csit/libraries/tls/gen-certs.sh

   1 #!/usr/bin/env bash
   2
   3 CA_KEY="ca.key"
   4 CA_CERT="ca.crt"
   5
   6 SWITCH_KEY="switch.key"
   7 SWITCH_CERT="switch.crt"
   8 SWITCH_CACHAIN="cachain.crt"
   9
  10 CONTROLLER_KEY="controller.key"
  11 CONTROLLER_CERT="controller.crt"
  12 CONTROLLER_KEYSTORE="keystore.p12"
  13 CONTROLLER_TRUSTSTORE="truststore.p12"
  14
  15 OPENSSL_CONFIG="openssl.conf"
  16 CA_INDEX="index.txt"
  17 CERT_SERIAL="serial"
  18
  19 VALID_DAYS="1825" # 5 years
  20 PASSWORD="opendaylight"
  21 CA_KEY_LEN="4096"
  22 CLIENT_KEY_LEN="2048"
  23
  24 WORKDIR="./cert-tmp"
  25 CERT_FILES_SAVED=(
  26     "$SWITCH_KEY"
  27     "$SWITCH_CERT"
  28     "$SWITCH_CACHAIN"
  29     "$CONTROLLER_KEYSTORE"
  30     "$CONTROLLER_TRUSTSTORE"
  31 )
  32
  33 function prep_cert_gen() {
  34     rm -rf "$WORKDIR"
  35     rm -f "${CERT_FILES_SAVED[@]}"
  36     mkdir -p "$WORKDIR"
  37 }
  38
  39 function post_cleanup() {
  40     for i in "${CERT_FILES_SAVED[@]}"; do
  41         cp -p "$WORKDIR/$i" .
  42     done
  43     rm -rf "$WORKDIR"
  44 }
  45
  46 function create_openssl_config() {
  47     touch "$CA_INDEX"
  48     echo 1000 >"$CERT_SERIAL"
  49     cat <<EOF >"$OPENSSL_CONFIG"
  50 [ ca ]
  51 default_ca = CA_default
  52
  53 [ CA_default ]
  54 new_certs_dir     = .
  55 database          = $CA_INDEX
  56 serial            = $CERT_SERIAL
  57 private_key       = $CA_KEY
  58 certificate       = $CA_CERT
  59 policy            = policy_loose
  60 default_md        = sha256
  61
  62 [ policy_loose ]
  63 countryName             = optional
  64 stateOrProvinceName     = optional
  65 localityName            = optional
  66 organizationName        = optional
  67 organizationalUnitName  = optional
  68 commonName              = supplied
  69 emailAddress            = optional
  70
  71 [ req ]
  72 default_bits        = 2048
  73 distinguished_name  = req_distinguished_name
  74 string_mask         = utf8only
  75 default_md          = sha256
  76
  77 [ req_distinguished_name ]
  78 countryName                     = Country Name (2 letter code)
  79 stateOrProvinceName             = State or Province Name
  80 localityName                    = Locality Name
  81 0.organizationName              = Organization Name
  82 organizationalUnitName          = Organizational Unit Name
  83 commonName                      = Common Name
  84 emailAddress                    = Email Address
  85
  86 [ ca_cert ]
  87 subjectKeyIdentifier = hash
  88 authorityKeyIdentifier = keyid:always,issuer
  89 basicConstraints = critical, CA:true
  90 keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  91
  92 [ client_cert ]
  93 basicConstraints = CA:FALSE
  94 subjectKeyIdentifier = hash
  95 authorityKeyIdentifier = keyid,issuer:always
  96 keyUsage = critical, digitalSignature, keyEncipherment
  97 extendedKeyUsage = serverAuth, clientAuth
  98 EOF
  99 }
 100
 101 function gen_ca() {
 102     echo -e "\\nGenerate CA Key & Certificate"
 103     echo -e "-----------------------------"
 104
 105     echo -e "\\n> Root: Key & Self-Signed Certificate"
 106     openssl req \
 107         -config "$OPENSSL_CONFIG" \
 108         -new \
 109         -newkey rsa:"$CA_KEY_LEN" \
 110         -x509 \
 111         -nodes \
 112         -extensions ca_cert \
 113         -subj "/C=US/ST=California/L=San Jose/O=Verizon/CN=Root CA" \
 114         -days "$VALID_DAYS" \
 115         -keyout "$CA_KEY" \
 116         -out "$CA_CERT"
 117
 118     chmod 0600 "$CA_KEY"
 119     chmod 0644 "$CA_CERT"
 120 }
 121
 122 function gen_signed_cert() {
 123     local client="$1"
 124     local client_key="$2"
 125     local client_cert="$3"
 126     local client_csr
 127
 128     client_csr="$(tr '[:upper:]' '[:lower:]' <<<"$client").csr"
 129
 130     echo -e "\\n> $client: CSR\\n"
 131     openssl req \
 132         -config "$OPENSSL_CONFIG" \
 133         -new \
 134         -newkey rsa:"$CLIENT_KEY_LEN" \
 135         -nodes \
 136         -subj "/C=US/ST=California/L=San Jose/O=Verizon/CN=$client" \
 137         -keyout "$client_key" \
 138         -out "$client_csr"
 139
 140     echo -e "\\n> $client: Certificate\\n"
 141     openssl ca \
 142         -batch \
 143         -config "$OPENSSL_CONFIG" \
 144         -extensions client_cert \
 145         -notext \
 146         -days "$VALID_DAYS" \
 147         -in "$client_csr" \
 148         -out "$client_cert"
 149
 150     chmod 0600 "$client_key"
 151     chmod 0644 "$client_cert"
 152 }
 153
 154 function gen_keystore() {
 155     local client="$1"
 156     local client_key="$2"
 157     local client_cert="$3"
 158     local client_keystore="$4"
 159
 160     echo -e "\\n> $client: Keystore"
 161     openssl pkcs12 \
 162         -export \
 163         -in "$client_cert" \
 164         -inkey "$client_key" \
 165         -certfile "$CA_CERT" \
 166         -passout "pass:$PASSWORD" \
 167         -out "$client_keystore" \
 168         -name "$client"
 169
 170     chmod 0600 "$client_keystore"
 171 }
 172
 173 function gen_truststore() {
 174     local client="$1"
 175     local client_truststore="$2"
 176
 177     echo -e "\\n> $client: Truststore"
 178     keytool -importcert \
 179         -noprompt \
 180         -file "$CA_CERT" \
 181         -storetype PKCS12 \
 182         -trustcacerts \
 183         -alias "rootca" \
 184         -keystore "$client_truststore" \
 185         -storepass "$PASSWORD"
 186
 187     chmod 0644 "$client_truststore"
 188 }
 189
 190 function gen_switch() {
 191     echo -e "\\nGenerate Switch Key & Certificate"
 192     echo -e "---------------------------------"
 193     gen_signed_cert "Switch" "$SWITCH_KEY" "$SWITCH_CERT"
 194     cp -p "$CA_CERT" "$SWITCH_CACHAIN"
 195 }
 196
 197 function gen_controller() {
 198     echo -e "\\nGenerate Controller Keystore & Truststore"
 199     echo -e "-----------------------------------------"
 200     gen_signed_cert "Controller" "$CONTROLLER_KEY" "$CONTROLLER_CERT"
 201     gen_keystore "Controller" "$CONTROLLER_KEY" "$CONTROLLER_CERT" "$CONTROLLER_KEYSTORE"
 202     gen_truststore "Controller" "$CONTROLLER_TRUSTSTORE"
 203 }
 204
 205 function run() {
 206     prep_cert_gen
 207     (
 208         cd "$WORKDIR" || exit 1
 209         create_openssl_config
 210         gen_ca
 211         gen_switch
 212         gen_controller
 213     )
 214     post_cleanup
 215 }
 216
 217 run