mrcharles
2eca50490d
Split per O&M lane work order. Full history: KNEL/PFVCluster. https://projects.knownelement.com/issues/769#note-4152
37 lines
1.6 KiB
Bash
37 lines
1.6 KiB
Bash
#!/bin/bash
|
|
#
|
|
# issue-cert.sh — issue a leaf certificate from the fleet intermediate [#697]
|
|
# Usage: issue-cert.sh <common-name> "SAN list" e.g.
|
|
# issue-cert.sh tsys-wazuh.knel.net "DNS:tsys-wazuh.knel.net,DNS:tsys-siem.knel.net"
|
|
# Requires: intermediate initialized at /etc/ssl/tsys-ca (ca-init.sh).
|
|
# Output: <certs>/<cn>.crt (leaf+chain) + <certs>/<cn>.key (0600) on this host.
|
|
#
|
|
set -euo pipefail
|
|
|
|
CN="${1:?usage: issue-cert.sh <common-name> \"SAN list\"}"
|
|
SAN="${2:?usage: issue-cert.sh <common-name> \"SAN list\"}"
|
|
INT_DIR="${INT_DIR:-/etc/ssl/tsys-ca}"
|
|
INT_KEY="$INT_DIR/intermediate.key"
|
|
INT_CRT="$INT_DIR/intermediate.crt"
|
|
CHAIN="$INT_DIR/ca-chain.crt"
|
|
|
|
[ -s "$INT_CRT" ] || { echo "intermediate missing at $INT_CRT — run ca-init.sh first" >&2; exit 1; }
|
|
[ -s "$INT_KEY" ] || { echo "intermediate key missing" >&2; exit 1; }
|
|
|
|
KEY="$INT_DIR/certs/$CN.key"
|
|
CSR="$INT_DIR/csr/$CN.csr"
|
|
CRT="$INT_DIR/certs/$CN.crt"
|
|
[ -e "$CRT" ] && { echo "cert already exists: $CRT (revoke/rename first)" >&2; exit 1; }
|
|
|
|
openssl genrsa -out "$KEY" 2048 2>/dev/null
|
|
chmod 600 "$KEY"
|
|
openssl req -new -key "$KEY" -out "$CSR" -sha256 \
|
|
-subj "/C=US/ST=Texas/O=Known Element Enterprises/OU=TechOps/CN=$CN"
|
|
openssl x509 -req -in "$CSR" -CA "$INT_CRT" -CAkey "$INT_KEY" \
|
|
-CAcreateserial -days 825 -sha256 -out "$CRT" \
|
|
-extfile <(printf 'basicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth,clientAuth\nsubjectAltName=%s\nauthorityKeyIdentifier=keyid,issuer\n' "$SAN")
|
|
|
|
cat "$CRT" "$CHAIN" > "$INT_DIR/certs/$CN.fullchain"
|
|
openssl verify -CAfile "$CHAIN" "$CRT"
|
|
echo "issued: $CRT (+ .key, .csr, .fullchain)"
|