Created
June 26, 2019 14:49
-
-
Save yaroslav-shlapak/6550bcea86811301caa5d62defdbb8dd to your computer and use it in GitHub Desktop.
How to generate chain of two certificates with selfsigned CA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| DOMAIN ?= your.domain.com | |
| COUNTRY := US | |
| STATE := CA | |
| COMPANY := MetricInsights. | |
| # credits to: https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309 | |
| # usage: | |
| # make rootCA.crt # (rootCA.key implicitly created) | |
| # make DOMAIN=somedomain.dev somedomain.dev.csr somedomain.dev.crt or make DOMAIN=somedomain.dev | |
| # make DOMAIN=somedomain.dev verify-csr | |
| # make DOMAIN=somedomain.dev verify-crt | |
| # import rootCA.crt to the client (chrome) | |
| # upload somedomain.dev.crt and somedomain.dev.key to the host | |
| all: $(DOMAIN).csr $(DOMAIN).crt | |
| ca.key: | |
| openssl genrsa -out ca.key 4096 | |
| # create and self sign root certificate | |
| ca.crt: ca.key | |
| echo "$(COUNTRY)\n$(STATE)\n\n$(COMPANY)\n\n\n\n" | openssl req -x509 -new -nodes -key ca.key -sha256 -days 1024 -out $@ | |
| $(DOMAIN).key: | |
| openssl genrsa -out server.key 2048 | |
| $(DOMAIN).conf: | |
| sh mkconf.sh $(DOMAIN) >$@ | |
| $(DOMAIN).csr: $(DOMAIN).key $(DOMAIN).conf | |
| openssl req -new -sha256 -key server.key -subj "/C=$(COUNTRY)/ST=$(STATE)/O=$(COMPANY)/CN=$(DOMAIN)" \ | |
| -reqexts SAN \ | |
| -config $(DOMAIN).conf \ | |
| -out $@ | |
| # verify .csr content | |
| .PHONY: verify-csr | |
| verify-csr: | |
| openssl req -in $(DOMAIN).csr -noout -text | |
| $(DOMAIN).san.conf: | |
| sh mksan.sh $(DOMAIN) $(COUNTRY) $(STATE) "$(COMPANY)" >$@ | |
| $(DOMAIN).crt: ca.key ca.crt $(DOMAIN).csr $(DOMAIN).san.conf | |
| openssl x509 -req -in $(DOMAIN).csr -CA ./ca.crt -CAkey ./ca.key \ | |
| -CAcreateserial -out server.crt -days 1024 -sha256 \ | |
| -extfile $(DOMAIN).san.conf -extensions req_ext | |
| # verify the certificate | |
| .PHONY: verify-crt | |
| verify-crt: | |
| openssl x509 -in $(DOMAIN).crt -text -noout | |
| .PHONY: clean | |
| clean: | |
| -rm -f server.key $(DOMAIN).csr $(DOMAIN).conf $(DOMAIN).san.conf server.crt |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| cat <<EOF | |
| $(cat /etc/ssl/openssl.cnf) | |
| [SAN] | |
| subjectAltName=DNS:$1,DNS:www.$1 | |
| EOF |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| cat <<EOF | |
| [req] | |
| default_bits = 2048 | |
| distinguished_name = req_distinguished_name | |
| req_extensions = req_ext | |
| [req_distinguished_name] | |
| countryName = $2 | |
| stateOrProvinceName = $3 | |
| organizationName = $4 | |
| commonName = $1 | |
| [req_ext] | |
| subjectAltName = @alt_names | |
| [alt_names] | |
| DNS.1 = $1 | |
| DNS.2 = www.$1 | |
| EOF |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment