openssl-helper-functions.sh (5307B)
1 #!/bin/bash 2 3 # OpenSSL reference and helper functions for dealing with certificates. 4 5 # Source this in the terminal (`. openssl-helper-functions.sh`) and run the functions 6 # as desired, or for dev purposes, run `bash openssl-helper-functions.sh runall` to 7 # generate a new CA and signed server certificates. 8 9 10 # This is pretty much just to demonstrate all of the functions below 11 function run_all_cert_functions() { 12 generate_ca ca 13 generate_private_key localhost 14 generate_csr localhost 15 sign_csr ca localhost 16 bundle_certs ca localhost 17 } 18 19 function generate_key_and_cert() { 20 ca=$1 21 server=$2 22 generate_private_key $server 23 generate_csr $server 24 sign_csr $ca $server 25 bundle_certs $ca $server 26 } 27 28 29 # Generate CA 30 # Key is stored in $1.key, and self-signed certificate in $1.pem 31 function generate_ca() { 32 name=$1 33 openssl genrsa -out $name.key 2048 34 openssl req -new -x509 \ 35 -key $name.key \ 36 -out $name.pem \ 37 -days 18000 \ 38 -subj "/C=NO/ST=Viken/L=Drammen" 39 } 40 41 # Generate new private key 42 # Saved to $1.key 43 function generate_private_key() { 44 name=$1 45 openssl genrsa -out $name.key 2048 46 } 47 48 # Generate Certificate Signing Request 49 # Assumes that $1.key exists in the working directory 50 function generate_csr() { 51 name=$1 52 subject="/C=NO/ST=Viken/L=Drammen/CN=$1" 53 openssl req -new \ 54 -key $name.key \ 55 -out $name.csr \ 56 -subj "$subject" 57 } 58 59 # Sign the certificate 60 # $1 = CA name, $2 = Server / client name 61 # Assumes that all files, i.e. CSR, CA cert and key, exist in the working directory 62 function sign_csr() { 63 ca=$1 64 server=$2 65 openssl x509 -req \ 66 -days 3600 \ 67 -CA $ca.pem \ 68 -CAkey $ca.key \ 69 -CAcreateserial \ 70 -in $server.csr \ 71 -out $server.pem \ 72 # CSR shouldn't be needed again, *I think*: 73 rm $server.csr 74 } 75 76 # Bundle certificates with key in PKCS12 format 77 # $1 = CA name, $2 = Server / client name 78 # Userful in Java code, among other things 79 function bundle_certs() { 80 ca=$1 81 server=$2 82 echo "Please enter password for .p12 file" 83 echo "This is the password you will probably use in your Java code" 84 openssl pkcs12 -export \ 85 -certfile $ca.pem \ 86 -in $server.pem \ 87 -inkey $server.key \ 88 -out $server.p12 89 } 90 91 function get_server_cert() { 92 server=$1 93 output=$2 94 openssl s_client -connect $server -showcerts 2>/dev/null </dev/null > $output 95 } 96 97 function ks_list() { 98 keystore=$1 99 keytool -list -keystore $keystore 100 } 101 102 # Extract PEM from a Java keystore entry 103 function ks_alias_to_pem() { 104 keystore=$1 105 alias=$2 106 keytool -exportcert \ 107 -keystore $keystore \ 108 -alias $alias | openssl x509 -inform der -text > $alias.pem 109 } 110 111 # (untested) 112 # Convert entire Java keystore to PEM file with all keys and certificates 113 function ks_to_pem() { 114 keystore=$1 115 target=$2 116 # Convert JKS to PKCS12 117 keytool -importkeystore -srckeystore $keystore \ 118 -destkeystore $target.p12 \ 119 -srcstoretype jks \ 120 -deststoretype pkcs12 121 p12_to_pem $target.p12 122 } 123 124 125 function pem_to_p12_cert() { 126 if [ -z "$1" ]; then 127 echo "pem_to_p12_cert:" 128 echo "Converts PEM certificate file to a PKCS12 file." 129 echo "Most relevant for creating a .p12 truststore with the certificates." 130 echo "Usage:" 131 echo " pem_to_p12_cert <pem file>" 132 return 133 fi 134 pem_file=$1 135 pkcs_file=$pem_file.p12 136 openssl pkcs12 -export -nokeys -in $pem_file -out $pkcs_file 137 } 138 139 function p12_to_pem() { 140 if [ -z "$1" ]; then 141 echo "p12_to_pem:" 142 echo "Converts PKCS12 file to a single textual PEM file." 143 echo "Generated file is named <pkcs_file>.pem" 144 echo "If there are any keys in the PKCS file, they will stay encrypted." 145 echo "Usage:" 146 echo " p12_to_pem <pkcs_file>" 147 return 148 fi 149 pkcs_file=$1 150 pem_file=$1.pem # <-- TODO: improve 151 # Create PEM with all info from P12 152 openssl pkcs12 -in $pkcs_file -out $pem_file -nodes 153 } 154 155 function p12_extract_cert() { 156 pkcs_file=$1 157 cert_file=$1.crt 158 # Convert PKCS12 to PEM *without encryption (omit -nodes to encrypt) 159 openssl pkcs12 -in $pkcs_file -out $cert_file -nodes -nokeys 160 } 161 162 function p12_extract_rsa_key() { 163 if [ -z "$1" ]; then 164 echo "p12_extract_rsa_key:" 165 echo "Extracts and decrypts an RSA key from a PKCS12 formatted file" 166 echo "Generated file is named <pkcs_file>.key" 167 echo "Usage:" 168 echo " p12_extract_rsa_key <pkcs_file>" 169 echo 170 return 171 fi 172 pkcs_file=$1 173 key_file=$1.key 174 openssl pkcs12 -in $pkcs_file -nodes -nocerts | openssl rsa -out $key_file 175 } 176 177 function verify_signed_cert() { 178 if [ -z "$2" ]; then 179 echo "verify_signed_cert:" 180 echo "Verifies the given certificate against the given CA certificate(s)" 181 echo "Usage:" 182 echo " verify_signed_cert <trusted_ca> [<intermediate_ca_bundle>] <certificate>" 183 echo 184 return 185 fi 186 if [ -z "$3" ]; then 187 ca_cert=$1 188 cert=$2 189 else 190 ca_cert=$1 191 untrusted="-untrusted $2" # Intermediate cert(s) 192 cert=$3 193 fi 194 openssl verify --CAfile $ca_cert $untrusted $cert 195 196 } 197 198 if [ "$1" == "runall" ]; then 199 run_all_cert_functions 200 fi