otca

#!/bin/bash

DIR=$(cd $(dirname $0); pwd -P)
source ${DIR}/config.sh

function usage {
	echo "USAGE:"
	echo "$(basename $0) create root                                                       : Create a root CA"
	echo "$(basename $0) create int                                                        : Create an intermediate CA"
	echo "$(basename $0) create server server_name [extension]                             : Create a server certificate"
	echo "$(basename $0) create p12 server_name                                            : Create a server certificate"
	echo "$(basename $0) create dhparam                                                    : Create a dhparam file"
	echo "$(basename $0) chain chain_name certs (use ca, int, server_name, key:server_name): Create a chain with the given cervificates in order"
	echo "$(basename $0) copy server_name new_server_name                                  : Copy a certificate to a new name"
	echo "$(basename $0) edit root                                                         : Edit the openssl.cnf of the root CA"
	echo "$(basename $0) edit int                                                          : Edit the openssl.cnf of the intermediate CA"
	echo "$(basename $0) index root                                                        : Edit the index of the root CA"
	echo "$(basename $0) index int                                                         : Edit the index of the intermediate CA"
	echo "$(basename $0) pack server_name                                                  : Pack the certificates into a tar archive"
	echo "$(basename $0) show server_name                                                  : Show content of certificate"
	echo "$(basename $0) rmpw server_name                                                  : Remove the password of the key"
	echo "$(basename $0) verify server_name                                                : Verify the ceritficate to match certificate chain"
	echo "$(basename $0) list certs                                                        : List certificates"
	echo "$(basename $0) help"
}

if [ "$1" == "help" -o $# -lt 1 ]; then
	usage
fi

if [ "$1" == "list" -a "$2" == "certs" ]; then
	ls -1 ${CA_INT}/certs	
fi

if [ "$1" == "verify" -a "$2" != "" ]; then
	SERVER="$2"
	${OPENSSL} verify -CAfile ${CA_INT}/certs/${CHAIN_NAME}.cert.pem \
      ${CA_INT}/certs/${SERVER}.cert.pem
fi

if [ "$1" == "edit" -a "$2" == "root" ]; then
	vi ${CA_ROOT}/openssl.cnf
fi

if [ "$1" == "edit" -a "$2" == "int" ]; then
	vi ${CA_INT}/openssl.cnf
fi

if [ "$1" == "index" -a "$2" == "root" ]; then
	vi ${CA_ROOT}/index.txt
fi

if [ "$1" == "index" -a "$2" == "int" ]; then
	vi ${CA_INT}/index.txt
fi

if [ "$1" == "pack" -a "$2" != "" ]; then
	SERVER="$2"
	mkdir -p ${CA_INT}/pack
	tar czf ${CA_INT}/pack/${SERVER}.tar.gz -C ${CA_INT} certs/${SERVER}.cert.pem private/${SERVER}.key.pem certs/${CHAIN_NAME}.cert.pem
fi

if [ "$1" == "show" -a "$2" != "" ]; then
	SERVER="$2"
	${OPENSSL} x509 -noout -text -in ${CA_INT}/certs/${SERVER}.cert.pem | less
fi

if [ "$1" == "rmpw" -a "$2" != "" ]; then
	SERVER="$2"
	${OPENSSL} rsa -in ${CA_INT}/private/${SERVER}.key.pem -out ${CA_INT}/private/${SERVER}.key.pem.tmp
	mv ${CA_INT}/private/${SERVER}.key.pem.tmp ${CA_INT}/private/${SERVER}.key.pem
fi

if [ "$1" == "create" -a "$2" == "dhparam" ]; then
	if [ ! -d ${CA_INT} ]; then
        echo "Intermediate CA does not exist in ${CA_INT}"
        exit 1
    fi
	cd ${CA_INT}
	${OPENSSL} dhparam -out certs/dhparam.pem 4096
fi

if [ "$1" == "create" -a "$2" == "root" ]; then
	if [ ! -z "$(ls -A ${CA_ROOT})" ]; then
		echo "Root CA already exist in ${CA_ROOT}"
		exit 1
	fi

	mkdir -p ${CA_ROOT}
	cd ${CA_ROOT}
	mkdir certs crl newcerts private
	chmod 700 private
	touch index.txt
	echo 1000 > serial

	cp ${DIR}/root_ca.cnf openssl.cnf
    sed -i.bak "s#_COUNTRY_#${COUNTRY}#g" openssl.cnf
    sed -i.bak "s#_STATE_#${STATE}#g" openssl.cnf
    sed -i.bak "s#_LOCALITY_#${LOCALITY}#g" openssl.cnf
    sed -i.bak "s#_OU_#${OU}#g" openssl.cnf
    sed -i.bak "s#_COMPANY_#${COMPANY}#g" openssl.cnf
    sed -i.bak "s#_EMAIL_#${EMAIL}#g" openssl.cnf
	#vi openssl.cnf

	${OPENSSL} genrsa -aes256 -out private/ca.key.pem 4096
	chmod 400 private/ca.key.pem
	
	${OPENSSL} req -config openssl.cnf \
      -key private/ca.key.pem \
      -new -x509 -days 7300 -sha256 -extensions v3_ca \
      -out certs/ca.cert.pem 

	chmod 444 certs/ca.cert.pem

	${OPENSSL} x509 -noout -text -in certs/ca.cert.pem
fi

if [ "$1" == "create" -a "$2" == "int" ]; then
	if [ -d ${CA_INT} ]; then
        echo "Intermediate CA already exist in ${CA_INT}"
        exit 1
    fi
	mkdir -p ${CA_INT}
	cd ${CA_INT}
	mkdir certs crl csr newcerts private
	chmod 700 private
	touch index.txt
	touch index.txt.attr
	echo 1000 > serial
	
	echo 1000 > ${CA_INT}/crlnumber

	cp ${DIR}/int_ca.cnf openssl.cnf
    sed -i.bak "s#_COUNTRY_#${COUNTRY}#g" openssl.cnf
    sed -i.bak "s#_STATE_#${STATE}#g" openssl.cnf
    sed -i.bak "s#_LOCALITY_#${LOCALITY}#g" openssl.cnf
    sed -i.bak "s#_OU_#${OU}#g" openssl.cnf
    sed -i.bak "s#_COMPANY_#${COMPANY}#g" openssl.cnf
    sed -i.bak "s#_EMAIL_#${EMAIL}#g" openssl.cnf
	#vi openssl.cnf
	
	${OPENSSL} genrsa -aes256 \
      -out private/${INT_NAME}.key.pem 4096

	chmod 400 private/${INT_NAME}.key.pem

	${OPENSSL} req -config openssl.cnf -new -sha256 \
      -key private/${INT_NAME}.key.pem \
      -out csr/${INT_NAME}.csr.pem	

	cd ${CA_ROOT}

	${OPENSSL} ca -config openssl.cnf -extensions v3_intermediate_ca \
      -days 3650 -notext -md sha256 \
      -in ${CA_INT}/csr/${INT_NAME}.csr.pem \
      -out ${CA_INT}/certs/${INT_NAME}.cert.pem
	
	chmod 444 ${CA_INT}/certs/${INT_NAME}.cert.pem

	${OPENSSL} verify -CAfile certs/ca.cert.pem \
      ${CA_INT}/certs/${INT_NAME}.cert.pem

	cat ${CA_INT}/certs/${INT_NAME}.cert.pem \
      certs/ca.cert.pem > ${CA_INT}/certs/${CHAIN_NAME}.cert.pem

	chmod 444 ${CA_INT}/certs/${CHAIN_NAME}.cert.pem
fi	

if [ "$1" == "create" -a "$2" == "server" -a "$3" != "" ]; then
	SERVER="$3"
	EXT_OPT="-extensions server_cert"
	if [ "$4" != "" ]; then
		EXT_OPT="-extensions $4"
	fi

	cd ${CA_INT}
	if [ -f private/${SERVER}.key.pem ]; then
		rm -f private/${SERVER}.key.pem
	fi

	${OPENSSL} genrsa -aes256 -passout pass:1234 \
      -out private/${SERVER}.key.pem 2048

    ${OPENSSL} rsa -in private/${SERVER}.key.pem -passin pass:1234 -out private/${SERVER}.key.pem.tmp
    mv private/${SERVER}.key.pem.tmp private/${SERVER}.key.pem

	chmod 400 private/${SERVER}.key.pem

	${OPENSSL} req -config openssl.cnf \
      -key private/${SERVER}.key.pem \
	  -passin pass:1234 \
      -new -sha256 -out csr/${SERVER}.csr.pem

	if [ -f certs/${SERVER}.cert.pem ]; then
        rm -f certs/${SERVER}.cert.pem
    fi

	${OPENSSL} ca -config openssl.cnf \
      ${EXT_OPT} -days 375 -notext -md sha256 \
      -in csr/${SERVER}.csr.pem \
      -out certs/${SERVER}.cert.pem

	chmod 444 certs/${SERVER}.cert.pem

	${OPENSSL} verify -CAfile certs/${CHAIN_NAME}.cert.pem \
      certs/${SERVER}.cert.pem
fi

if [ "$1" == "create" -a "$2" == "p12" -a "$3" != "" ]; then
	SERVER="$3"

	cd ${CA_INT}
	if [ ! -f certs/${SERVER}.cert.pem -o ! -f private/${SERVER}.key.pem ]; then
		echo "Server certificate for ${SERVER} does not exist!"
		exit 1
	fi

	${OPENSSL} pkcs12 -export -out certs/${SERVER}.p12 \
	  -inkey private/${SERVER}.key.pem -in certs/${SERVER}.cert.pem \
	  -certfile certs/${CHAIN_NAME}.cert.pem
fi

if [ "$1" == "copy" -a "$2" != "" -a "$3" != "" ]; then
	SERVER="$2"
	NEW_SERVER="$3"
	cd ${CA_INT}
	cp private/${SERVER}.key.pem private/${NEW_SERVER}.key.pem
	cp certs/${SERVER}.cert.pem certs/${NEW_SERVER}.cert.pem
fi

if [ "$1" == "chain" -a "$2" != "" ]; then
	CHAIN_NAME="$2"
	cd ${CA_INT}
	if [ -f certs/${CHAIN_NAME}.cert.pem ]; then
		rm -f certs/${CHAIN_NAME}.cert.pem
	fi
	shift 2
	for cert in $*
	do
		if [ "$cert" == "ca" ]; then
			cat ${CA_ROOT}/certs/ca.cert.pem  >> certs/${CHAIN_NAME}.cert.pem
		elif [ "$cert" == "int" ]; then
			cat certs/${INT_NAME}.cert.pem  >> certs/${CHAIN_NAME}.cert.pem
		elif [ ${cert:0:4} == "key:" ]; then
			cert=${cert:4}
			cat private/${cert}.key.pem >> certs/${CHAIN_NAME}.cert.pem
		else
			cat certs/${cert}.cert.pem  >> certs/${CHAIN_NAME}.cert.pem
		fi
	done
fi