mkcert

#!/usr/bin/env bash
#
# Copyright (c) 2020 Gareth Palmer <gareth.palmer3@gmail.com>
# This program is free software, distributed under the terms of
# the GNU General Public License Version 2.

set -o errexit
set -o pipefail
set -o nounset
shopt -s extglob

OPTIONS=$(getopt -n "${0##*/}" -o "c:o:u:l:s:C:b:E:y:d:f:H" \
    -l "common:,organization:,unit:,locality:,state:,country:,bits:,key-size:,curve:,years:,digest:,output:,help" -- "$@")

if [[ $? -ne 0 ]]; then
    echo "Try '${0##*/} --help' for more information"
    exit 1
fi

eval set -- "$OPTIONS"

COMMON_NAME=""
ORGANIZATION=""
ORGANIZATIONAL_UNIT=""
LOCALITY=""
STATE=""
COUNTRY=""
KEY_SIZE="2048"
CURVE=""
YEARS="10"
DIGEST="sha256"
OUTPUT_FILE=""

while [[ -n $1 ]]; do
    OPTION="$1"
    shift 1

    case "$OPTION" in
    -c|--common)
        COMMON_NAME="$1"
        shift 1
        ;;
    -o|--organization)
        ORGANIZATION="$1"
        shift 1
        ;;
    -u|--unit)
        ORGANIZATIONAL_UNIT="$1"
        shift 1
        ;;
    -l|--locality)
        LOCALITY="$1"
        shift 1
        ;;
    -s|--state)
        STATE="$1"
        shift 1
        ;;
    -C|--country)
        COUNTRY="${1^^[A-Z]}"
        shift 1

        if [[ ! $COUNTRY =~ ^[A-Z]{2}$ ]]; then
            echo "Invalid country: $COUNTRY" >&2
            exit 1
        fi
        ;;
    -b|--bits|--key-size)
        KEY_SIZE="$1"
        shift 1

        if [[ ! $KEY_SIZE =~ ^[0-9]+$ || $KEY_SIZE -lt 512 || $KEY_SIZE -gt 4096 ]]; then
            echo "Invalid bits: $KEY_SIZE" >&2
            exit 1
        fi
        ;;
    -E|--curve)
        CURVE="$1"
        shift 1

        if ! openssl ecparam -name "$CURVE" -noout 2> /dev/null; then
            echo "Invalid curve: $CURVE" >&2
            exit 1
        fi
        ;;
    -y|--years)
        YEARS="$1"
        shift 1

        if [[ ! $YEARS =~ ^[0-9]+$ || $YEARS -lt 1 ]]; then
            echo "Invalid years: $YEARS" >&2
            exit 1
        fi
        ;;
    -d|--digest)
        DIGEST="$1"
        shift 1

        if [[ $DIGEST != @(sha1|sha256|sha512) ]]; then
            echo "Invaid digest: $DIGEST" >&2
            exit 1
        fi
        ;;
    -f|--file)
        OUTPUT_FILE="$1"
        shift 1
        ;;
    -H|--help)
        echo "Usage: ${0##*/} [OPTIONS] [FILE]"
        echo "Create a self-signed X509 certificate."
        echo ""
        echo "  -c, --common COMMON-NAME           common name, required"
        echo "  -o, --organization ORGANIZATION    organization, required"
        echo "  -u, --unit UNIT                    organizational unit, required"
        echo "  -l, --locality LOCALITY            locality"
        echo "  -s, --state STATE                  state or province"
        echo "  -C, --country COUNTRY              country code"
        echo "  -y, --years NUMBER                 number of years to sign the certificate (default 10)"
        echo "  -b, --bits, --key-size BITS        RSA key-size (default 2048)"
        echo "  -E, --curve CURVE                  EC name (secp256r1, secpr384r1 or secp512r1)"
        echo "  -d, --digest DIGEST                message digest to use: sha1, sha256 or sha512 (default sha256)"
        echo "  -f, --file FILE                    output file (default COMMON-NAME.pem)"
        echo "  -h, --help                         print this help and exit"
        echo ""

        exit 0
        ;;
    --)
        break
        ;;
    esac
done

if [[ -z $COMMON_NAME ]]; then
    echo "No common name specified" >&2
    exit 1
fi

if [[ -z $ORGANIZATION ]]; then
    echo "No organization specified" >&2
    exit 1
fi

if [[ -z $ORGANIZATIONAL_UNIT ]]; then
    echo "No organizational unit specified" >&2
    exit 1
fi

if [[ -z $OUTPUT_FILE ]]; then
    OUTPUT_FILE="${1:-}"

    if [[ -z $OUTPUT_FILE ]]; then
        OUTPUT_FILE="${COMMON_NAME//[^a-zA-Z0-9-]/_}.pem"
    fi
fi

START_DATE=$(date -u -d "now" +"%Y%m%d000000Z")
END_DATE=$(date -u -d "now + $YEARS years" +"%Y%m%d000000Z")

TEMP_DIR=$(mktemp -d /tmp/mkcert-XXXXXXXX) || exit 1

trap "rm -rf $TEMP_DIR" EXIT
touch "$TEMP_DIR/random" "$TEMP_DIR/database.txt" "$TEMP_DIR/database.txt.attr"

SERIAL_NUMBER=$(openssl rand -hex 16)
echo "$SERIAL_NUMBER" > "$TEMP_DIR/serial.txt"

cat >> "$TEMP_DIR/openssl.cnf" <<EOF
[ca]
default_ca = default_ca

[default_ca]
new_certs_dir = $TEMP_DIR
database = $TEMP_DIR/database.txt
serial = $TEMP_DIR/serial.txt
default_startdate = $START_DATE
default_enddate = $END_DATE
default_md = $DIGEST
certificate = $TEMP_DIR/crt.pem
private_key = $TEMP_DIR/key.pem
x509_extensions = x509_extensions
policy = policy
copy_extensions = none
email_in_dn = yes
preserve = no
unique_subject = no

[policy]
commonName = supplied
organizationName = supplied
organizationalUnitName = supplied
localityName = optional
stateOrProvinceName = optional
countryName = optional

[req]
distinguished_name = distinguished_name
req_extensions = x509_extensions
default_md = $DIGEST
prompt = no

[distinguished_name]
commonName = $COMMON_NAME
organizationName = $ORGANIZATION
organizationalUnitName = $ORGANIZATIONAL_UNIT
${LOCALITY:+localityName = $LOCALITY}
${STATE:+stateOrProvinceName = $STATE}
${COUNTRY:+countryName = $COUNTRY}

[x509_extensions]
basicConstraints = critical, CA:true, pathlen:0
keyUsage = Certificate Sign, CRL Sign, Digital Signature, Key Encipherment, Data Encipherment
extendedKeyUsage = TLS Web Server Authentication, TLS Web Client Authentication, IPSec End System
subjectKeyIdentifier = hash
subjectAltName = DNS:${COMMON_NAME,,}
EOF

if [[ -n $CURVE ]]; then
    if ! openssl ecparam -name "$CURVE" -genkey -noout \
         -out "$TEMP_DIR/key.pem" 2> /dev/null; then
        echo "Error while generating EC key" >&2
        exit 1
    fi
else
    if ! openssl genrsa -out "$TEMP_DIR/key.pem" "$KEY_SIZE" 2> /dev/null; then
        echo "Error while generating RSA key" >&2
        exit 1
    fi
fi

if ! openssl req -config "$TEMP_DIR/openssl.cnf" -new -batch \
     -key "$TEMP_DIR/key.pem" -out "$TEMP_DIR/req.pem"; then
    echo "Error while creating signing request" >&2
    exit 1
fi

if ! openssl ca -config "$TEMP_DIR/openssl.cnf" -notext -selfsign -batch \
     -in "$TEMP_DIR/req.pem" -out "$TEMP_DIR/crt.pem" 2> /dev/null; then
    echo "Error while signing CA certificate" >&2
    exit 1
fi

cat "$TEMP_DIR/key.pem" "$TEMP_DIR/crt.pem" > "$OUTPUT_FILE"
echo "New certificate and private-key saved in $OUTPUT_FILE"

exit 0