Skip to Content.
Sympa Menu

sm-spell-submit - [SM-Spell-Submit]updated script to generate self-signed certificates, spell: httpd-dev

sm-spell-submit AT lists.ibiblio.org

Subject: Submit list for new spells

List archive

Chronological Thread  
  • From: Sergey A Lipnevich <sergeyli AT pisem.net>
  • To: Justin Rocha <jrocha AT sourcemage.org>, sm-spell-submit <sm-spell-submit AT lists.ibiblio.org>
  • Subject: [SM-Spell-Submit]updated script to generate self-signed certificates, spell: httpd-dev
  • Date: Thu, 17 Oct 2002 18:23:11 -0400

Hi Justin,

Here's another patch, for my httpd-dev spell. It expands the purpose of mksscert.sh (which generates self-signed CA certificate and a HTTPD certificate signed by this CA) to generate CA-signed certificates for other services. I used it to generate one for PostgreSQL (which needs a cert when compiled with OpenSSL support). I wrote this script because Apache 2 doesn't support the `make certificate' command of Apache 1.3 anymore. For some reason they think self-signed certificates are "less secure" ;-). Again, if you don't mind, I could commit it myself.
Thanks!

--Sergey.

Index: mksscert.sh
===================================================================
RCS file: /cvsroot/sourcemage/sourcemage/grimoire/http/httpd-dev/mksscert.sh,v
retrieving revision 1.2
diff -u -r1.2 mksscert.sh
--- mksscert.sh 2002/10/08 22:14:06 1.2
+++ mksscert.sh 2002/10/17 22:36:41
@@ -19,11 +19,12 @@
local -r CA_CRR=$CRR_DIR/ca-revokereq.pem

#
-# HTTPD attributes
- local -r HTTPD_KEY=$KEY_DIR/httpd-key.pem
- local -r HTTPD_CSR=$CSR_DIR/httpd-signreq.pem
- local -r HTTPD_CRT=$CRT_DIR/httpd-certificate.pem
- local -r HTTPD_CLR=$CRR_DIR/httpd-revokereq.pem
+# SERVICE attributes
+ local -r SERVICE=${1:-httpd}
+ local -r SERVICE_KEY=$KEY_DIR/$SERVICE-key.pem
+ local -r SERVICE_CSR=$CSR_DIR/$SERVICE-signreq.pem
+ local -r SERVICE_CRT=$CRT_DIR/$SERVICE-certificate.pem
+ local -r SERVICE_CLR=$CRR_DIR/$SERVICE-revokereq.pem

#
# Custom attributes
@@ -64,47 +65,49 @@
#
# Step 1d. CA certificate revocation request (CRR), just in case

+# TODO: do it
+
#
# Step 2a. Server keys
- if [ -e $HTTPD_KEY ]; then
- echo "-=* Server key: $HTTPD_KEY *=-"
+ if [ -e $SERVICE_KEY ]; then
+ echo "-=* Server key: $SERVICE_KEY *=-"
else
- echo "-=* Generating server key: $HTTPD_KEY *=-"
- openssl genrsa $RANDOMIZE -out $HTTPD_KEY $RSA_BITS || exit
+ echo "-=* Generating server key: $SERVICE_KEY *=-"
+ openssl genrsa $RANDOMIZE -out $SERVICE_KEY $RSA_BITS || exit

#
# New key means new certificate
- if [ -e $HTTPD_CSR ]; then mv -fv $HTTPD_CSR $HTTPD_CSR.$TIMESTAMP; fi
- if [ -e $HTTPD_CRT ]; then mv -fv $HTTPD_CRT $HTTPD_CRT.$TIMESTAMP; fi
- if [ -e $HTTPD_CRR ]; then mv -fv $HTTPD_CRR $HTTPD_CRR.$TIMESTAMP; fi
+ if [ -e $SERVICE_CSR ]; then mv -fv $SERVICE_CSR $SERVICE_CSR.$TIMESTAMP; fi
+ if [ -e $SERVICE_CRT ]; then mv -fv $SERVICE_CRT $SERVICE_CRT.$TIMESTAMP; fi
+ if [ -e $SERVICE_CRR ]; then mv -fv $SERVICE_CRR $SERVICE_CRR.$TIMESTAMP; fi
fi

#
# Step 2b. Server certificate signing request
- if [ -e $HTTPD_CSR ]; then
- echo "-=* Server certificate signing request: $HTTPD_CSR *=-"
- elif ! [ -e $HTTPD_CRT ]; then
- echo "-=* Generating server certificate signing request: $HTTPD_CSR *=-"
+ if [ -e $SERVICE_CSR ]; then
+ echo "-=* Server certificate signing request: $SERVICE_CSR *=-"
+ elif ! [ -e $SERVICE_CRT ]; then
+ echo "-=* Generating server certificate signing request: $SERVICE_CSR *=-"
echo "Specify server's FQDN as Common Name (CN)"
- openssl req -new -key $HTTPD_KEY -out $HTTPD_CSR || exit
+ openssl req -new -key $SERVICE_KEY -out $SERVICE_CSR || exit
fi

#
# Step 2c. Server certificate, signed by CA
- if [ -s $HTTPD_CRT ]; then
- echo "-=* Server certificate: $HTTPD_CRT *=-"
+ if [ -s $SERVICE_CRT ]; then
+ echo "-=* Server certificate: $SERVICE_CRT *=-"
else
- if [ -e $HTTPD_CRT ]; then
- echo "-=* Deleting zero-length server certificate: $HTTPD_CRT *=-"
- rm -f $HTTPD_CRT
+ if [ -e $SERVICE_CRT ]; then
+ echo "-=* Deleting zero-length server certificate: $SERVICE_CRT *=-"
+ rm -f $SERVICE_CRT
fi

- echo "-=* Generating server certificate: $HTTPD_CRT *=-"
+ echo "-=* Generating server certificate: $SERVICE_CRT *=-"
if ! [ -w $CA_SRL ]; then
if ! [ -s $CA_SRL ]; then echo "01" > $CA_SRL; fi
chmod u+rw $CA_SRL
fi
- openssl x509 -days 1024 -CA $CA_CRT -CAkey $CA_KEY -CAserial $CA_SRL -in $HTTPD_CSR -req
-out $HTTPD_CRT || exit
+ openssl x509 -days 1024 -CA $CA_CRT -CAkey $CA_KEY -CAserial $CA_SRL -in $SERVICE_CSR -r
eq -out $SERVICE_CRT || exit
echo "-=* Done! *=-"
fi
}
@@ -112,10 +115,16 @@
#
# Step 2d. Server certificate revocation request (CRR), just in case

+# TODO: do it
+
+#
+# Switch context to root if we're not the one
if [ "$UID" != 0 ]; then
echo "Switching to root..."
su - -c "$PWD/$0 $*"
exit
fi

-generate_self_signed_certificate
+#
+# Main function
+generate_self_signed_certificate "$@"


ðÏÌÕÞÉÔÅ ÂÅÓÐÌÁÔÎÙÊ ÐÏÞÔÏ×ÙÊ ÑÝÉË 20í ÎÁ http://www.hotbox.ru

  • [SM-Spell-Submit]updated script to generate self-signed certificates, spell: httpd-dev, Sergey A Lipnevich, 10/17/2002

Archive powered by MHonArc 2.6.24.

Top of Page