1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
| #!/bin/bash
# The information assigned to the environment variables below will be included
# in the certificates generated by this script.
#
# The following environment variables should be assigned to valid values. This
# script will not work with quotes in any of the following environment
# variables.
############################################################################
# EDIT THE FOLLOWING LINES, WHICH CURRENTLY HAVE SAMPLE DEFAULTS.
# CHANGE THE VALUES AFTER THE '=' SYMBOL TO REFLECT YOUR SPECIFIC ENVIRONMENT.
#
#############################################################################
# Specify your country Specify your country [two letters only]
set OP_CERT_COUNTRY=CA
# Specify your state or province
set OP_CERT_STATE=QC
# Specify your city
set OP_CERT_LOCALITY=Trois-Rivieres
# Specify your company's name
set OP_CERT_ORG=UQTR
# This is the expiration for the CA and public certificates created by the CA;
# often will be 10 years or more.
set OP_CERT_CA_DAYS=3650
# This is the expiration for the Capture Manager certificates; might be 1 day,
# 30 days, etc., depending on policy.
set OP_CERT_CERT_DAYS=200
##########################################################
#
# END OF LINES THAT YOU SHOULD EDIT.
#
###########################################################
#Test de l'alimentation des variables
if [[ " $OP_CERT_COUNTRY" ]] || [[ " $OP_CERT_STATE" ]] || [[ " $OP_CERT_LOCALITY " ]] || [[ " $OP_CERT_ORG" ]] || [[ " $OP_CERT_CA_DAYS" ]] || [[ " $OP_CERT_CERT_DAYS" ]] ; then
echo "op_cert: please edit the environment variables at the start of this script file"
exit
#Test de l'option du script
function help()
{
echo "usage: op_cert command"
echo "commands:"
echo "dsaparam: generates DSA parameters"
echo "gencakey: generates the certificate authority's private and public keys"
echo "genmanager: generates the certificates used by the capture manager"
echo "help: displays this text"
echo "Certificate generation requires generating the DSA parameters first"
echo "If the DSA parameter file (dsaparam.pem) already exists, there is no"
echo "need to generate a new DSA parameter file"
exit 1
}
function dsaparam()
{
/usr/local/ssl/bin/openssl dsaparam -outform PEM -out dsaparam.pem 1024
}
function gencakey()
{
echo "===================================================================================================================="
echo "Generating the private and public keys for the certificate authority. This operation only needs to be done once."
echo "Enter the same passphrase three times. This passphrase should be kept secure."
echo "===================================================================================================================="
echo "[ req ]" > openssl.cnf
echo "default_bits = 1024" >> openssl.cnf
echo "default_keyfile = privkey.pem" >> openssl.cnf
echo "distinguished_name = req_distinguished_name" >> openssl.cnf
echo "prompt = no" >> openssl.cnf
echo "[ req_distinguished_name ]" >> openssl.cnf
echo "C = $OP_CERT_COUNTRY" >> openssl.cnf
echo "ST = $OP_CERT_STATE" >> openssl.cnf
echo "L = $OP_CERT_LOCALITY" >> openssl.cnf
echo "O = $OP_CERT_ORG" >> openssl.cnf
echo "CN = CA" >> openssl.cnf
/usr/local/ssl/bin/openssl req -config openssl.cnf -newkey dsa:dsaparam.pem -sha1 -keyout cakey.pem -outform PEM -out careq.pem
/usr/local/ssl/bin/openssl x509 -req -inform PEM -in careq.pem -sha1 -signkey cakey.pem -outform PEM -out ca.pem -days $OP_CERT_CA_DAYS
cp ca.pem cakey.pem casign.pem
rm -f cakey.pem careq.pem
echo "========================================================"
echo "This certificate will expire in $OP_CERT_CA_DAYS days."
echo "========================================================"
function genmanager()
{
echo "==================================================================================================="
echo "Generating the capture manager certificate."
echo "Enter the user's passphrase twice, followed by the certificate authority's passphrase."
echo "The user's passphrase is what he will type into ITGuru when opening the capture manager."
echo "==================================================================================================="
echo "[ req ]" > openssl.cnf
echo "default_bits = 1024" >> openssl.cnf
echo "default_keyfile = privkey.pem" >> openssl.cnf
echo "distinguished_name = req_distinguished_name" >> openssl.cnf
echo "prompt = no" >> openssl.cnf
echo "[ req_distinguished_name ]" >> openssl.cnf
echo "C = $OP_CERT_COUNTRY" >> openssl.cnf
echo "ST = $OP_CERT_STATE" >> openssl.cnf
echo "L = $OP_CERT_LOCALITY" >> openssl.cnf
echo "O = $OP_CERT_ORG" >> openssl.cnf
# Note that CN ("Commmon Name") is chosed to be different to make sure the output cert.pem does not appear to be self-signed.
echo "CN = manager certificate" >> openssl.cnf
/usr/local/ssl/bin/openssl req -config openssl.cnf -newkey dsa:dsaparam.pem -sha1 -keyout managerkey.pem -outform PEM -out managerreq.pem
/usr/local/ssl/bin/openssl x509 -req -inform PEM -in managerreq.pem -sha1 -CA casign.pem -CAkey casign.pem -CAcreateserial -outform PEM -out managercert.pem -days $OP_CERT_CERT_DAYS
cp managercert.pem+managerkey.pem+ca.pem cert.pem
rm managerkey.pem managerreq.pem managercert.pem casign.srl openssl.cnf
echo " ==========================================================="
echo " This certificate will expire in $OP_CERT_CERT_DAYS days."
echo " ============================================================"
} |
