to 2048 (recommended) although 3072
should work ok and not slow things down too much
Generally values of 4096 and higher are considered
overkill. Valid options are: 2048, 3072, 4096,
6144 and 8192.
DEBUG Verbose output (for debugging)
EOF
return
}
add_san() {
if [[ ! "$sans" =~ " $1 " ]]; then # skip duplicates
echo "DNS.$((n++)) = $1" >> $TMPFILE # add subject alternate name
sans+="$1 "
fi
}
add_ip() {
echo "IP.$((i++)) = $1" >> $TMPFILE
}
create_temporary_cnf() {
n=1; i=1; sans=" "
# remove alt_names from template
sed -e '/^\[\s*alt_names\s*\]/q' $TEMPLATE > $TMPFILE
if [[ $WILD == true ]]; then
[[ "$args" == "" ]] && args="$(hostname -Ad)"
for domain in $args; do
commonName=${commonName:-$domain}; # use first match
add_san "$domain"; # domain
add_san "*.$domain"; # wildcard
done
else
[[ "$args" == "" ]] && args="$(hostname -A)"
[[ "$args" == "" ]] && args="$(hostname)"
for fqdn in $args; do
commonName=${commonName:-$fqdn} # use first match
add_san "$fqdn" # fqdn
add_san "${fqdn#*.}" # domain
add_san "${fqdn%%.*}" # host
done
fi
if [[ $IP == true ]]; then
for addr in $(hostname -I) '127.0.0.1'; do
add_san "$addr"; add_ip "$addr"
done
fi
# truncate common name if it's too long for openssl
if [[ "${#commonName}" -gt 18 ]]; then
commonName="${commonName:0:18}"
fi
sed -i "s#@HostName@#\"$commonName\"#" $TMPFILE
}
expiry_days() {
num="${1//[dmy]}"
case $num in
'')
error_exit "Expiry date not set"
;;
*[!0-9]*)
error_exit "Expiry can only be digits (with d|m|y suffix) got: $1"
;;
esac
interval="${1//[0-9]}"
case "$interval" in
y) days=$((($(date -d "+$number year" +%s) - $(date +%s))/86400));;
m) days=$((($(date -d "+$number month" +%s) - $(date +%s))/86400));;
d) days=$((($(date -d "+$number day" +%s) - $(date +%s))/86400));;
*) error_exit "Expiry $interval not recognised.";;
esac
if [[ "$days" -lt 1 ]] || [[ "$days" -gt 10957 ]]; then
error_exit "Expiry must be between 1 day (1d) and 30 years (10957d)"
fi
}
# Trap signals
trap "signal_exit TERM" TERM HUP
trap "signal_exit INT" INT
# Parse command-line
while [[ -n $1 ]]; do
case $1 in
-h|--help) help_message; graceful_exit;;
-o|--out) shift; CERT="$1"; OUT=true;;
-d|--default) DEFAULT=true; GEN_DH=true;;
-e|--expiry) shift; EXPIRY="$1";;
-p|--dh-only) DH_ONLY=true; GEN_DH=true;;
-r|--csr) REQUEST=true;;
-w|--wild) WILD=true;;
-t|--template) shift; TEMPLATE="$1";;
-i|--ip) IP=true;;
-v|--verbose) VERBOSE=true;;
--force-overwrite)
warning "Use of --force-overwrite is deprecated, use"\
" -f|--force instead"
OVERWRITE=true;;
-f|--force) OVERWRITE=true;;
-*|--*) usage; error_exit "Unknown option $1";;
*) args+="$1 ";;
esac
shift
done
if [[ $DH_ONLY == true ]]; then
warning "--dh-only switch used, no cert or key files will be generated."
fi
expiry_days $EXPIRY
# Check for root UID
if [[ $(id -u) != 0 ]]; then
error_exit "You must be the superuser to run this script."
fi
# Template file must exist
if [[ ! -f $TEMPLATE ]]; then
error_exit "Could not open template file: $TEMPLATE"
fi
## Main logic ##
TMPFILE="$(mktemp)" || error_exit "Can't create temporary file"
TMPOUT="$(mktemp)" || error_exit "Can't create temporary file"
create_temporary_cnf
# assign file names
DHP="$KEY_DIR/dhparams.pem"
if [[ $DEFAULT == true ]] || [[ $DH_ONLY == true ]]; then
OUT=false # ignore output file
CERT="$CERT_DIR/cert.crt"
KEY="$KEY_DIR/cert.key"
CSR="$KEY_DIR/cert.csr"
elif [[ $OUT == false ]]; then
CERT="$CERT_DIR/$commonName.crt"
KEY="$KEY_DIR/$commonName.key"
CSR="$KEY_DIR/$commonName.csr"
else
# ensure user input cert name has extension pem or crt
shopt -s nocasematch
[[ ${CERT##*.} =~ (pem|crt) ]] || CERT+=".crt"
shopt -u nocasematch
KEY="${CERT%.*}.key"
CSR="${CERT%.*}.csr"
fi
# don't overwrite existing key and/or cert files without permission
if [[ -f $CERT ]] || [[ -f $KEY ]]; then
# except when only generating dhparams
if [[ $OVERWRITE == false ]] && [[ $DH_ONLY == false ]]; then
error_exit "Output file(s) already exists: $CERT &/or $KEY"
fi
fi
# don't generate dhparams only unless cert & key both exist
if [[ ! -f $CERT ]] && [[ ! -f $KEY ]] && [[ $DH_ONLY == true ]]; then
msg="One of $CERT & $KEY files is missing, won't be able to rebuild
combined cert.pem file. Please rerun with different options."
error_exit "$msg"
fi
# create the key and certificate.
if [[ $DH_ONLY == false ]]; then
info "Generating certificate and key files."
if ! openssl req -sha256 -config $TMPFILE -new -x509 -days $days \
-nodes -out $CERT -keyout $KEY > $TMPOUT 2>&1; then
error_exit "Could not create certificate. Openssl output was:" $TMPOUT
fi
fi
# gen dhparams.
if [[ "$GEN_DH" == "true" ]]; then
msg="Generating Diffie-Hellman parameters file - using predifined"
msg="$msg parameters as per RFC7919."
info "$msg"
if ! openssl genpkey -genparam -algorithm DH \
-pkeyopt dh_param:ffdhe$DH_BITS -out $DHP \
-outform PEM > $TMPOUT 2>&1; then
msg="Diffie-Hellman parameter generation failed. OpenSSL output: "
error_exit "$msg" $TMPOUT
fi
fi
# set file permissions
chmod 400 "$KEY"
chmod 644 "$CERT"
chmod 400 "$DHP"
# create default cert.pem file, including dhparams
if [[ $DEFAULT == true ]] || [[ $DH_ONLY == true ]]; then
cat "$CERT" "$KEY" "$DHP" > "$KEY_DIR/cert.pem"
chmod 400 "$KEY_DIR/cert.pem"
fi
# create the certificate signing request.
if [[ $REQUEST == true ]]; then
# warn if organizationName is "TurnKey GNU/Linux"
if [[ $(grep '^organizationName\s*=\s*"TurnKey GNU/Linux"' $TEMPLATE) ]]; then
cat >&2 <<EOF
WARNING [${PROGNAME}]: organizationName = "TurnKey GNU/Linux"
Unless you work for TurnKey, you probably want to edit the
template file, /etc/ssl/turnkey.cnf or create a custom copy
and use the [-t|--template] option.
EOF
fi
# create the certificate signing request.
if ! openssl req -sha256 -config $TMPFILE -new -key $KEY -out $CSR \
> $TMPOUT 2>&1; then
error_exit "Could not create CSR. Openssl output was:" $TMPOUT
fi
chmod 600 $CSR
fi
# rehash symlinks in /etc/ssl/certs
if [[ $OUT == false ]]; then
update-ca-certificates
fi
# handle verbose
if [[ $VERBOSE == true ]]; then
# display the certificate
openssl x509 -noout -text -in $CERT
if [[ $REQUEST == true ]]; then
# display the certificate signing request.
openssl req -noout -text -in $CSR
fi
fi
clean_up
graceful_exit